Privacy Policy

This policy is from Dycern LLC, an Indiana limited liability company doing business as Xtimates ("Xtimates", "we", "us"). It explains what we collect through xtimates.com, the client dashboard at https://app.xtimates.com, and the emails we send, and what you can do about it.

It covers four groups of people:

• Visitors to xtimates.com, including anyone who opens a link from one of our emails or asks for a website audit.
• Clients: the home-service companies that hire us, and the people on their team who use the dashboard.
• Homeowners: people who ask one of our clients for a price. The client is in charge of that information. We handle it on the client's behalf under our Data Processing Addendum (xtimates.com/legal/dpa).
• Partners and developers who send data to the platform or read usage from it under our Developer Terms (xtimates.com/legal/developer-terms).

What you type in. When you check whether your area is open, start signup, or ask us to contact you, we collect what you enter: your name, company, trade, city, website address, email and phone number.

Links from our emails. A link in one of our emails can carry your first name, company, trade, city and website address so the page greets you by name. We keep those five things, and nothing else, in a first-party session cookie named xt_visitor. We set it, only we read it, and it expires when you close your browser. Pages personalized this way are marked so search engines don't index them. The Cookie Policy (xtimates.com/legal/cookies) has the details.

The website audit. If you ask for an audit, you name a public website. Our audit tool loads that site the way a visitor would, records what's on it (forms, phone links, page speed, tracking tags, titles and headings, schema, reviews and photos) and takes screenshots. We keep the report so you can read it and so we can show it to you again in onboarding. We only audit a site you name, and we never sign in to anything.

Booking a call. If you book a call, the scheduling page collects the time you pick and the details you enter. The scheduling page is run by a scheduling provider under its own privacy policy.

Paying. Stripe collects your card or bank details on our payment form. We receive a record of the payment (amount, date, plan, a Stripe customer reference, and the last 4 digits of the card or the bank's name). The full card number never reaches our servers.

Analytics. We use first-party analytics and may use Google Analytics 4. There are no advertising cookies on the marketing site.

Server logs. Our host keeps short-lived logs of requests (internet address, browser, page requested, time) to keep the site running and to stop abuse.

Your account. Your name, email, phone, company name, legal name, address, time zone, website, logo, the trades and service areas you serve, and the people you invite with their roles (owner, admin or member).

Billing. Stripe handles payment details. We keep your invoices, your plan, and the last 4 digits of the card or the bank's name so you can recognize the payment method.

What you do in the dashboard. Sign-ins, settings you change, the stage and source of each estimate request and who changed it, notes, flags, messages you send to support, and questions you ask Ask Xtimates.

Accounts you connect. Only when you connect them, and only with read access to the products you pick:

• Google: Google Ads performance (spend, impressions, clicks, conversions by campaign and ad group), Google Analytics 4 website traffic (visits, key actions, sources, landing pages, devices, cities), Search Console search performance (queries, pages, clicks, impressions, position), and the rows of a Google Sheet you choose.
• Facebook and Instagram (Meta): ad account performance by campaign, ad set and ad; your Page's basic details; and the entries from the instant forms you connect (name, phone, email and the answers to your form's questions).
• HubSpot, GoHighLevel and Jobber: contacts, estimate requests, jobs and their values, so your board matches your CRM.
• Your own website forms, Zapier, Make or a custom webhook, and CSV files you import: the estimate requests they carry.

Connections use OAuth, so we never see your Google or Facebook password. The tokens they give us are encrypted at rest with AES-256-GCM. Data syncs about every 5 minutes. You can disconnect any account at any time in Settings › Connections.

When someone asks one of our clients for a price, we receive what they entered or said: name, phone, email, address or town, what the job is, and where the request came from (which ad, page, form or source). We also keep what the client records about it: stage, appointment outcome, notes, and whether it became a job.

That information belongs to the client. We handle it only to run the client's system, count estimates for billing and the guarantee, and show the client its results. We never send it to another client, and we never use it to market to the homeowner ourselves. If you're a homeowner and want to see or delete your information, contact the contractor you asked for a price. If you contact us instead at privacy@xtimates.com, we'll pass the request on and help them handle it.

