Privacy policy

Draft for legal review. Clavoz is not yet a registered legal entity;
this page will name the entity once it is formed. Last updated: 5 October 2026.

This policy explains how Clavoz ("Clavoz", "we", "us"), of
Checkerberry Park Ln, Tomball, TX 77375, USA, handles information when you visit clavoz.com or use the
Clavoz app. Questions: hello@clavoz.com.

Who this covers

• Visitors to our website and Help Center.
• Members: contractors and their team members who hold a Clavoz account.
• Your clients: homeowners and property owners whose details you enter
  into Clavoz, and who view or sign the proposals you send them.

For your clients' information, you (the contractor) decide what is entered
and why; we process it on your behalf to provide the service.

What we collect

Account information. Your name, email address, password (stored only as a
secure hash, never in readable form), role, and, if you use Google sign-in,
your Google account identifier.

Business information. Company name, logo, licence number, contact details,
tax and pricing settings, your rate catalog, contract and warranty wording.

Your clients and jobs. Client names, addresses, phone numbers, email
addresses and notes; quotes, line items, rooms, photos you attach, and job
expenses.

Insurance claim information. When you import a carrier estimate, the line
items and claim details it contains: carrier name, claim and policy numbers,
deductible, depreciation and payment amounts. The PDF itself is read to
extract this and is not stored.

Voice walkthroughs. Audio you record is sent for transcription and the
temporary copy on our server is deleted straight after. The text that comes
back is used to suggest scope. A copy of the recording stays on your own
device if you save it there.

Signatures. When your client signs a proposal we record the name they
typed or drew, the date and time, their IP address and their browser's
user-agent, so the signature can be relied on later.

Billing. Payments are handled by Stripe. We receive your subscription
status and the last details Stripe shares with us (such as plan and renewal
date); we never see or store full card numbers.

Contacts you import. If you connect Google Contacts or upload a CSV or
vCard file, the contacts you choose to import become client records.

Technical information. Server logs (IP address, pages requested, time,
errors) kept for security and troubleshooting. See the Cookie Policy for what
is stored in your browser.

Sign-in records. Every sign-in attempt, whether it worked or not, is
recorded: the IP address it came from, your browser's own user-agent string,
whether it succeeded, why and when. When an attempt comes from a browser your
account has not used before, we email you about it. One cookie, cz_device,
identifies the browser rather than you — it is a long random string we generate,
which is how we can say "this is the same machine as last time" without
fingerprinting your device. Sign-in records are used only for security and fraud
prevention; they are kept for 90 days and then deleted automatically.

Messages to us. What you send through the contact form or by email.

Why we use it

• To provide the service you signed up for: building quotes, sending
  proposals, recording signatures, tracking jobs and payments.
• To bill your subscription.
• To send service emails: account verification, password resets, proposals
  you send, signature notifications, payment problems.
• To keep the service secure, prevent abuse and fix problems.
• To answer your questions.
• To meet legal obligations (for example tax and accounting records).

We do not sell personal information, and we do not use your clients'
information for our own marketing.

Who we share it with

Only the service providers we need to run Clavoz, each limited to its job:

Provider	What it does for us	What it receives
Hostinger	Hosts the app, database and backups; sends our emails	Everything stored in Clavoz; email contents
Stripe	Subscription payments	Billing details you give Stripe
Groq	Transcribes voice walkthroughs	Walkthrough audio, for transcription only
Google	Sign-in with Google; Google Contacts import (only if you use them)	Sign-in tokens; the contacts you choose

We may also disclose information if the law requires it, or to protect
people's safety or our legal rights. If Clavoz is sold or merged, information
would transfer to the new owner under this policy.

Where it is stored

Our servers are located in the United States. If you use Clavoz from
outside the US, your information is transferred to and stored in the US.
Some providers above may also process data in other countries.

How long we keep it

• While your account is open, we keep your data so the service works.
• Backups are kept for up to 30 days, then deleted.
• Sign-in records (see above) are kept for 90 days, then deleted automatically.
• A closed account (Settings, Account, Close your account) is kept, locked,
  for 90 days so you can sign back in and have everything restored exactly
  as it was; after 90 days it is permanently deleted. Signing in or signing up
  with the same email in that window offers the restore.
• After you close your account we delete or anonymise your data within
  90 days, except what we must keep by law (for example billing records).
• Signed proposals and their signature records are kept for as long as your
  account holds them, because they may be needed as evidence of agreement.

Your choices and rights

You can view and update your account and business details in Settings.
To ask for a copy of your data, a correction, or deletion of your account,
email hello@clavoz.com; account deletion is handled by our team today
rather than a button. Depending on where you live you may have further rights
(for example to object, restrict processing, or complain to a data protection
authority).

If you are one of our members' clients and want your information changed or
removed, contact the contractor who entered it; we will help them do so.

Security

Passwords are hashed, connections are encrypted (HTTPS), each company's data
is kept separate from every other company's, and backups are taken daily.
Repeated failed sign-ins are slowed down: after 20 failed attempts from one
connection in 15 minutes we refuse further attempts for a while, and after five
wrong passwords an account is locked for 15 minutes (resetting your password
clears the lock). Every attempt is recorded, and you can see the recent ones on
the Security card in Settings.
No system is perfectly secure; if we learn of a breach affecting your
information we will tell you as the law requires.

Children

Clavoz is a business tool and is not intended for anyone under 18.

Changes

We will post changes here and update the date above. For significant changes
we will email account owners.