Privacy Policy

Proper Sanitation

Effective date: September 15, 2026

Last updated: October 26, 2026

This policy explains what Proper Sanitation collects about you, why, who else sees it, how long we keep it, and what you can ask us to do about it. It covers:

our website, www.propersani.com, including the quote form and your online customer account;
the Proper Sani app for iPhone;
the records our office and drivers keep when you call or email us, book with us, or have our units on your site, and when we contact you as a contractor about a job site.

It does not cover information about our own staff and drivers, which we handle separately.

In this policy, "we", "us", and "Proper Sanitation" mean Proper Sanitation LLC, located at 1880 Century Park E, Suite 1104, Century City, CA 90067.

The short version

We collect what we need to quote, deliver, service, and bill for our restrooms and handwash stations: your contact details, your site addresses and access instructions, your orders, and your payments.
We do not sell your personal information, and we do not share it for advertising.
Our own code contains no advertising, analytics, or tracking tools. Stripe, our payment processor, collects details about your device while a payment screen is open, to prevent fraud and improve its payment form.
Card and bank account numbers go straight to Stripe. They never pass through our servers.
The emails and notices we send are about your jobs, your invoices, and your account. We do not send text messages yet; once we do, they will be about the same things. Your mobile number and text-message consent are never shared with anyone for their own marketing. Reply STOP to any text to stop our texts.
Photos sent through our app or website are re-saved before upload, which leaves out hidden details such as GPS location.
We keep your records until you delete your account, in the app or on our website, or ask us to delete them. Even then, we keep the billing and job records we need for tax, legal reasons, and disputes, and our history of changes. You can ask to see, correct, or delete your information.

Information you give us

Account details. Your first and last name, email address (which is also your sign-in), phone number, customer type (homeowner, contractor, event planner, and so on), and, if you add them, your company name and a separate billing email for invoices. We store your password only in hashed form, never the password itself.

Quote requests. Your name, phone, email, and company; the site address; the dates; which units and how many; what they are for; expected attendance; and any notes.

Quotes without an account. You can ask for a quote on our website or in the app without signing up. We keep the request and the contact details on it so our office can price it and follow up. If you already have a record with us under the same email address, we add the quote to it. If you later create an account with that email, our office combines the records once it has confirmed the account is yours.

If the website cannot send your quote, it offers to open your own email app with the details filled in, addressed to info@propersani.com. Nothing is sent unless you send that email yourself.

Your sites. For each site: a nickname, the address, and the type of site. On the website you can also save an on-site contact's name and phone number, and access notes such as a gate code or where to put the units. You can also give access instructions in a booking's notes or to our office. Only give us an on-site contact's details if you are entitled to share them; we use them only to deliver, service, and collect units. Each booking keeps a copy of the site details it was made with, so the record of a past job shows where it went.

Site links and monthly records. For a site, you can make a link that lets anyone who has it see the site's units, visits, and our photos, and you can add up to five email addresses to receive the site's monthly record. We keep the link, when it was made, replaced, or turned off, how often it was opened, the crew size you give us for the record, and the email addresses you add. Only add someone's email address if you are entitled to share it; we use it only to tell that person they have been added and to send that site's monthly record, and each email says how to stop it.

Bookings and changes. The units, dates, and notes on each booking; pickup and extension requests; and which version of our Terms of Service you accepted, when, and whether you accepted it yourself or through our office.

Service requests. The rental and unit involved, the kind of problem, how urgent it is, your notes, and any photos you attach.

Photos you attach. In the app or on our website, you can attach up to four photos to a service request. iOS's own photo picker gives the app only the photos you choose; the app has no access to your photo library. On the website, your browser gives us only the files you pick or the picture you take. See Photos below.

Messages. The message thread between you and our office, in the app or your online account, including notes you send from the Support screen. We keep what you send and what we reply, so both sides can see the conversation and we have a record of what was agreed. While "In my account" is switched on, our automatic notices (delivery, service, invoice, quote) are also posted into your Messages thread, and kept with the conversation. A few notices are posted there whatever that switch says; see Texts, emails, and notifications below.

Notification settings. Which notices you want (Delivery & Pickup, Service Visits, Invoices, Tips & Promotions) and how you want them (Text, Email, In my account). See Texts, emails, and notifications below.

Payment details. Whether autopay is on, whether our office has agreed you may pay by check, and any card labels you add. Card numbers and bank account details are entered only in Stripe's form, which you see when you book and when you pay. See Payments and autopay below.

What you tell our office. When you call, email, or talk to our team, our office may enter or correct your details, add other contacts at your company (name, role, phone, email), book work for you, change your notification settings, and record payments made by cash, check, or transfer, with a reference such as a check number.

