Legal

Informic LLC, doing business as "Notify" ("Informic," "Notify," "we," "us," or "our"), provides an AI-powered chat, booking, and lead management platform for home service businesses. This Privacy Policy explains how we collect, use, disclose, and protect personal information through our website, chat widget, dashboard, and related services (collectively, the "Service").

Please read this Policy together with our Master Service Agreement.

1. SCOPE AND WHO THIS POLICY COVERS

This Policy applies to two distinct groups:

Business Clients — contractors and businesses who create a Notify account to deploy our chat widget and use our dashboard.

Visitors — end customers who interact with a Notify chat widget embedded on a Business Client's website.

Important distinction regarding Visitors: When a Visitor interacts with a chat widget on a Business Client's website, that Business Client determines what information is collected and how it is used. In privacy terms, the Business Client acts as the controller of that information, and Notify acts as a processor or service provider processing that information on the Business Client's behalf and under its instructions. Visitors with questions or requests about their information should contact the business whose website they used. We will assist that business in responding.

This processor relationship is established contractually in the Data Processing Addendum (Exhibit A to our Master Service Agreement), which contains the service-provider and processor terms required by the CCPA and comparable state privacy laws.

For information we collect directly from Business Clients and from visitors to our own marketing website, Notify acts as the controller.

This Policy does not apply to any Business Client's own website, privacy practices, or offline operations.

2. INFORMATION WE COLLECT

2.1 Information We Collect From Business Clients

2.2 Information We Collect From Visitors (On Behalf of Business Clients)

2.3 Information We Do Not Seek. We do not seek, and Business Clients are contractually prohibited from configuring the Service to solicit, Social Security numbers or other government identification numbers; full payment card or financial account numbers; health, medical, or diagnostic information subject to HIPAA; biometric identifiers; precise device geolocation; information about racial or ethnic origin, religion, sexual orientation, or political affiliation; or information about individuals known to be under 13. A service address provided to arrange a job is collected as service-request information; the Service does not require device GPS access.

Visitors may nonetheless volunteer sensitive information in free-text messages or uploaded images. If submitted, it may be stored in the conversation and transmitted through Lovable's managed AI Gateway to Claude as part of answering the request, assessing a job photo, or drafting an authorized follow-up. We do not represent that this content is only stored or that it is automatically removed before AI processing. We do not use it for advertising, unrelated profiling, or model training. Visitors should avoid submitting sensitive information and direct deletion requests to the relevant business; we will assist that business under the Data Processing Addendum and applicable law.

2.4 Cookies and Similar Technologies We use a limited set of cookies and similar technologies:

• Strictly necessary: maintaining login sessions, security, and load balancing. These cannot be disabled without breaking the Service.
• Functional: remembering whether a chat window is open or closed, and preferences.
• Attribution: UTM parameters passed in URLs to understand which marketing links produce signups.

We do not use cookies for third-party advertising, cross-site behavioral advertising, or ad retargeting. We do not currently respond to browser "Do Not Track" signals, as no common standard for them has been adopted. We do honor Global Privacy Control (GPC) signals where required by applicable law.

3. HOW WE USE INFORMATION

We use personal information for the following purposes:

3.1 To provide the Service: operate the AI chat assistant; generate responses, estimates, and urgency classifications; check calendar availability and create bookings; capture and store leads; deliver notifications and alerts to Business Clients.

3.2 To communicate: send transactional messages (booking confirmations, urgent-job alerts, account and security notices); send optional daily or weekly activity summary emails according to the Business Client's preference; when a Business Client turns on automated follow-ups, send follow-up emails in that business's name to Visitors who gave an email address, each with an unsubscribe link; respond to support inquiries.

3.3 To process payments: manage subscriptions, billing, renewals, plan changes, and collections through our payment processor.

3.4 To secure and maintain the Service: detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents; enforce our terms; debug and repair errors.

3.5 To improve the Service: analyze usage patterns, measure feature adoption, and improve functionality, primarily using aggregated and de-identified data.

