Privacy Policy

1. Who We Are

InsulatorOS is a business management platform for insulation contractors, operated by Insulate You LLC ("Company," "we," "us," or "our"), based in Jonesboro, Arkansas. This Privacy Policy describes how we collect, use, and share information when you use our website at insulatoros.com and our software application (collectively, the "Service").

Questions or requests? Email us at privacy@insulatoros.com.

2. Information We Collect

Information you provide directly

• Account information: Name, email address, company name, password (stored as a one-way bcrypt hash — we cannot recover your password).
• Business data: Customer records, job estimates, invoices, crew information, inventory, and equipment records that you create within the platform.
• Payment information: Billing details entered during checkout are processed by Stripe, Inc. directly. We store only a Stripe customer ID — no card numbers, CVV codes, or full bank account numbers are stored on our servers.
• Communications: Messages you send to our support team or through the IVY AI assistant.

Information collected automatically

• IP address, browser type, operating system, and referring URLs.
• Pages visited, features used, and session duration (used for product improvement).
• Error logs and crash reports (automatically redacted to remove authentication tokens and personal data before logging).

Information from third parties

• Stripe: Payment success/failure status, last-four digits, and card type for display purposes.

3. How We Use Your Information

• Provide, operate, and improve the InsulatorOS platform.
• Process transactions and send related confirmations.
• Respond to support requests and communicate about your account.
• Train and improve the IVY AI assistant using aggregated, de-identified conversation patterns (never your business-specific data).
• Comply with legal obligations and enforce our Terms of Service.
• Detect and prevent fraud, abuse, and security incidents.

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

4. Data Isolation & Multi-Tenancy

Each company account's data is stored under a unique namespace prefix (e.g., co_{companyId}_...). This architectural boundary ensures that one company cannot access another company's data. All API requests are authenticated via JWT tokens that include your company ID, and every database query is scoped to that ID before execution.

5. Sharing Your Information

We share information only in these circumstances:

• Service providers: Stripe (payments), Anthropic (IVY AI inference), Replit (infrastructure hosting). Each is bound by a data processing agreement.
• Legal requirements: If required by law, court order, or governmental authority.
• Business transfer: In the event of a merger or acquisition, your data would transfer to the successor entity under the same privacy protections.
• With your consent: Any other sharing requires your explicit opt-in.

6. California Consumer Privacy Act (CCPA)

If you are a California resident, you have the following rights under the CCPA:

• Right to Know: Request disclosure of what personal information we collect, use, and share.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt Out: We do not sell personal information, so there is nothing to opt out of.
• Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

To submit a Data Subject Access Request (DSAR), email privacy@insulatoros.com with the subject line "CCPA Request." We will respond within 45 days.

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your account, we will delete or anonymize your personal data within 90 days, unless we are required to retain it for legal or compliance purposes. Business records (invoices, contracts) may be retained for up to 7 years to comply with applicable financial record-keeping laws.

8. Security

• Passwords are hashed using bcrypt with a salt factor of 12.
• All data in transit is encrypted via TLS 1.2 or higher.
• Authentication uses JSON Web Tokens (JWT) with short expiry windows.
• Auth endpoints are rate-limited (20 attempts per 15 minutes) to prevent brute-force attacks.
• Payment card data is handled exclusively by Stripe (PCI DSS Level 1 certified).

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at security@insulatoros.com.

9. Cookies

We use only essential session cookies required to authenticate your login. We do not use advertising cookies or third-party tracking pixels. The IVY AI chat widget stores conversation context in your browser's session storage, which is cleared when you close your browser tab.

10. Children's Privacy

InsulatorOS is a business software platform intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by a prominent notice in the application at least 30 days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, DSAR requests, or to exercise your rights:

• Email: privacy@insulatoros.com
• Mail: Insulate You LLC, Attn: Privacy, Jonesboro, Arkansas