Privacy Policy

Who we are and how to reach us

Platy OS is business software sold to landscaping companies. Platy OS is a registered assumed name (DBA) of a Texas limited liability company. When we say “we” or “us” in this policy, we mean Platy OS. When we say “customer,” we mean the landscaping business that signs up for Platy OS. When we say “their customers,” we mean the homeowners and property managers that business serves. If you need the name and registered address of the operating company, for a data request, a legal notice or your own records, write to hello@getplaty.com and we will give it to you.

The fastest way to reach us about anything in this policy is the hello@getplaty.com.

What we collect

Account data

When a business signs up we collect the name, email address and phone number of the people who use the account, plus login credentials. Passwords are handled by our authentication provider and we never see them in plain text.

Business data the customer enters

Platy OS exists to hold a landscaping company’s operating data: clients, properties, quotes, jobs, schedules, routes, invoices, notes and text message threads. That includes contact details for the business’s own customers, which the business enters or collects on its own behalf. We hold that data for the business, and the next section explains what that means.

Data from connected services

If a customer connects a bank account through Plaid, we receive transaction data for that account so the books can build themselves. If they connect a Stripe account, we receive the account identifiers and payment status needed to show which invoices are paid. If they text their customers through Platy OS, messages pass through the messaging providers named under Who we share it with and are stored on the job and client records they belong to. If they connect an AI assistant of their own, we record which one and what it asked for, as described under AI: you bring your own.

Usage data

Like most software, we keep server logs: what was requested, when, from what device and browser, and whether it worked. We use this to keep the product running and to find bugs, not to build advertising profiles.

Website analytics

On getplaty.com we count visits with Vercel Web Analytics and measure page speed with Vercel Speed Insights. Neither sets a cookie or builds a profile of you, and page addresses are recorded without anything after the question mark except campaign tags. We also keep one first-party cookie for 30 days that remembers how you first found us: the campaign tags on the link you arrived from, the site that sent you and the page you landed on. If you sign up, that is saved with your company's account so we know which of our posts and partners bring people in. It holds no name, email or contact details, and it is never shared with an advertising network.

The Platy OS mobile app

The Platy OS app for iPhone is used by the owners of a landscaping business and by the crew members that business invites. Accounts are created by the business, not in the app. This section covers what the app itself does on your phone. Everything above and below this section also applies to it.

Location

If you turn on location recording, the app uses your phone’s precise location, including while the app is closed, for one purpose: to record when you arrive at and when you leave the job sites on your own schedule for that day. It records an arrival when you are within about 50 metres of a scheduled stop and a departure once you are more than about 80 metres away. For each arrival and departure it stores the time, which stop it was, and the position and accuracy your phone reported at that moment.

It does not keep a trail or route of where you went, and it records nothing at places that are not scheduled stops. Arrivals and departures are sent to the Platy OS account of the business you work for, so the business can see time on site. They are never sold, never used for advertising, and never shared with anyone else.

Location recording is optional. You can pause it at any time in the app (Me, then Location recording, then Pause recording), and while it is paused the app does not ask your phone for your position at all. You can also switch location off for Platy OS in your phone’s settings. The Location recording screen shows you each arrival and departure the app has recorded, and whether it has been sent.

Camera and photos

The app uses the camera only when you choose to take a picture in it, such as a job photo or a picture of a receipt, and reads your photo library only for a photo you pick to attach. Those pictures, and what you type with a receipt, are stored with the job or the expense they belong to in the business’s account. The app never records audio.

Notifications

If you turn notifications on, we store the push token your phone gives the app, so we can deliver the notifications you asked for, such as a client viewing a quote or sending a text. Notifications reach your phone through Apple’s push notification service, which is how every iPhone app delivers them, so the text of a notification passes through that service on its way to you. The token is removed when you sign out of the app or delete your account.

Face ID and passcode lock

You can choose to have the app ask for Face ID, Touch ID or your phone’s passcode before it opens. That check is done by iOS on your phone. The app is told only whether it passed. Platy OS never receives, sees or stores your face, your fingerprint or your passcode.