Information created as we work

Proof photos. Our drivers and staff photograph units at delivery, at pickup, at route service visits, and when they finish a service call, as proof the work was done. The photos show the equipment and its immediate surroundings. Photos from deliveries, pickups, and route service visits appear in your account on the rental they belong to. Photos taken when we finish a service call are kept for our records, and you can ask us for a copy. When a driver can't do a visit — no access, a locked gate, or something else in the way — they may photograph what stopped them. Those photos are kept for our records, and you can ask us for a copy.

Job records. Order numbers, delivery and pickup status and time windows, which units (by asset tag) are on your site, your service schedule, and a history of service visits with the driver's notes.

Invoices and payments. Invoices, amounts, due dates, billing periods, reminders sent, voided and replacement invoices, payments received, refunds owed, and who recorded each payment.

Office notes. Notes our staff keep about your account, tags, a pinned account alert (for example, a payment instruction), and whether the account is archived. When we find two records for the same customer, we combine them and keep the history of both, including the earlier email address. Office notes are not shown in your account, but they are included if you ask for a copy of your information.

Contractors we may contact. To find job sites that may need our units, our office reads public records: the building-permit records that cities and Los Angeles County publish, and the Contractors State License Board's license list. From them we keep each permit's job-site address and details, and the contractor's business name, license number and details, business address, and phone number. We leave out the names of property owners and permit applicants that those records show. When we call a contractor, we keep notes of the call: when we called, what was said (for example, who they use now), and when to call back. We also keep the phone numbers and email addresses they give us, and the names and roles of people there. If you ask us not to contact you, we keep a note of that so we don't. If your business becomes our customer, your customer record can start with the business phone and address from the contractors' list, and the people we noted move to it as contacts.

A history of changes. Our system records changes to customer records: who made each change (a member of our team, or you), when, and what the details said before and after. This covers contact details, notification settings, account alerts, tags and contacts, site addresses and access notes changed by our office, payments recorded, visit notes, and the first part of any office note added or removed. It also records a request to delete an account, its cancellation, and the deletion itself, which is recorded as counts of what was deleted and kept and a short note of how the request was made and confirmed, without your contact details. Our team cannot edit or delete this history.

A record of notices. For each email, text, notice placed in your account, and push notification we try to send, we keep its wording, when it was sent, whether sending succeeded, and a shortened form of where it went (for example, the last four digits of a phone number). Password reset codes are never kept in this record.

Information collected automatically

On our website. Our website's own code sets no cookies. It uses your browser's storage for:

a sign-in token that keeps you signed in, removed when you sign out, when you delete your account in that browser, or the next time you open your account on the site after your account is deleted another way;
your light or dark display choice, which never leaves your browser and is removed when you choose System;
after a card or bank payment, Stripe's reference for that payment (no card or bank details, amount, or name), so the payment is recorded once and never charged twice. It is removed once the payment is recorded. Signing out does not remove it, so on a shared computer you may want to clear this site's data;
for the open tab only, cleared when the tab closes: unsent message drafts, where you were in the site (such as the page to return to after signing in, and the tab or filter you had open), a notice that your session has ended, a notice that your account has been deleted (with your email address, removed once it is shown), the status of a payment in progress, or of a card or bank account being saved, and any refund message about an invoice you have just paid.

When you reach the payment step of a booking, or open a payment screen, Stripe's payment software loads from Stripe and may set its own cookies. See Payments and autopay below.

An invoice you print or save as a PDF on the website is made by your own browser and goes only where you print or save it.

After you send a quote without an account, the link to create an account carries the name and email you entered, so the sign-up form is filled in for you. That link stays in your browser history. The part carrying your details is not sent to any server when the page opens.

In the app. Your sign-in token is kept in the iPhone's Keychain and deleted when you sign out, when you delete your account in the app, or the next time the app contacts our servers after your account is deleted another way. If you allow notifications, the app keeps its push token, so that it can send it to our servers after you sign in, and deletes it when you sign out (once our servers have removed it) or delete your account in the app. An invoice you open to share is made into a PDF, and an invoice you download is saved, in the app's temporary storage, and goes only where you send it. iOS may briefly keep a cached copy of photos you view. The app keeps no other store of your information on the phone, and it asks for no location, photo library, contacts, or microphone permission. It asks to use the camera only if you tap Scan card while adding a card or paying an invoice: your card is read on your phone to fill in its number, and the picture is not saved or sent to us. You can type the card instead.

Push notifications. The app asks permission to send notifications only after you send a quote, booking, or service request, or when you tap Allow app notifications in its notification settings. If you allow them, your device's push token is sent to our servers once you are signed in, and while In my account is on we use Apple Push Notification service to deliver notices to your phone. We send them only to a phone that is still signed in to your account. The token is removed from our servers when you sign out (if your phone can reach our servers at that moment), when you reset your password, when our office changes your sign-in email, when Apple tells us it is no longer valid, when another account signs in on that phone, or when your account is deleted; if a sign-in simply expires, we stop using its token and remove it the next time you sign in. You can stop them at any time by turning off In my account, or by turning off notifications for the app in iOS Settings.

