Privacy policy

Two kinds of data

Data about you as our customer or visitor. When you visit tendroom.com, ask for early access, or sign in to a portal, we decide how that information is used, and this policy covers it.

Data a business keeps in its portal. Businesses use Tendroom to store information about their own clients and staff, such as names, invoices and photos. For that information we act on the business's behalf: the business decides what to collect and why, and their own privacy policy applies. If you're a client of a business that uses Tendroom, contact that business first. We'll help them answer you.

What we collect

• Early access requests: your business's name, your name, your email, the kind of business, your website if you give it, and your message.
• Accounts: your name and email, your password (stored only as a one-way hash, never in a form we can read), and sign-in sessions, which record the IP address and browser you signed in from. We also keep a log of changes made in each business's portal (for example, who changed a setting or added a team member).
• Business data in portals: whatever the business enters or uploads, such as client names and contact details, notes, invoices, estimates, bookings, messages, photo and video galleries, schedules, tasks and hours.
• Contact page messages: when someone writes to a business through its Tendroom contact page, we store their name, email, phone number, requested date and message for that business.
• Security information: IP addresses, used to limit repeated form submissions and sign-in attempts (kept for about a day), and short-lived server logs from our hosting provider. Our forms use Cloudflare Turnstile, which checks signals from your browser to tell people from automated bots.

How we use it

• To provide the service: running portals, storing files, and showing clients the invoices, estimates and galleries a business shares with them.
• To send emails the service needs: welcome and password emails, replies to early access requests, and the emails businesses send their clients through Tendroom, including reminders they choose to turn on.
• To keep Tendroom secure and working: preventing abuse, fixing problems, and keeping records of important changes.
• To talk with you about your account and, for businesses, about billing.

We don't sell personal information, and we don't share it for advertising. We don't use advertising or analytics trackers, and we don't add you to mailing lists.

Cookies

We use only the cookies needed to keep you signed in to a portal or the operator console. Cloudflare Turnstile may set cookies it needs to work. We use no cookies for tracking or advertising.

Who helps us run Tendroom

We use a few service providers, who handle data only to provide their service to us:

• Cloudflare: hosting, databases, domain names and the Turnstile bot check.
• Backblaze: storage for uploaded files such as gallery photos and logos.
• Resend: delivering email.
• Google Fonts: the typefaces on our pages and forms. Your browser loads them from Google, which receives your IP address as part of that request.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of our business, in which case this policy would continue to apply.

How long we keep it

• Account and portal data: while the business uses Tendroom. When an owner closes their business, it goes offline straight away and everything (records, files and the logins of people only on that team) is erased 30 days later, unless the law requires us to keep something.
• Your login: until you delete it from Your account. A business keeps the work records it made about you, such as hours and pay, as employers must.
• Gallery files: deleted automatically, at the latest about 30 days after the gallery was created.
• Early access requests: until they're no longer needed to reply to you or set up your business.
• IP addresses used to limit form submissions: about a day.

Security

Everything travels over HTTPS. Passwords are stored as one-way hashes. Links to client invoices, estimates and galleries are long, random and hard to guess, and each person in a business sees only what their role allows. No system is perfectly secure, but we work to protect your information and will tell affected businesses promptly if something goes wrong.

Your choices

You can download your own data and delete your login yourself, from Your account in the portal, or ask us to see, correct, export or delete personal information we hold about you by emailing privacy@tendroom.com. Business owners and admins can download everything their business has, and owners can close the business, from Settings at any time. If your information is in a business's portal, contact that business, or contact us and we'll pass your request on.

California residents

If you live in California, the California Consumer Privacy Act gives you the right to:

• Know what personal information we collect, use and disclose, and get a copy of it.
• Ask us to correct or delete it.
• Opt out of the sale or sharing of personal information. We don't sell or share it, so there's nothing to opt out of.
• Limit the use of sensitive personal information. We don't use it beyond what the service needs.
• Not be treated differently for using these rights.

In the last 12 months we collected the categories described above under “What we collect”: identifiers (such as name, email and IP address), business information you or a business entered, and internet activity limited to sign-in and security records. We collected them from you, from the business you work with, and from your browser, for the purposes under “How we use it”, and disclosed them only to the service providers listed above.

To make a request, email privacy@tendroom.com. We'll confirm we received it and verify your identity, usually by checking you control the email address on file. You can also have an authorized agent make a request for you.

Children

Tendroom is for businesses and isn't directed to children under 13. We don't knowingly collect their personal information.

Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll also email the businesses that use Tendroom before the changes take effect.

Contact

Questions or requests about privacy: privacy@tendroom.com.