Privacy Policy

It matters who is collecting information from whom, so this Policy is explicit about it:

• When you sign up for Cooler, we are the data controller of your account and billing information — we decide why and how it is processed, as described in this Policy.
• When you (or your team) enter information about your own leads, customers, and properties into the Service, you are the data controller of that information and we act as your data processor / service provider — we process it only on your instructions, to provide the Service to you, and not for our own independent purposes such as advertising. If you need a data processing agreement for your own compliance obligations, contact legal@thecoolerjob.com.

Account and billing information. Name, work email, phone number, password (stored as a salted hash, never in plain text), company name and address, and subscription/billing details (processed by our payment provider — we do not store full card numbers).

Customer Data you submit. Information about your leads, customers, and properties (names, phone numbers, emails, service addresses, billing addresses); estimate, job, and payment records; photos and documents you upload; messages sent and received through the built-in email/SMS inbox; and consent and communication-preference records (see Section 5).

Usage and device information. Log data (IP address, browser type, pages viewed, timestamps), device and connection information, and product-analytics events we use to understand which features are used and to diagnose problems.

Cookies and similar technologies. We use strictly necessary cookies to keep you signed in and to protect the Service, and may use additional cookies for analytics. See Section 6.

Location data. If you enter a business or property address, we geocode it (convert it to map coordinates) using a mapping provider in order to display job locations on a map and estimate travel time and mileage. We do not collect precise device GPS location.

• To provide, operate, secure, and maintain the Service, including the features described above.
• To process subscription payments and send billing-related communications.
• To send transactional notifications you or your customers would reasonably expect — for example, notifying your business when a customer signs a proposal, or delivering the confirmation email when you invite a team member.
• To provide customer support and respond to your requests.
• To monitor, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• To understand how the Service is used so we can maintain and improve it, including aggregated or de-identified analysis that does not identify a specific individual.
• To comply with legal obligations and enforce our agreements.

We do not use Customer Data submitted about your leads and customers to serve them advertising, and we do not sell that data. See Section 11 for more on our position on "sale" and "share" of information under California law.

The Service lets Customers send email and SMS messages to their own leads and customers, and lets those recipients reply. Because you control who you message and why, you are responsible for obtaining any consent required by law before sending marketing messages (see Terms of Service, Section 5).

To support that responsibility, the Service is designed to:

• Record consent events (such as when and how a contact opted in) as a history, not a single yes/no flag, so you can show what was agreed to and when.
• Maintain a suppression list and check it before every marketing send, including automatic handling of SMS "STOP", "START", and "HELP" keywords.
• Log every inbound and outbound message to the relevant customer's record for your reference.

We use third-party providers to actually transmit SMS and email messages (see Section 7). Message content and delivery metadata pass through those providers to reach the recipient.

We use cookies that are strictly necessary to operate the Service (for example, to keep you signed in and to protect against cross-site request forgery), which cannot be switched off without breaking core functionality. We may also use analytics cookies to understand aggregate feature usage. We do not use third-party advertising cookies on the application itself. Our public marketing pages may use standard analytics tooling to understand traffic; where required by law, we will present a cookie consent banner allowing you to accept or decline non-essential cookies.

We share information only as described here:

• Within your organization. Information you enter is visible to the team members and roles you or your administrators grant access to.
• Service providers (subprocessors). We use vetted third-party providers to operate the Service, including a cloud database, authentication, and file-storage provider; application hosting; SMS and email delivery providers; a mapping/geocoding provider; and a payment processor. These providers process data only on our instructions and under contractual confidentiality and security obligations. A current list of subprocessors is available on request at privacy@thecoolerjob.com.
• Legal and safety. We may disclose information if required by law, subpoena, or legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Cooler, our Customers, or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy (or a policy at least as protective).
• With your direction. Where you direct us to share information — for example, when a proposal is sent to your customer via a link, or when an estimate email is delivered on your behalf.

We do not sell personal information to third parties for their own marketing purposes.

The Service is built on a small number of infrastructure and communication providers. As of the effective date above, these include: a hosted Postgres database, authentication, and file storage provider; an application hosting provider; SMS delivery via a telecom messaging provider; email delivery via a transactional email provider; mapping and geocoding via a mapping provider; and, when payment features are enabled, a payment processor. Each provider has its own privacy practices governing the data it processes on our behalf.

We use industry-standard technical and organizational measures designed to protect information, including encryption of data in transit, encryption of data at rest where supported by our infrastructure provider, row-level tenant isolation so one organization cannot query another's data, role-based access controls, and audit logging of sensitive actions. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your Customer Data, we will notify you without undue delay and in accordance with applicable law.

We retain Customer Data for as long as your account is active, plus a limited period after termination (see Terms of Service, Section 13) to allow you to export it and to satisfy legal, accounting, or dispute-resolution needs. Signed proposals and related signature evidence are retained for an extended period after signing (at least one to two years) so that both you and your customer can retrieve a historical record, consistent with the purpose of an electronic signature audit trail. You can request earlier deletion of specific records, subject to the legal-hold and audit-trail exceptions described above, by contacting privacy@thecoolerjob.com.

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. Where the individual is a Customer's lead or customer rather than a Cooler account holder, that individual should direct their request to the business they interacted with (the Customer); we will assist our Customers in responding to such requests as their processor. Account holders may exercise these rights for their own account information by contacting privacy@thecoolerjob.com or through in-product account settings where available. We will verify your identity before fulfilling a request and will respond within the time required by applicable law.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), gives you additional rights, including the right to know what personal information we collect, use, and disclose; the right to request deletion; the right to correct inaccurate information; and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights. To exercise a CCPA right, contact privacy@thecoolerjob.com.

Our infrastructure providers may process and store information in the United States and other countries. Where we transfer personal information subject to the EU/UK GDPR or similar frameworks outside of the originating jurisdiction, we rely on appropriate safeguards, such as standard contractual clauses, consistent with applicable law.

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from individuals under 16. If you believe a child has provided us personal information, contact us at privacy@thecoolerjob.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice by email to your account's administrator or by posting a notice within the Service before the change takes effect. The "Effective date" at the top of this page reflects the last update.

Questions about this Privacy Policy or how we handle information can be sent to privacy@thecoolerjob.com.