Server logs. When our website or app contacts our servers, the logs kept by Render, which hosts our servers, record details of the request, such as the network (IP) address it came from, the time, what was requested, the result, and the browser or app making it. Our logs also record the email address or phone number each email or text went to, the subject lines of notices, short excerpts of alerts to our office (for example, the name and email of someone who asked for a password reset), and error details. The part of a unit label link, a site link, or a stop link that works as its key is left out of our logs. We use logs to run the service, fix problems, and stop abuse.

Abuse protection. To limit repeated attempts to sign in, sign up, reset a password, send a quote without an account, confirm deleting an account with a password, open a unit's label page or a shared site page, report a problem from a label, download a site's monthly record, use a stop link, attach photos, or add addresses to a site's monthly record, our servers keep a count of recent attempts by IP address (and, for password resets, by email address; for deleting an account, attaching photos, or adding monthly-record addresses, by account; for a label report, by label; for a site page or record, by link). The count covers at most the last hour, or the last day for a label's reports, a link's record downloads, and the addresses an account adds to monthly records. It is held only in our server's memory until it restarts, and is never saved to our database.

Website hosting. Netlify, Inc., which serves our website's pages, keeps its own standard request logs, such as IP address, browser, and page requested.

What we do not collect

No location tracking. The app has no location services, and the website never asks your browser for your location. The addresses we hold are the ones you or our office type in. Tapping a site address opens Apple Maps in the app, or Google Maps on the website; the address goes to Apple or Google only when you tap it, under their own privacy policies.
No advertising. No ad networks, no advertising identifiers, and no tracking across other companies' apps and websites.
No social media plugins, embedded maps, or chat widgets.
No microphone, contacts, calendar, or health data.
No full card numbers, card security codes, bank account numbers, or bank logins. If you link a bank account, you sign in to your bank through Stripe, never through us.
Nothing from your calls, texts, or email. Tapping Call, Text, or Email opens your own phone, Messages, or mail app. The app's Text button starts a message with your name in it, so we know who is texting.

How we use your information

We use it to:

create your account, keep you signed in, and help you back in if you forget your password;
price quotes and confirm bookings;
deliver, service, and collect units, and give our drivers the directions and access instructions they need;
tell you about your jobs, quotes, invoices, payments, and account security;
invoice you, take card and bank payments, run autopay, and follow up on unpaid invoices and refunds;
answer your messages and calls;
keep proof of the work and a record of what was agreed;
keep the records we need for tax, accounting, and legal purposes, and to resolve disputes;
delete your account when you ask, and tell you when it is done;
protect accounts, prevent fraud and abuse, and fix problems.

We do not use your information for advertising, and we do not use it to build marketing profiles or to predict things about you such as your interests or finances. Our office does keep working notes about your account, such as payment arrangements or site details, to serve you.

Our own team. What each person can see depends on their job, and they must sign in to see any of it.

Office staff see customer records in full, including messages, notes, invoices, and payments, and can export invoice lists with customer contact details for bookkeeping.
Drivers see what the route needs: your name and phone number, the site address, access notes and on-site contact, the units and dates, delivery and pickup windows, service-call details including your notes and photos, and earlier visit notes and photos. Drivers do not see your email address, invoices, payments, or messages.

Alerts to our office. Our system alerts our office by email, and by text for urgent items, when you send a quote request, booking, pickup or extension request, service request, or message; when you create an account that matches a record we already hold; when you ask to delete your account or cancel that request, and when an account is deleted; and when an autopay charge fails, a bank payment is returned, a bank account can no longer be used for autopay, or a payment needs refunding. Alerts include details such as your name, phone, email, the site address, the notes on a service request, the first part of a message, what is still open on an account you asked to delete, and, for a failed autopay charge or a returned bank payment, the invoice number and the reason Stripe gave.

Service providers. We use the companies below to run our service. Each receives only what it needs, and their terms with us require them to protect it and use it only to provide their service to us. The exception is Stripe, which also uses some information for its own purposes under its own privacy policy (see Payments and autopay).

Stripe, Inc. processes card and bank payments and autopay. It receives the card or bank account details you enter, the amount, the invoice number, and our reference numbers for you and the invoice. For a bank payment, we also fill in your name and email in Stripe's form, and Stripe uses the email to send you a copy of your authorization. When you save a card or bank account at booking or for autopay, Stripe receives your name and email and the details you enter, and we create a Stripe customer record for you then. When you link a bank account, you sign in to your bank through Stripe Financial Connections, which confirms the account with your bank. If you tell us whether a bank account is personal or business, we pass that to Stripe so it handles the account's payments the right way. Stripe also collects device information itself.
Twilio Inc. will deliver our text messages once we send them. It will receive the phone number and the wording of each message.
Google LLC (Google Workspace) sends our emails and holds our office mailbox. It receives the email address and the content of each message.
Apple delivers push notifications to the app through Apple Push Notification service, if you allow them. It receives your device's push token and the title and wording of each notification.
Render Services, Inc. hosts our servers in the United States. Our database, photos, and server logs are stored with Render.
Cloudflare, Inc. stores backup copies of our database and of photos. It does not receive server logs.
Netlify, Inc. serves our website's pages. It receives the ordinary request details that every website visit sends.