3.6 To comply with law: meet legal, regulatory, tax, accounting, and law enforcement obligations; establish, exercise, or defend legal claims.

3.7 Legal bases (where applicable law requires one): performance of a contract; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and consent, where required (for example, for push notifications, which require your affirmative device permission).

4. ARTIFICIAL INTELLIGENCE DISCLOSURE

4.1 The Notify chat widget uses an artificial intelligence language model. AI-generated messages are automated, not human responses. If an authorized person from the business takes over the conversation, that person's replies are marked "From the team." A business may not remove the AI disclosure or misrepresent AI-generated messages as human replies.

4.2 Chat messages and the business information needed to answer them (such as services, prices, hours, and availability) are sent through Lovable's managed AI Gateway to Anthropic Claude to generate responses. Uploaded job photos use the same managed service. For automated follow-ups, relevant conversation details, such as the Visitor's name, the job discussed, and quote or appointment details, are sent through that service to draft the email. Lovable is the managed AI intermediary; this is not a direct Anthropic API account maintained by Notify. We do not use this personal information to train AI models and require no-training protections in the managed processing chain under Section 4.5.1 of the Data Processing Addendum. General published provider policies do not, by themselves, verify gateway-specific retention or all processing locations. Sections 6.8 and 10 explain these distinctions, and our Sub-processor Page identifies the relevant roles.

4.3 AI-generated responses, including price estimates and urgency assessments, are automated and may be inaccurate. They are informational only and do not constitute a binding quote, offer, or professional advice.

4.4 The Service performs automated classification of message urgency to route alerts. It is not designed or authorized to make legal, eligibility, or similarly significant decisions concerning an individual. A Business Client remains responsible for its decisions and may not configure the Service to make prohibited determinations. An individual may contact the relevant business directly rather than using the chat.

4.5 The chat assistant is not an emergency service. If you are experiencing an emergency involving danger to life or property, contact 911 or the appropriate emergency or utility service directly.

5. HOW WE SHARE INFORMATION

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not sold or shared personal information for such purposes in the preceding twelve (12) months.

We disclose information in the following circumstances:

5.1 With the relevant Business Client. Leads, conversations, uploaded images, and bookings generated through a Business Client's chat widget are made available to that Business Client. Business Clients cannot access any other Business Client's data.

5.2 With service providers and sub-processors. We share information with vendors who perform functions on our behalf under contractual confidentiality and data protection obligations. Categories include: cloud hosting and database infrastructure; AI model providers; calendar and authentication integrations; payment processing;

transactional email delivery; push notification delivery; and content delivery/performance infrastructure.

Our Sub-processor Page at https://notify.informic.app/legal/subprocessors identifies the vendors, functions, information categories, and known location scope. We update that page when relevant arrangements change. We will send required change notices to affected Business Clients using their account notice details; Clients may contact us to update those details or request an additional notification recipient. Notice, objection, termination, and refund rights are governed by Sections 10.4 and 10.4.1 of the Data Processing Addendum. Listing a change on that page does not remove required advance notice or make a material change exempt from Section 13.

5.3 For legal reasons. We may disclose information where we believe in good faith that it is required by law, regulation, subpoena, court order, or other valid legal process; to enforce our agreements; to investigate potential violations; or to protect the rights, property, safety, or security of Informic, our users, or the public. Where legally permitted, we will make reasonable efforts to notify the affected Business Client before disclosure.

5.4 Business transfers. If Informic is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, information may be transferred as part of that transaction. We will provide notice of any such transfer and any material change to this Policy resulting from it.

5.5 Aggregated and de-identified information. We may create and use aggregated or de-identified information that cannot reasonably be used to identify any individual, for any lawful purpose including benchmarking and product improvement. We commit to maintaining such information in de-identified form and not to attempt to re-identify it, except as permitted by law to test de-identification.

5.6 With your direction or consent. We share information as you direct or authorize, including relevant lead and booking details with an external service you configure through an outbound webhook. Such a service is chosen by the Business Client and is governed by that service's own terms and the Business Client's responsibilities.

