Privacy Policy

Flagstone CRM LLC ("Flagstone," "we," "us") respects your privacy. This policy explains what information we collect, how we use and share it, and the choices you have when you use flagstonecrm.com, the Flagstone CRM application, and the customer portal (together, the "Service").

1. Two kinds of information

Because Flagstone is business software, we handle two different kinds of information:

• Account Information: information about the business owners, staff, and other people who sign up for and use Flagstone. For this, Flagstone decides how and why the information is used.
• Customer Data: information that Flagstone customers (landscaping businesses) enter about their own clients and properties. For this, the landscaping business decides how and why the information is used, and Flagstone processes it on that business's behalf as a service provider (processor). If you are a homeowner or client of a landscaping business that uses Flagstone, please read Section 10.

2. Information we collect

Information you give us:

• Account Information: name, business name, email, phone number, password (stored in hashed form), crew member names and roles, and billing contact details.
• Customer Data you or your team enter: your clients' names, addresses, phone numbers, emails, property details, gate codes, pet or safety notes, job history, photos, estimates, invoices, payment status, notes, and messages.
• Messages to us: chat conversations and emails with our support team.

Information collected automatically:

• Device and usage data: IP address, browser and device type, pages and features used, timestamps, and error logs.
• Cookies and similar technologies (see Section 7).
• Location data: if you use features such as route navigation or geofenced time tracking (when released), we process location data only to provide those features.

Information from others:

• Our payment provider Stripe gives us limited billing information such as transaction status, country, and the last four digits of a card. We do not receive or store full card numbers or security codes.
• Your clients may provide information through the customer portal, such as approvals, contact details, or payment requests.

We do not intentionally collect sensitive categories such as government ID numbers, health information, or biometric data, and ask that you do not enter them into the Service.

3. How we use information

We use Account Information and usage data to: provide, maintain, and secure the Service; create and manage accounts; process subscriptions and billing; provide support; send service messages such as trial reminders, security alerts, and billing notices; improve and develop features; detect and prevent fraud and abuse; and comply with law. With your permission or where allowed by law, we may send product updates and marketing, and you can opt out at any time.

We use Customer Data only to provide the Service to the business that entered it, to keep the Service secure and working, to provide support at that business's request, and as required by law. We do not use Customer Data to advertise to the individuals in it.

4. AI features

When you use AI features (for example drafting an estimate or analyzing customer history), the relevant text and records you select, such as job notes, service history, and pricing, are sent to our AI model providers to generate a response. We send only what is needed for the requested action. [CONFIRM WITH YOUR PROVIDERS BEFORE PUBLISHING: Our AI providers are contractually prohibited from using this data to train their models.] We do not use your Customer Data to train our own general-purpose AI models. AI output is generated automatically and may contain errors, so you should review it before using it. Our current AI providers are listed in the subprocessor list in Section 6.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers (subprocessors): companies that help us run the Service under written confidentiality and security obligations.
• Payment provider: Stripe processes our subscription payments.
• At your direction: for example when you send an estimate or invoice to a client, or give another user access to your account.
• Legal and safety: to comply with law, respond to valid legal process, enforce our Terms, or protect the rights, property, or safety of Flagstone, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice to you where required.
• Aggregated or de-identified data that cannot reasonably be used to identify you or your clients.

6. Subprocessors

We use the following categories of service providers. We will keep this list current and give notice of material changes.

• Hosting, database, and file storage: [HOSTING / DATABASE PROVIDER, e.g., Lovable Cloud / Supabase]
• Payments and billing (our subscriptions): Stripe
• Client payments (card and ACH), if enabled: [PAYMENT PROCESSOR]
• AI model providers: [AI PROVIDER NAMES]
• Email delivery: [EMAIL PROVIDER]
• Text messaging, if enabled: [SMS PROVIDER]
• Customer support chat: [CHAT PROVIDER]
• Website analytics: [ANALYTICS PROVIDER, or "none"]

7. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in, protect the Service, and remember your settings. We also use limited analytics, only after you dismiss the cookie notice, to understand how the site is used and improve it. We do not use advertising cookies. You can control cookies in your browser settings, though blocking essential cookies may stop the Service from working. Our site does not currently respond to "Do Not Track" signals, but we honor the Global Privacy Control signal where required by law.

8. Retention

We keep Account Information for as long as your account is active and for a reasonable period afterward for legal, accounting, security, and dispute-resolution purposes. After you close your account, Customer Data is retained for [30] days so you can export it, then deleted from our active systems and removed from backups within [90] days, unless law requires us to keep it longer. Billing records are kept as required by tax and accounting law. Support chat records are kept for up to [24] months.

9. Security

We use safeguards designed to protect information, including encrypted connections (HTTPS), encryption of data in transit and at rest where supported by our providers, access controls limited to authorized people, secure sign-in, and monitoring. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a security incident affecting your information, we will notify affected customers and regulators as required by law and, for customers, without undue delay. Please use a strong, unique password and tell us right away at legal@flagstonecrm.com if you suspect misuse.

10. If you are a client of a landscaping business that uses Flagstone

If a landscaping company uses Flagstone to manage your estimates, schedule, or invoices, that company is responsible for your information, and we hold it only to provide the service to them. To see, correct, or delete your information, or to opt out of their messages, contact that company directly. If you contact us, we will forward your request to them or tell you who to ask, and we will help them respond as needed. You can unsubscribe from any email using the link in it, or reply STOP to text messages.

11. Your rights and choices

Depending on where you live (including Massachusetts, California, and other states and countries with privacy laws), you may have the right to: know what personal information we hold about you; access and receive a copy; correct inaccurate information; delete your information; opt out of sale or sharing of personal information (we do neither); limit certain uses; and not be discriminated against for exercising these rights. To make a request, email legal@flagstonecrm.com. We may need to verify your identity, and we will respond within the time required by law (generally 45 days). If we deny a request, you may appeal by replying to our response, and you may also contact your state attorney general. Account owners can also export and delete much of their data directly in their account settings.

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact legal@flagstonecrm.com and we will delete it.

13. International use

Flagstone is based in the United States and the Service is intended for US businesses. If you access it from elsewhere, your information will be processed and stored in the United States, where privacy laws may differ from those in your country.

14. Changes to this policy

We may update this policy as our practices or the law change. For material changes, we will notify account owners by email or in the Service before the change takes effect. The "Last updated" date above shows when it was last revised.

15. Contact us

Flagstone CRM LLC
1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States
Privacy questions and requests: legal@flagstonecrm.com
General support: support@flagstonecrm.com