Other disclosures.

Route planning. To plan our truck's route, and to check whether a site is in our online booking area (we also use the ZIP code you give for that), our system sends a site's street address, city, and ZIP code (never a name, phone number, email, or note) to the U.S. Census Bureau's free address lookup, which returns the site's map position.
Our accountant or lawyer, where reasonably needed, who keep it confidential.
People you choose. Invoice notices go to the billing email you add, and an invoice PDF you share goes wherever you send it. A site link you share shows that site's units, visits, and photos to whoever has it, and a site's monthly record goes to the email addresses you add for it.
Preliminary notices. On commercial and construction projects, California law lets us serve a preliminary notice on the property owner, the direct contractor, and any construction lender. It names you as our customer and gives the site address, a description of what we supply, and an estimate of its price.
The law and safety. Where the law requires it, such as a subpoena or court order, or where needed to protect someone's safety, prevent fraud, or establish or defend a legal claim.
A sale of the business. If Proper Sanitation is sold or merged, customer records would pass to the new owner. We would tell you before your information became subject to a different privacy policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not give personal information to other companies for their own marketing.

Mobile information, text-message opt-in data, and consent will not be sold or shared with third parties or affiliates for their marketing or promotional purposes. The sharing described above does not include text-message opt-in data and consent, except that our text provider receives your number to deliver our messages, and a buyer of our business could keep sending you the same service texts.

Texts, emails, and notifications

What we send.

Deliveries and pickups: a notice each time a delivery or pickup moves along (a heads-up when our truck is a few stops away from a delivery, a pickup or a service call, a driver on the way, units delivered, a pickup lined up or on the way, units collected), with any photos in your account; changes to dates or time windows; a reminder the day before a delivery or pickup window (or that day, if the window is set late); a correction if we marked a step by mistake, such as a delivery marked complete before it was; cancellations; answers to extension requests.
Service: a note when a route service visit is done, including the driver's note; a correction if a visit was recorded by mistake; changes to your service days, and a visit moved, skipped, or put back on; service calls scheduled, on the way, done, and closed; and a note when someone reports a problem from the label on one of your units.
Quotes: a note that we have your quote request, each time you send one; a notice when your quote has been priced, and again if its price changes.
Invoices and payments: new and replacement invoices; a notice when the price of a rental changes, such as when the damage waiver comes off or applies again; reminders around the due date and when an invoice is about 7 and 21 days overdue (automatic reminders go out only during daytime hours, Pacific time); a "Payment received" notice when autopay charges your card or a bank payment clears; a notice when autopay starts a bank payment; for a personal bank account saved for autopay, a notice of the amount and date of each debit at least 10 days before it, and of any change to it; failed autopay charges; failed or returned bank payments, and our debiting one again; a notice if a bank account can no longer be used for autopay; payments applied, refunds owed, and refunds sent; and, when our office books a job for you and no card or bank account is saved for autopay, a request to add one.
Bookings, price adjustments and pickups: the confirmation of a booking; the notice of our yearly price adjustment, 30 days before it takes effect; and confirmation of a pickup booked for your job, whether you or our office booked it, again if the truck's day for it moves, and a correction if one went out by mistake. We send these whatever your notification settings say.
Your account: password reset codes, when you ask for one; emails about deleting your account; and, if our office changes your sign-in email, an email to the old address and the new one.
Messages from our office: when our office writes to you in your Messages thread, a push notification while In my account is on (if you allow them), and, while your Email switch is on, an email of what we wrote about a minute later, unless you have read it in your account by then.
Site links: a note in your account when our office makes, replaces, or turns off a site link for you. It goes only into your account, whatever your settings say.

How your settings work.

