Privacy Policy

1. Introduction & Commitment to Privacy

At OnderVolk Inc. (“OnderVolk,” “we,” “us,” or “our”), we take your privacy and the security of your business and customer data with the utmost seriousness. This Privacy Policy explains how we collect, use, process, disclose, and protect personal and commercial information when you access our website, applications, trade tools, customer invoice portals, and payment services.

We operate under a simple principle: We do not sell your personal data or your customer list to third-party data brokers or advertisers.

2. Information We Collect

We collect information across two categories of users: Contractors (account holders) and End Customers (homeowners/clients viewing estimates or paying invoices).

A. Contractor & Business Information

• Account Identifiers: Name, trade company name, business phone number, email address, physical address, trade specialization (e.g. electrical, plumbing, HVAC, roofing, landscaping).
• Price Book & Margin Data: Wholesale item catalogs, labor hourly rates, equipment configurations, and target margin settings.
• Billing & Payout Information: Stripe Connect merchant identifiers, tax IDs (processed securely by Stripe for 1099 compliance), and subscription payment methods.

B. End Customer / Homeowner Information (Provided by Contractor or Customer)

• Contact & Property Details: Customer name, job site service address, phone number, and email address.
• Job Scope & Invoicing Details: Approved estimate line items, labor hours, material selections, and invoice balances.
• Equipment & Warranty Passport Records: Equipment brand, model serial numbers, installation dates, warranty expiration terms, and filter/part specifications.
• Customer Feedback & Ratings: 1-to-5 star satisfaction ratings, private feedback messages, and published customer reviews.

C. Automated Technical & Log Data

• IP addresses, browser type, device identifiers, operating system version, access timestamps, and session security tokens for link verification.

3. Payment Information & PCI-DSS Compliance

All customer payment transactions, Apple Pay, Google Pay, and credit card payments are securely handled directly by our payment processor, Stripe, Inc., which is certified as a PCI Service Provider Level 1 (the highest standard in the payments industry). When you submit card information, it is encrypted and sent directly to Stripe via end-to-end tokenization. OnderVolk only receives payment confirmation tokens and transaction status metadata.

4. How We Use Your Information

We use the collected information solely for legitimate operational and business purposes, including:

• Generating and delivering itemized estimates, quotes, change orders, and invoices.
• Facilitating secure 1-tap client payments and updating contractor revenue ledgers.
• Maintaining digital Equipment & Warranty Passports for homeowners.
• Sending transactional SMS and email notifications (e.g., “Your estimate is ready,” “Payment receipt,” “Annual tune-up reminder”).
• Protecting the Platform against fraud, unauthorized access, chargeback abuse, and security threats.
• Providing customer support and improving field calculator algorithms.

5. SMS / Text Messaging Policy (TCPA & 10DLC)

OnderVolk strictly enforces anti-spam and TCPA compliance for transactional SMS communications.

• SMS messages sent through the platform are strictly transactional service notifications requested by the contractor or customer.
• We do NOT use customer phone numbers for marketing campaigns, promotional blast texts, or affiliate solicitations.
• Recipients may unsubscribe from automated reminders at any time by replying “STOP” to any message.

6. Sharing & Disclosure of Information

We share information only under the following strictly defined circumstances:

• With Contractors and Customers: We transmit job details, estimate scopes, and payment receipts between the respective contractor and client associated with that tokenized job link.
• Service Providers: We work with trusted infrastructure providers (e.g., Stripe for payments, Cloudflare for DNS/DDoS protection, Vercel for hosting) who are bound by confidentiality agreements and security standards.
• Legal Compliance: We may disclose information if required by a valid subpoena, court order, or applicable federal/state law.

7. Your Privacy Rights (CCPA/CPRA & GDPR)

Depending on your location, you have statutory rights regarding your personal information, including:

• Right to Know & Access: You can request a copy of the personal information we hold about you.
• Right to Delete: You can request the permanent deletion of your account and associated records.
• Right to Correct: You can correct inaccurate or incomplete business/contact information.
• Right to Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact our privacy team at privacy@ondervolk.com.

8. Data Security & Storage

We implement industry-leading technical and administrative safeguards, including 256-bit TLS encryption in transit, AES-256 encryption at rest, secure signed link tokens, and strict least-privilege access controls.

9. Contact Us