6. DATA RETENTION

6.1 Business Client account data: retained for the duration of the account, and for up to seven (7) years after closure where necessary for tax, accounting, and legal recordkeeping.

6.2 Lead, conversation, and booking data: retained while the associated Business Client's account remains active. Business Clients may request deletion of individual records at any time, and we will provide deletion functionality or technical assistance under the Data Processing Addendum. Removing a lead from the dashboard can mark it as removed without erasing its stored transcript, photos, or related records; that display change is not confirmation of completed privacy deletion. Contact us for assistance with actual erasure, subject to applicable legal exceptions.

6.3 Uploaded images: retained alongside the associated conversation record, subject to the same retention period.

6.4 Following account termination: Business Clients may request an export of Client Data during the thirty (30) day Export Window, and we will provide the requested export, including assistance for information not included in the self-service lead export. When the window expires, or earlier at the Business Client's written direction, we will delete Client Data from active production systems, subject to the retention exceptions in Section 6.6 of the Master Service Agreement and Section 9.3 of the Data Processing Addendum. A dashboard status or internal cleanup marker is not, by itself, certification that all related records and photos have been erased.

6.5 Backups: residual copies may persist in encrypted backup systems until those backups cycle out under the applicable recovery schedule. Retention is determined by disaster-recovery needs, the applicable provider schedule, and legal requirements, not indefinite ordinary Service use. Retained copies are restricted from ordinary use, and applicable deletion instructions will be reapplied if a backup is restored. Available information about the relevant backup schedule may be requested using the contact details in Section 14.

6.6 Logs: security and diagnostic logs are retained only for as long as reasonably necessary to investigate incidents, prevent abuse, diagnose faults, or meet a specific legal recordkeeping requirement. The scope and duration depend on the event, the information needed for those purposes, and any applicable legal hold. Logs containing Client Personal Information remain subject to the Data Processing Addendum; their designation as logs does not exempt them from its deletion and retention requirements.

6.7 Legal holds: we retain information longer where required to comply with legal obligations, resolve disputes, or enforce agreements. For Client Data, retention after termination is limited to the exceptions in Section 6.6 of the Master Service Agreement and Section 9.3 of the Data Processing Addendum. Where legally required to honor an email opt-out, we may retain minimal suppression information after deletion of the associated lead or account; that information is restricted to preventing prohibited renewed communication and does not permit retaining an entire conversation for that purpose.

6.8 Managed AI processing: gateway and upstream-provider retention are separate from Notify's own record retention. Anthropic's general commercial API policy describes deletion of inputs and outputs ordinarily within 30 days, with exceptions for different agreements, particular features or models, safety enforcement, and legal requirements. Those general terms do not establish the retention period applicable to Lovable's gateway or its upstream account. We do not represent that this route has zero retention or a verified end-to-end 30-day maximum. We will provide available information about the applicable arrangements on request; this disclosure does not remove Company's deletion, confidentiality, no-training, or remediation obligations under the Data Processing Addendum.

7. SECURITY

7.1 We implement commercially reasonable measures designed to protect personal information, including TLS in transit; encryption at rest; hashed password storage; row-level access controls separating Business Client accounts; and restricted administrative access. Private platform and AI-provider credentials are kept server-side, not exposed to customer browsers. Public client configuration is not a private credential. Authorized, authenticated Business Clients may view or manage their own integration credentials, including webhook signing secrets; those credentials are not made available to other Business Clients or Visitors.

7.2 No system is completely secure. We cannot and do not guarantee that unauthorized access, hardware or software failure, or other factors will never compromise information. You use the Service at your own risk and are responsible for maintaining the security of your own credentials and devices.

7.3 Incident notification. If we become aware of a security incident affecting personal information, we will notify affected Business Clients and, where required, individuals and regulators, without undue delay and consistent with applicable law.