The Delivery & Pickup, Service Visits, and Invoices switches decide which of those notices you get. The Text, Email and In my account switches decide how. Invoice and payment emails go to your billing email if you have added one.
Besides the bookings, price adjustments and pickups above, these messages go out whatever your topic switches say. A notice of an autopay debit from a personal bank account, or that a bank payment failed or was returned, or that we are debiting it again, goes by email (or, once we send texts, by text if we have no email address for you; until then, into your account instead), and into your account while In my account is on. A password reset code goes to your email (and, once we send texts, by text too if we have your phone number) whenever you ask for one; to prevent abuse, we limit how often a new code is sent. A note that we have your quote request goes by email (into your account instead if your Email switch is off), and into your account while In my account is on; if you sent the request without an account, it goes only to the email address on the request. A notice that your quote is priced, or that its price has changed, goes by whichever of email, your account and (once we send texts) text you have switched on, and as a push notification while In my account is on, if you allow them. Emails about deleting your account go only by email, to the email address on your account: one confirming a request you made that is waiting for something to be settled, and one when the account is deleted. If our office changes your sign-in email, both addresses are emailed, whatever your settings say.
Push notifications go with the In my account switch: while it is on and you allow notifications for the app, the notices your topic switches allow also arrive on your phone. The exception is a notice that what you pay is changing (a new price for a rental, the sales tax for your site, the damage waiver, or what is charged at delivery). That goes by email (or, once we send texts, by text if your Email switch is off or we have no email address for you), and into your account while In my account is on, but never as a push notification. To stop push notifications, turn off In my account (Email has to stay on, or Text once we send texts), or turn off notifications for the app in iOS Settings.
Tips & Promotions is off unless you turn it on. We do not send promotional messages today. If we start, promotional emails will go only to customers who have turned it on and will include a way to unsubscribe, and we will not send promotional texts without first getting your express written consent.

Text messages. We do not send text messages yet. Once we do, when you give us a mobile number (for your account, a quote, a booking, or through our office), Text is switched on and we will use the number to text you about your quotes, jobs, invoices, payments, and account. Where you type your number into our app or website, we say so beside the phone field. Consent to texts is not a condition of purchase. We do not send marketing texts. Message frequency varies with your jobs. Message and data rates may apply. Until then, a notice that could reach you only by text is placed in your account instead, even if In my account is off.

Stopping texts. Reply STOP to any of our texts, turn off Text in your notification settings, or ask us. Reply HELP for help, or call 213.290.4440. If you reply STOP, our text provider blocks all texts from us to your number, including password reset codes, until you reply START; our system is not told, so please also turn off Text or tell us. Turning off Text in your settings stops every text except reset codes you ask for. Stopping texts does not cancel your service; we will reach you by email or phone instead.

Payments and autopay

Card and bank numbers go to Stripe, not us. You enter your card in Stripe's payment form: Stripe's payment sheet in the app, or Stripe's form on the website, which loads on the card step when you book, and on a payment screen. Your card number, security code, and any billing details the form asks for (such as a ZIP code) go directly to Stripe and never pass through our servers. Our servers set the amount from the invoice, and check with Stripe that the payment went through before marking the invoice paid.
Bank accounts. You link a bank account in Stripe's form by signing in to your bank through Stripe Financial Connections; your bank login goes to your bank or to Stripe, never to us. We ask Stripe only for what a payment needs, never your balances, transactions, or other accounts. Our servers keep your bank's name, the last four digits of the account, whether you told us it is a personal or business account and when, and what Stripe reported about that, with Stripe's references to the account and to your authorization, never the full account number. For a personal account saved for autopay, we keep a record of each notice we send you before a debit: its amount, its date, and when we sent it. When you authorize a debit, Stripe records when you gave it, with your IP address and browser or device details, as the record of your authorization, and emails you a copy. If Stripe offers to save your details with its Link service for use at other businesses, that is between you and Stripe, under Stripe's own terms and privacy policy.
Stripe collects device information. While its payment form is open, Stripe's software collects information about your device and how the form is used, such as your device model or browser, operating system, language, time zone, screen size, app version, network type, IP address, and identifiers Stripe assigns. Stripe uses it to detect fraud and to improve its payment form, and on the website it may set cookies for the same reasons. Stripe handles this under its own privacy policy, at https://stripe.com/privacy, and may use it across the many businesses it serves to spot fraud. If your bank asks you to confirm a payment, Stripe's software passes device details, such as your device type, browser or app, language, screen size, time zone, and IP address, to your bank for that check.
Card labels. The card labels you add in the app (card type, last four digits, expiry) are there to help you recognize a card. We keep only the last four digits of any number entered.
Autopay. When you save a card or bank account at booking or for autopay, Stripe receives your name and email and the details you enter, and we create a Stripe customer record for you then, with our reference number for you; Stripe keeps that card or account. We store Stripe's references to the customer and the card or account, so later invoices can be charged to it when they are issued, or, for a personal bank account, on the date in the notice we send you at least 10 days before. Turning autopay off stops automatic charges, but the card or account stays saved at Stripe, and its references stay on your record, until you ask us to remove them or your account is deleted. Stop using this bank account, in Payment Methods, or asking our office, removes a bank account from Stripe and ends its authorization. Removing a card label from your account does not remove a card saved at Stripe.
When your account is deleted, we delete your customer record at Stripe, which removes any card or bank account saved with it. Stripe keeps its own records of past payments under its own privacy policy.
Other payments. Payments by cash, check, or transfer are recorded by our office with a reference, such as a check number.