Working without a signal

Crews often work where there is no signal, so the app keeps what you do on the phone until it can send it: clock punches, stop updates, notes, photos, receipts, and arrivals and departures. It also keeps a copy of your day’s route so you can see it offline. Once something has been sent, it is stored in the business’s account like everything else described in this policy.

Maps

Maps in the app load their map images from Esri’s map service, and the line that follows the roads between stops comes from the public OSRM routing service. Those services receive the area of the map being shown and the locations of the stops on it. They do not receive your name, your account or your phone’s own position. When you tap for directions, the app hands the address to the maps app you choose, such as Apple Maps or Google Maps, and that app’s own privacy policy applies.

No tracking, advertising or analytics

The app contains no advertising, no advertising identifiers and no third-party analytics or tracking code, and it does not track you across other companies’ apps or websites. If the app hits an error, it can offer to send us a report the next time you open it. Nothing is sent unless you choose to send it. If you have chosen in your iPhone settings to share analytics with app developers, Apple may share crash information with us under Apple’s own terms.

Deleting your account in the app

You can delete your login from inside the app. A crew member goes to Me, then This account, then Ask to remove my access. An owner goes to More, then Settings, then Delete my account. The app shows what will be removed and what will be kept before you confirm. Removal takes your login, your email address and password, every signed-in session on every device, the notification tokens for your phones, and any screenshots you sent us with a problem report.

What is kept, and why: the work already done for the business stays with the business, because it is the business’s record and not your login’s. For a crew member that is your visits, your hours, your job photos and the receipts you captured, which are the business’s records and its payroll evidence, and your name on the jobs you worked, so the business can still tell who did what. For an owner it is the company’s jobs, visits, quotes, invoices, payments and expenses, with invoices and payments kept because they are financial records the business has to keep. We also keep a record that you asked to be removed, and when, because that record is how we can prove it was done. You can also ask us to delete your data by writing to hello@getplaty.com, as described under Your rights below.

How we use it

We use data to run the product: to price quotes, schedule work, send invoices, take payments, keep books and deliver texts. We use account data to communicate with our customers about their service. We use usage data to fix problems and improve the product. We do not run AI models on any of it, and we do not use it to train AI models. We do not sell any of this data, and we do not use one customer’s business data to benefit another customer.

AI: you bring your own

Platy OS does not use AI models to process your data. We do not send it to an AI provider, we do not pay one to read, sort, price or write anything for you, and we do not use your data to train AI models.

Platy OS is built so you can bring the AI assistant you already use, on your own account and your own subscription with its provider. You can connect one in two ways: through the Platy OS connector, which is built on an open standard AI assistants use to connect to other software, where an owner signs in and approves the connection; or by signing the assistant in to Platy OS with a login, the way a person signs in. Either way, the same rules hold.

• It works for you, not for us. The assistant acts on your instructions, under your own agreement with its provider. That provider’s terms and privacy policy govern what it does with anything it reads, including whether it keeps it or learns from it.
• It sees only what its person can see. An assistant reaches your own company’s data and nothing from any other company, limited by the role of the person it is signed in as. A crew login sees less than an owner login, and so does an assistant using one.
• What it can do is limited too. Through the connector, an assistant can read your records and take only the actions listed on the screen where you approve it, such as saving a quote as a draft. Nothing it does through the connector is sent to your customers: a person sends it from Platy OS. An assistant signed in with a login can do whatever that login can do, so only sign one in with a login you are comfortable letting it use.
• What it reads leaves Platy OS, because you asked for it. When your assistant asks for something, we send it the answer, and that can include your own customers’ names, addresses, phone numbers and job details. From there it is held by the provider you chose, and we are not responsible for how that provider handles it. Which provider to trust with it is your choice, so read its terms before you connect it.
• You can cut it off at any time. An owner can cut off a connected assistant in Platy OS, in Settings, then Connections, and Platy OS refuses its next request. You can also remove the connector inside the assistant itself. An assistant signed in with a login stays signed in until it is signed out, or until an owner removes that person’s access in Settings.
• We keep a record. Every request made through the connector is recorded: which assistant, signed in as whom, what it asked for and when. An owner can see the recent ones in Settings, then Connections.