8. YOUR PRIVACY RIGHTS

8.1 Rights That May Apply to You Depending on where you live, you may have some or all of the following rights:

• Access / Know — request confirmation of whether we process your personal information and obtain a copy, including the categories collected, sources, purposes, and recipients.
• Correction — request correction of inaccurate personal information.
• Deletion — request deletion of your personal information, subject to legal exceptions.
• Portability — receive your information in a portable, machine-readable format.
• Opt out of sale, sharing, targeted advertising, and certain profiling — where applicable law provides these rights. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Our urgency classification is described in Section 4.4. Contact the relevant Business Client for processing it controls, or contact us for processing we control.
• Limit use of sensitive personal information — request restrictions where applicable law grants this right; contact the relevant Business Client for information collected on its behalf, or contact us for information we control.
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
• Appeal — if we deny your request, you may appeal our decision as described in Section 8.4.

State-specific note: Residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other U.S. states with comprehensive privacy laws have rights under those laws. The specific rights available to you, and any exceptions, are governed by the law of your state of residence.

8.2 How to Exercise Your Rights If you are a Visitor who interacted with a chat widget on a business's website: please contact that business directly, as they control your information. If you contact us instead, we will forward your request to the relevant business and assist them in responding.

If you are a Business Client or interacted with our own marketing website: contact us using the details in Section 14.

We will respond within the timeframe required by applicable law (generally 45 days, extendable where permitted). We may need to verify your identity before acting, and may decline requests where an exception applies. An authorized agent may submit a request on your behalf with proof of authorization. We will request identity verification only where permitted and appropriate for the request; applicable opt-out preference signals and requests that do not legally require verification will not be conditioned on identity verification.

8.3 California Shine the Light California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

8.4 Appeals If we decline your request, you may appeal by replying to our decision with the word "Appeal" and an explanation. We will respond to appeals within the period required by applicable law. If your appeal is denied, you may contact your state Attorney General.

9. CHILDREN'S PRIVACY

The Service is intended for use by businesses and adults. We do not knowingly collect personal information from children under 13, and the Service is not directed to children. If we learn we have collected such information, we will delete it promptly. If you believe a child has provided information through the Service, contact us using the details in Section 14.

10. GEOGRAPHIC SCOPE AND DATA LOCATION

The Service is operated from, offered in, and intended solely for use within the United States. We do not target, market to, or knowingly offer the Service to individuals or businesses in the European Economic Area, the United Kingdom, or Switzerland, and the Service is not intended for use by such persons.

Notify's application database is hosted in the United States, and customer-content AI requests are configured for US model inference with a check of the inference location reported by the managed service. Model inference location is distinct from gateway ingress, storage, logs, backups, safety review, support, and other vendors' processing. We have not independently confirmed that every such activity occurs exclusively in the United States, so this page does not present US inference as proof of end-to-end US-only handling. The Sub-processor Page distinguishes confirmed location scope from matters requiring provider confirmation. If you access the Service from outside the United States, your information is transferred to the United States for the stated hosting and inference, and may be handled elsewhere by service providers under their applicable arrangements; data protection laws may differ from those where you live.

11. BUSINESS CLIENT RESPONSIBILITIES

If you are a Business Client deploying the Notify widget, you are responsible for:

• maintaining your own privacy policy accurately describing your data practices;
• obtaining any consents and providing any disclosures required by applicable law before collecting information from your customers;
• disclosing, where required by law, that customers are interacting with an automated system;
• responding to privacy rights requests from your own customers; and
• complying with all laws applicable to your communications with your customers.

12. THIRD-PARTY LINKS AND SERVICES

The Service may contain links to third-party websites and integrate with third-party services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies. This provision does not remove our obligations for providers processing personal information on our behalf under the Data Processing Addendum.

13. CHANGES TO THIS POLICY

We may update this Policy and post a new Last Updated date. Material contractual changes are subject to Section 19.10 of the Master Service Agreement, including at least fifteen (15) days' advance notice before those changes take effect. A factual disclosure update does not waive accrued rights or cure prior noncompliance.

14. CONTACT US

For privacy requests, please include enough detail for us to identify your records and specify which right you are exercising.