Legal

Privacy Policy

Effective date: July 21, 2026

This Privacy Policy explains how Ratchly ("Ratchly", "we", "us", or "our") collects, uses, discloses, and safeguards information when you use our job management platform, marketing website, and related services (collectively, the "Service"). It applies to HVAC shop owners and their team members ("Tenants"), the end-customers Tenants serve, and visitors to ratchly.com.

1. Our role

For account, billing, and platform-usage data, Ratchly acts as a data controller. For the customer records, jobs, invoices, and messages that Tenants create and manage inside the Service, Ratchly acts as a data processor on behalf of the Tenant, who is the controller of that data.

2. Information we collect

  • Account data: name, email, password hash, business name, phone number, role, and profile settings.
  • Business data: customers, jobs, estimates, invoices, schedules, inventory, checklists, photos, notes, and messages that Tenants and their technicians create.
  • Payment data: subscription and payment metadata handled by Stripe. Full card numbers are never stored on Ratchly servers.
  • Communications data: SMS and email metadata (recipient, timestamp, delivery status) handled by Twilio and our email provider.
  • Usage & device data: log data, IP address, browser and device info, referrer, and feature-usage events used for security and product improvement.
  • Cookies & similar: essential cookies for session and authentication, and limited analytics cookies to understand product performance.

3. How we use information

  • Provide, operate, and maintain the Service.
  • Process subscriptions, invoices, and payments.
  • Send transactional messages (receipts, appointment confirmations, password resets).
  • Provide customer support and respond to inquiries.
  • Detect, investigate, and prevent fraud, abuse, and security incidents.
  • Improve product features, reliability, and performance.
  • Comply with legal obligations and enforce our Terms.

4. Legal bases (EEA / UK users)

Where the GDPR or UK GDPR applies, we rely on the following bases: (a) performance of a contract (delivering the Service you signed up for), (b) legitimate interests (securing and improving the Service, provided your rights are not overridden), (c) consent (where required, for example for certain analytics), and (d) compliance with legal obligations.

5. Sharing and subprocessors

We do not sell personal information. We share data only with service providers who process it on our behalf under contractual confidentiality and security obligations. Current subprocessors include:

  • Supabase — managed database, authentication, storage, and edge functions.
  • Cloudflare — hosting, edge compute, CDN, and DDoS protection.
  • Stripe — subscription billing and payment processing.
  • Twilio — SMS delivery.
  • Resend — transactional email delivery.

We may also disclose information when required by law, to protect rights or safety, or in connection with a merger, acquisition, or sale of assets, in which case we will provide notice before your information becomes subject to a different privacy policy.

6. International transfers

Data may be processed in the United States and other countries where we or our subprocessors operate. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

7. Data retention

We retain personal information for as long as your account is active and for a reasonable period after to comply with legal obligations, resolve disputes, and enforce agreements. Billing records may be retained longer where required by tax and accounting law. Tenants may export or request deletion of their data at any time.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to our processing of your personal information, and to withdraw consent. California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and to non-discrimination for exercising those rights. To exercise a right, email support@ratchly.com. You may also lodge a complaint with your local data protection authority.

If your data was entered into the Service by a Tenant (for example, you are a customer of an HVAC shop that uses Ratchly), please contact that Tenant directly for access or deletion requests. We will assist them in responding to your request.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including HTTPS in transit, encryption at rest via our managed cloud provider, tenant-scoped row-level access rules, least-privilege access controls, and monitoring. No method of transmission or storage is 100% secure.

10. Children

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Cookies

We use cookies and similar technologies that are strictly necessary to run the Service (session, authentication, security) and limited analytics to understand feature usage. You can control cookies through your browser settings; disabling essential cookies may break sign-in and other core features.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date and, where appropriate, notify you by email or in-app notice.

13. Contact us

Questions about this Policy or our privacy practices? Email support@ratchly.com. See our Terms of Service and Trust & Security page for related details.