If nobody on your account connects an assistant, no AI reads your data through Platy OS.

Whose data it is

For the business data our customers put into Platy OS, including their own customers’ contact details, the business is the controller and we are a processor. In plain terms: it is their data, they decide what it is used for, and we handle it only to provide the service they signed up for. If a homeowner wants their details corrected or removed, the landscaping company they hired is the right party to ask, and we will help that company do it.

Who we share it with

We do not sell data. Ever. We share it only with the services that make the product work. These are our sub-processors, and we hold an account with each:

• Vercel, which hosts the application and this website, and measures visits and page speed as described under Website analytics.
• Supabase, which hosts the database, the files kept with your records such as job photos and receipts, and sign-in.
• Stripe, which processes card payments and our own billing. Payments run as direct charges into the customer’s own Stripe account, so card numbers go to Stripe, never to our servers, and the funds never pass through us.
• Plaid, which connects the bank accounts a customer chooses to link for bookkeeping.
• Telnyx and Twilio, which carry text messages and register a business’s texting with the phone carriers. Twilio also checks a business’s phone number when it signs up.
• Resend and Google Workspace, which deliver email from Platy OS: a business’s messages to its own customers, and our messages to account holders about their account.
• Mapbox, which suggests addresses as someone types one. It receives the text being typed.
• Apple’s push notification service, which delivers notifications to iPhones. The text of a notification passes through it on its way to your phone.

The product, or your own browser or phone, also reaches these other services. We have no agreement with them that covers your data, so each is named with exactly what reaches it:

• Esri, which provides the map and satellite images in the web app and the iPhone app. It receives the area of the map being shown, which at street level can be a customer’s property.
• The OSRM routing service, which is a public routing service. It orders stops into a route and draws the line along the roads between them, and it receives the locations of those stops.
• The US Census Bureau geocoder and OpenStreetMap’s Nominatim, which are public services that turn an address into a point on the map. They receive the address.
• Open-Meteo, which provides the weather at a job site. It receives the site’s map position.
• Google Fonts and OpenMapTiles, which serve the lettering the web app and its maps are drawn in. Your browser fetches it from them directly, so they see your IP address and nothing about your account.
• Your web browser’s push service, which delivers notifications to your browser if you turn them on there. They reach it encrypted, so it can deliver them but not read them.
• Telegram, which carries alerts to the people who run Platy OS. An alert can include a new account’s company name, owner name and email, or the name of someone who sent a problem report and the first part of what they wrote.

No AI provider is on either list, because Platy OS runs no AI on your data. An AI assistant you connect yourself is not our sub-processor. It works for you, under your own agreement with its provider, as described under AI: you bring your own.

Beyond those, we disclose data only if the law requires it, or if it is necessary to protect someone’s safety or our legal rights. If we are ever acquired or merge with another company, data would transfer as part of that, and this policy would still bind whoever holds it.

If we add a new sub-processor or replace one of those listed above, we will tell you at least 30 days before the change takes effect, at the email on your account. If you have a real objection to a change, tell us within that window and we will work with you on it. Platy OS is month to month, so you can also simply cancel before the change takes effect, as described under Ending the agreement in the terms of service.

Data processing terms

This section is written to be relied on the way a business customer’s own contracts expect a data processing instrument to read, not just as prose.

A breach of your data. If a security incident affects your data, we will notify you without undue delay once we have confirmed it, tell you what happened, what data was involved, and what we are doing about it, consistent with what the law requires for that kind of data.

Deletion and return of your data. When you cancel, we keep your data until you ask us to delete it, and you can export it at any time with our help, exactly as the terms of service describe. When you ask, we delete what we hold, except what the law requires us to keep, such as billing records.