Photos

Who sees them. Photos you attach are seen by our office and by the drivers handling the request, and you can see them in your account. Proof photos are seen by our team, and photos from deliveries, pickups, and route service visits also appear in your account. Any signed-in member of our team, drivers included, can open job photos, and anyone who has a link you share for a site sees that site's delivery, service, and pickup photos.
The label on each unit. Each of our units carries a label with a link. Anyone who scans it sees the unit's number, when it was last serviced, our driver's photo of the finished unit, and the next visit day — never your name, address or prices. If you'd rather a unit at your site show no photo, tell us and we'll turn it off.
Links you share. If you make a link for a site, anyone who has it can see, without signing in, the site's name and address as you saved them, your company name, the units on site by type and number, the dates and times of deliveries, service visits, and pickups, our drivers' photos from them, the next visit day, and the site's monthly records. They never see your name or contact details, anyone else's contact details, gate codes, access notes, notes, invoices, prices, or payments, or photos you sent us. If a job's photos are turned off on its unit labels, they are left off the link too. Anyone with the link can pass it on, so share it only with people you want to see these. You can turn a link off or replace it in your account, or ask us, at any time; the old link stops working at once. A link also stops 90 days after the last of our units leaves the site. A record someone has already downloaded or received by email stays with them.
Reports from a unit's label. Anyone can report a problem from a unit's label page. A report can include an optional phone number for a call back, a note, and a photo. Our office and the drivers handling it see the report, and so does the customer whose site the unit is on.
Hidden details left out. Photos uploaded through our app or our website are resized and re-saved as new image files before upload. Photos our staff upload through our office system are re-saved the same way whenever their browser can read the image. Re-saving leaves out the hidden details stored in the original file, such as GPS location and camera model.
What the picture shows stays. A photo can still show people, vehicles, signs, or neighbouring property. Please avoid photographing people where you can.
Where they are kept. Photos are stored with Render, which hosts our servers, alongside the job they belong to.
Deleting a photo. There is no delete button for photos. Ask us and we will delete a photo you sent, unless we need it as a record of a job or a dispute. Deleting your account deletes every photo you sent. Proof photos our team took on jobs we keep for tax and legal reasons stay with those job records.

How long we keep information

We keep information only as long as we need it for the reasons in this policy. Our systems do not delete customer records on a schedule. Here is what happens to each kind of information:

Your account and job history (quotes, bookings, service requests, messages, photos, and office notes) is kept while you are a customer and afterwards, because it may be needed for future bookings, questions about past jobs, disputes, and tax records, until you delete your account or ask us to delete it. Archiving an old account keeps its records.
When your account is deleted, we delete your name, email, phone, company, billing email, and notification settings; your saved sites, with their gate codes, access notes, and site contacts, and their site links (which stop working) and the email addresses you added for monthly records; your messages with our office; the photos you sent; our office notes, tags, contacts, and alerts on your account; quotes that did not become a booking; bookings that were never delivered or invoiced; service requests we had not completed; card labels; push tokens; and your sign-in. Your email address is then free, so an account you create with it later starts fresh and is not joined to the records we kept. If we also hold a separate record under your email address that was never joined to your account (for example, from a quote you sent or details our office took before you signed up), our office deletes that record too once it has confirmed it is yours. Deleting a separate record like that at your request does not delete an account you sign in to; you can delete that with Delete Account.
Invoices and payments, and the booking, job, and Terms records behind them, are kept for as long as we need them for tax, accounting, and legal purposes, and to resolve disputes. We keep these even when your account is deleted. When we delete an account, these records no longer carry your name or contact details. They keep the site address, what we delivered and when, our proof photos and drivers' visit notes, and the amounts and payments, but not gate codes, access notes, site contacts, or the notes you added. The record of a bank authorization (when you gave it, Stripe's reference to it, the account's last four digits, and whether you told us it is personal or business), and of the notices we sent before debits from a personal account, is kept in our history of changes for at least two years after the authorization ends; Stripe keeps the full record of how you gave it.
The history of changes and the record of notices sent are kept even after your account is deleted, because they protect you and us against fraud, mistakes, and disputes. Earlier entries still show the details they recorded at the time. Only our office staff can see them.
Saved sites and card labels stay until you remove them or delete your account. Removing a saved site does not change the copy kept with past bookings.
Site links and monthly-record addresses stay until you turn them off or remove them, remove the site, or delete your account. The exception is an address that used a stop link: it is kept, marked as stopped, even after you remove it, so we never email it again, and once the site is removed only a scrambled (hashed) form of it is kept, until your account is deleted. The record of which months were sent, and to how many addresses, stays with the job's history.
Sign-in sessions last 60 days, or until you sign out. Resetting your password, a change to your sign-in email, or deleting your account signs you out everywhere.
Password reset codes stop working after 20 minutes or five wrong tries, and are stored only in hashed form.
Push tokens are kept until you sign out (if your phone can reach our servers at that moment), reset your password, our office changes your sign-in email, Apple reports the token is no longer valid, another account signs in on that phone, or your account is deleted. A token whose sign-in has expired is no longer used, and is removed the next time you sign in.
Counts used for abuse protection, kept by IP address, email address (for password resets), account, label, or link, are held only in our server's memory until it restarts, count only recent attempts (at most the last hour, or the last day for a label's reports, a link's record downloads, and the addresses an account adds to monthly records), and are never saved to our database.
Permit leads. A permit lead nobody has worked on is removed about 18 months after its last permit, and the contractors' list is replaced whole each time we load a new copy. Notes of our calls to contractors, the people we noted, and a request not to be contacted are kept.
Server logs are kept by Render for a limited period set by our hosting plan, then deleted automatically. We cannot remove individual entries sooner, so a deletion does not reach log entries still inside that period.
Backups. Our database is copied continuously to backup storage with Cloudflare, and our backup system keeps 30 days of history there. When information in our database is changed or deleted, including when an account is deleted, the earlier version stays in that history until it rolls off automatically, about 30 days later. We use these backups only to recover lost or damaged data and to check that recovery works. Photos are copied to the same backup storage when they are stored, and a photo deleted with an account is deleted there too. Server logs are not part of these backups.
Copies elsewhere. Alerts about your requests also sit in our office's email inbox and on our office phone, and our email and text providers keep their own copies of messages for a period set by their services. When an account is deleted, or we carry out a deletion request, we also delete the alerts about you from our office inbox and phone. Copies held by those providers roll off on their own schedules.
Website browser storage is kept as described under Information collected automatically.