• To check whether your area is open and whether we're a fit, and to reply when you contact us.
• To build and run your system: your website, your Google presence, and the ads in your own Facebook and Google accounts.
• To log every estimate request with its source and show your results in your dashboard.
• To count estimates for billing and for the money-back guarantee.
• To send you account, billing, estimate and guarantee notifications by email.
• To answer questions you ask in Ask Xtimates, using only your own numbers.
• To keep the site and the dashboard secure, to find and fix problems, and to meet our legal duties.

We don't sell personal information, and we never have. We don't share it for other companies' advertising. We don't run ads to homeowners on our own behalf. The only advertising we do is inside a client's own accounts, for that client.

Xtimates's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

• We request read access only, and only for the Google products you connect: Google Ads, Google Analytics 4, Search Console, and the Google Sheet you choose.
• We use that data only to show you your own results in your dashboard and to run your system.
• We don't use it for advertising, we don't sell it, and nobody on our team reads it unless you ask us to (for support), it's needed for security, or the law requires it.
• We don't use Google user data to build or train general-purpose AI models.
• You can remove our access at any time at myaccount.google.com/permissions or in Settings › Connections.

We use data from Meta (ad performance, Page details and instant form entries) only to show you your results, deliver the entries to your estimates board, and run your ads. We don't share it with anyone except the processors below, and we delete it when you disconnect or ask. The Data Deletion (xtimates.com/legal/data-deletion) page explains how, including Meta's data-deletion callback.

Ask Xtimates answers questions about your own account by reading a fixed set of read-only tools (overview, Facebook, Google Ads, billing and guarantee numbers) and sending the question and those numbers to Anthropic's model. The "Draft a follow-up" button on an estimate sends that estimate's details to the same model and gives you text to copy. Nothing is sent to a homeowner automatically. Anthropic doesn't train on what we send it, and neither do we. The AI Terms (xtimates.com/legal/ai-terms) have the full description.

We share information only with the providers that run parts of the service for us, under contracts that limit what they can do with it:

We may also share information when the law requires it, to protect someone's safety or our rights, or as part of a sale or merger of the business, in which case this policy keeps applying to it.

• Clients: while you're a client, plus 30 days after the service ends so you can export your data, unless you ask us to delete it sooner.
• Deleted accounts: removed from our live database within 30 days of a confirmed request, and from provider backups within 90 days.
• Invoices and payment records: 7 years, as tax law requires.
• Homeowner estimate requests: as long as the client keeps them, or until the client or the homeowner asks us to delete them.
• Site inquiries that never became clients: until you ask us to delete them, or until we no longer have a reason to keep them.
• Audit reports: until you delete them or ask us to.

We're a United States company and most of our clients are in the United States. If you live in California, the CCPA and CPRA give you specific rights. If you live somewhere with GDPR-style law, you have similar rights. We honor them for everyone, wherever you live:

• To know what personal information we have about you and where it came from.
• To get a copy of it in a usable format.
• To correct it.
• To have it deleted, subject to what we have to keep for tax or legal reasons.
• To opt out of the sale or sharing of personal information. We don't sell or share it, so there's nothing to opt out of.
• To limit the use of sensitive personal information. We don't collect any.
• Not to be treated differently for using these rights.

To use any of them, email privacy@xtimates.com from the email address we know you by, or use the Help page in your dashboard. We'll confirm it's you, then answer within 45 days. You can have someone ask on your behalf if they can show you authorized them. Homeowners should ask the contractor first, as explained above.

Marketing email. Every marketing email we send has an unsubscribe link, and we stop when you use it. Account, billing and security emails still go out while you have an account, because the service needs them.

Xtimates is a service for businesses. We don't serve anyone under 18, and we don't knowingly collect information from anyone under 18. If you think we have, email privacy@xtimates.com and we'll delete it.

Everything between your browser and us travels over HTTPS. Connection tokens are encrypted at rest. Each client's rows are fenced at the database with row-level security, and Stripe holds card data so we don't have to. The Security (xtimates.com/legal/security) page lists what we do and how to report a problem. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

When what we do changes, we'll update this page and the date at the top. If a change matters to clients, we'll email them before it takes effect.

Dycern LLC, doing business as Xtimates, Indiana, USA. For any privacy question or request, email privacy@xtimates.com. For anything else, support@xtimates.com.

This policy is governed by the laws of the State of Indiana.