Our sub-processors. Every sub-processor in the first list under Who we share it with is bound by a written contract that requires it to protect your data to a standard consistent with this policy, and we remain responsible to you for what it does with your data. The services in the second list have no agreement with us that covers your data, which is why each is named with exactly what reaches it.

How long we keep it, and how you get it out

We keep a customer’s data for as long as they have an account, because that is the product. A customer can export their data at any time, including a clean export of their books for their CPA. When an account is closed, the customer can take their data with them, and can ask us to delete what we hold. We may retain what the law requires us to keep, such as records tied to billing, for as long as it requires.

Security

Data is encrypted in transit and at rest by the infrastructure providers named above. We design Platy OS to keep one company’s data separate from another company’s, with crew logins seeing less than owner logins, and we treat that separation as a practice we build for, test and keep correcting when we find a gap, not as a guarantee that no gap will ever exist. We limit our own access to what is needed to run and support the service. No software can honestly promise perfect security, and we do not. We hold no security certifications, and we will not claim one we have not earned. If a breach ever affects your data, we will tell you what happened and what we are doing about it.

Your rights

You can ask us what data we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Depending on where you live, some of these are legal rights; we honor them for everyone regardless. Use the hello@getplaty.com and we will respond. If the request concerns data a landscaping business holds about you as their customer, we will point you to that business and help them handle it, because it is their data to answer for.

California and Texas privacy rights (CCPA/CPRA and TDPSA)

California’s privacy law (the CCPA, as amended by the CPRA) and Texas’s privacy law (the TDPSA) give residents of those states specific rights over their personal information. Some of what follows may not yet be legally required of a company our size; we are stating it anyway rather than waiting to be made to.

Notice at collection. Here is every category of personal information we collect, why, and how long we keep it, in one place:

• Account data (name, email, phone, login credentials): to create and secure your account. Kept for as long as your account is open.
• Business operating data (clients, properties, quotes, jobs, invoices, messages): to run the product you or the business you work with signed up for. Kept for as long as that account is open, as described above.
• Connected-service data (bank transactions through Plaid, payment identifiers and status through Stripe): to build your books and show which invoices are paid. Kept for as long as the connection stays linked, or the account stays open.
• Mobile app data (arrival and departure times at scheduled job sites with the position the phone reported, photos and receipts you take or attach, and a push token if you turn notifications on): to record time on site, keep work with the job it belongs to, and deliver notifications. Kept as part of the business’s operating data while its account is open; the push token is removed when you sign out or delete your account. See The Platy OS mobile app above.
• Usage data (device, browser, request logs): to keep the product running, secure and free of bugs. Kept only as long as needed for that, then deleted or aggregated so it no longer identifies you.
• Website visit data (pages visited, campaign tags, the referring site, the first page you landed on): to see which pages and posts bring people in. The first-visit cookie expires after 30 days; if you sign up, what it held stays with your company's account while the account is open.

We do not sell or share personal information as defined by California and Texas law. We never have.

If you are a California or Texas resident, you have the right to know what personal information we hold about you and where it came from, get a copy of it, correct it, delete it, and not be discriminated against for exercising any of these rights. You also have the right to opt out of any sale, sharing or targeted advertising use of your information, which is moot here because we do none of those things, and the right to limit use of sensitive personal information, which we only ever use to run the product you or the business you work with signed up for. Texas law also gives you the right to appeal a decision we make on your request.

To exercise any of these rights, write to hello@getplaty.com and say what you are asking for. We will confirm we received it, verify who you are before acting on it, and respond within the time the law allows. If you are not satisfied with how we handled your request, tell us in your reply and we will have a different person review it.

Children

Platy OS is business software. It is not directed at children, and we do not knowingly collect data from anyone under 13. If you believe a child’s data has reached us, contact us and we will delete it.

Changes to this policy

If we change this policy, we will change the date at the top and, for changes that matter, tell our customers directly. We will not quietly weaken it.

Contact

Questions about privacy go through the hello@getplaty.com. Platy OS is a registered assumed name (DBA) of a Texas limited liability company, and this policy is governed by Texas law.