Your choices and rights

In your account (in the app or on the website) you can:

see and update your name, phone, company, customer type, and billing email;
change your notification settings;
manage your saved sites;
turn autopay off, where our office has agreed you may pay by check, stop using a bank account saved for autopay, remove card labels, and (in the app) add them;
see your quotes, rentals, service requests, invoices, messages, and your photos;
sign out, which ends the session on that device;
delete your account (see Timing below for when it happens).

Your sign-in email cannot be changed from your account. To move to a new address, message us. Our office changes it on your account, so your history stays with it, and emails both the old and the new address to say so. You are then signed out on your devices and sign in again with the new address; your password does not change. Your old address is not kept on your account: our history of changes records the change, with both addresses.

Ask us. Wherever you live, you can ask us to:

give you a copy of the personal information we hold about you, including office notes and the history of changes to your record;
correct anything that is wrong;
delete your account and personal information. We will delete what we can, but we keep invoices, payments, and the job records behind them for tax, accounting, and legal purposes, and we keep our history of changes and record of notices to protect against fraud, mistakes, and disputes (see How long we keep information). You can also do this yourself with Delete Account in your account;
remove a card or bank account saved at Stripe, or stop texts or emails.

How to ask. Send us a message from your account in the app or on the website, email info@propersani.com, or call 213.290.4440. To delete your account, use Delete Account in your account, in the app or on the website, or ask us in any of these ways.

Checking it is you. To delete your account from the app or website, you enter your password. A request sent from your signed-in account is treated as coming from you. For a request by email or phone, we check it against the email address and phone number on your account, and we may send a confirmation to one of them before acting. If you do not have an account (for example, you are someone's on-site contact or asked for a quote without signing up), we will confirm the request using the email address or phone number we hold for you. We will not ask for more than we need.

Timing. We aim to confirm we have your request within 10 business days and to answer it within 45 days. If we need longer, we will tell you within those 45 days and aim to finish within a further 45 days. When you delete your account in the app or on the website and nothing is still open on it (no units on your site or booked, no invoice still to pay or still being prepared, no days still to be invoiced, no bank payment still on its way, and no refund owed), it is deleted straight away. Otherwise we record your request, and your account is deleted automatically as soon as the last open item is settled; anything waiting on us, such as a pickup, a last invoice, or a refund, we finish within 45 days of your request. Until then you can still sign in to pay and follow your jobs, new quotes and bookings are paused, and you can cancel the request. When you ask us instead, our team deletes your account the same way once nothing is open on it. We email you when it is done, with what we kept and why.

Someone acting for you. You can have an authorized agent make a request for you. We may ask for your signed permission and confirm the request with you directly.

No penalty. We will not charge you more, give you a worse service, or refuse to serve you because you made a privacy request. Once your account is deleted you can no longer sign in to it, but you can still book with us by phone or email, or create a new account.

California residents

California law (the California Consumer Privacy Act, as amended by the California Privacy Rights Act) gives California residents the right to know what personal information a business collects and how it is used and disclosed, to access, correct, and delete it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for using these rights. We offer the access, correction, and deletion rights above to every customer, whether or not a law requires it in your case, and you use them the same way.

In the past 12 months we have collected these categories of personal information:

Identifiers: name, email address, phone number, billing and site addresses, account number, IP address, and, if you allow notifications in the app, your device's push token.
Customer records: billing email, card type and last four digits, your bank's name, the last four digits of a bank account and whether it is personal or business, and payment references.
Commercial information: quotes, bookings, service history, invoices, payments, office notes and tags about your account, and notes of our calls to contractors.
Internet or other electronic network activity: server log records of requests to our servers, and the device information Stripe's payment form collects.
Audio, electronic, or visual information: photos.
Professional information: your company name, customer type, and the roles of contacts at your company, and, for contractors we may contact, the license details on the Contractors State License Board's list.
Sensitive personal information: your account log-in (your email address together with your password).

We do not collect precise geolocation from your device, and we do not use personal information to create profiles for marketing.

Sources. You, when you use our website or app, call, email, or book with us; your phone or browser, automatically; other people, such as a customer who names you as an on-site contact, adds you to receive a site's monthly record, or a colleague who adds you as a contact at your company; our office staff and drivers, who record jobs, notes, and photos, and keep notes of our calls to contractors; public records — city and county building-permit records and the Contractors State License Board's license list — for contractors we may contact about their job sites; and Stripe, which confirms payments and tells us the bank's name, the last four digits and whether it is a personal or business account for an account you link.

Purposes. Those listed under How we use your information.

Disclosures for business purposes. In the past 12 months we have disclosed personal information for business purposes:

to Render, which hosts our servers: all of the categories above;
to Cloudflare, which stores backups of our database and photos: identifiers, customer records, commercial information, professional information, sensitive personal information, and audio, electronic, or visual information (photos);
to Stripe: identifiers, customer records, commercial information, and internet or other electronic network activity;
to our email and text providers: identifiers and commercial information (in the content of notices);
to Apple, which delivers the app's push notifications: identifiers (your device's push token) and commercial information (in the content of notifications);
to Netlify, which serves our website: identifiers (IP address) and internet or other electronic network activity;
to our accountant or lawyer, when needed: identifiers, customer records, and commercial information.

We may also disclose any category to government authorities where the law requires, and to a buyer of our business, as described above.

Sale and sharing. We have not sold personal information, or shared it for cross-context behavioral advertising, in the past 12 months. That includes the personal information of anyone under 16. Because we do neither, there is nothing for an opt-out request or a Global Privacy Control signal to switch off.

Sensitive personal information. The only sensitive personal information we collect is your account log-in (your email address together with your password). We use that combination only to sign you in and keep your account secure. We use your email address on its own to contact you, as described above, and we never see or store your password itself. There is no other use to limit.

Retention. See How long we keep information.

Shine the Light. California law lets customers ask whether a business has given their personal information to other companies for those companies' own direct marketing. We do not do this. You can ask us about it at info@propersani.com.

Do Not Track

Some browsers can send a Do Not Track signal. There is no common standard for what it means. We do not track you across other companies' websites or apps, so our website works the same whether or not your browser sends it.

How we protect it

Passwords are stored only as salted, one-way hashes, never as the password itself.
The app and website talk to our servers over encrypted HTTPS connections.
Backups of our database and photos are kept in private storage at Cloudflare, which encrypts them at rest.
Sign-in sessions end after 60 days, when you sign out, when you reset your password, when our office changes your sign-in email, or when your account is deleted. Our servers keep only a fingerprint of each sign-in token, not the token.
In the app, your sign-in token is kept in the iPhone's Keychain.
Password reset codes expire after 20 minutes and stop working after five wrong tries.
Deleting your account needs your password and a second confirmation.
Repeated attempts to sign in, sign up, reset a password, send a quote without an account, enter a password to delete an account, open a label page or a shared site page, or download a site's monthly record are limited.
Our system is designed so that each customer can reach only their own records, and our team sees records according to their role; drivers see only what their route needs.
Card and bank account numbers never reach our servers.

Anyone who can get into your email or answer your phone can reset your password, so keep both secure, and tell us straight away if you think someone else has used your account.

No system is completely secure, and we will not pretend otherwise. If a breach affects your personal information, we will notify you as the law requires.

Children

Our service is for adults: you must be 18 or older to create an account, request a quote, or book with us (see our Terms of Service). Our website and app are not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

If you are under 18 and have created an account or sent us content such as photos or messages, contact us and we will remove it. Copies we must keep for legal reasons, or that others have already received, may remain.

Changes to this policy

When we change this policy, we post the new version here and update the date at the top. For a material change, we will tell customers who have an account by email, or by a message in the app or their online account, before it takes effect. If a change would let us use personal information we already hold in a materially different way, such as selling it, we will ask for your consent first. We review this policy at least once a year.

Contact us

Proper Sanitation LLC

1880 Century Park E, Suite 1104, Century City, CA 90067

Phone: 213.290.4440

Email: info@propersani.com

You can also send us a message from your account in the app or on our website. If you need this policy in another format, contact us.