Privacy Policy

2.1 Who we are. Suds is business software for auto-service shops (detailing, tinting, wraps, and similar services), operated by Suds Software LLC, 10950 SW 5th St, STE 250, Beaverton, OR 97005. This policy explains what personal information the Service collects, why, who receives it, how long we keep it, and your choices.

2.2 Business Users. For information about Businesses and Business Users (account, billing, and usage information), Suds decides how it is used, as described in this policy.

2.3 Customers. For Customer Data, Suds acts as a service provider (processor) for the Business you deal with. The Business decides how it uses your information and is responsible for its own privacy notice. You can make privacy requests to that Business or to us; we will help either way (section 19).

2.4 Scope. This policy covers the Service. It does not cover a Business’s own practices outside the Service, its own website if Suds does not host it, or Third-Party Services you reach from the Service, which have their own policies.

3.1 Information you give us or a Business.

• Contact details: name, phone number, email, and service or mailing address.
• Vehicle and service details: year, make, model, color, services requested, quotes, appointments, job photos, notes, signatures on agreements, and survey answers.
• Messages and calls: texts, iMessages, emails, chat messages, voicemails, and recorded calls with a Business, and transcripts and summaries of them.
• Payment details: transaction amounts and status, and card brand, expiration date, and last four digits (never full card numbers; section 7).
• Consent records: the exact text-message consent wording you agreed to, when, and the IP address and browser used.
• Business account details: business name, legal name, EIN, address, website, owner contact details, team members, prices, settings, and a W-9 if the Business stores one (encrypted; shown only to that Business).
• Worker details: profile, role, photos the employer requires (such as a sign-in selfie), time-clock punches, pay records, and en-route location while sharing is on (section 13).
• Voice samples: if a Business owner turns on Suds Voice and records a sample (section 13).
• Demo and contact requests: name, email, phone, country, message, and the time you pick when you ask us about Suds.

3.2 Information collected automatically.

• Device and usage information: IP address, browser and device type, pages viewed, referring page, and actions taken.
• Ad and campaign information in the page address (UTM tags and click IDs such as gclid or fbclid).
• Cookies and similar technologies (section 14).
• Bot-protection and abuse signals on public forms (whether a real person is typing, automation markers, and rate limits by IP address).
• Approximate location from your IP address when a Business account signs up.

3.3 Information from third parties.

• From Meta: answers to Facebook and Instagram lead-ad forms, and, where a Business connects messaging, Messenger, Instagram, and WhatsApp messages (section 6).
• From products a Business connects or imports from, such as GoHighLevel, Quo, Gift Up, Plaid, Google, Ring, Gusto, and earlier booking software (sections 8 and 11).
• From Whop: payment, payout, refund, and dispute status.
• From Twilio: delivery status and, for imported phone history, caller-name lookups.
• From public sources: public business listings, reviews, and search results about a Business.

4.1 Purposes.

We use personal information to:

• provide the Service: booking, scheduling, messaging, payments, and records;
• send the texts, calls, and emails you asked for or agreed to;
• process payments, deposits, refunds, payouts, and receipts;
• run the AI features described in section 9;
• show a Business which pages, links, and ads bring it customers;
• bill Businesses for their plan and usage;
• provide support, keep the Service secure, and prevent fraud, spam, and abuse;
• improve the Service, using de-identified or aggregated data where we can; and
• comply with law and enforce our terms.

4.2 Limits. We do not sell personal information. We do not use Customer Data for our own marketing or share it with other Businesses. We do not use personal information to make decisions with legal or similarly significant effects about anyone.

5.1 How consent works. A Business can text you through Suds after you give your number and agree to receive texts. On booking and lead forms, an unchecked box shows the exact consent wording, for example: “I agree to get texts from [business] (sent via Suds) about my quote and booking, including automated texts. Not required to buy. Msg & data rates may apply. Msg frequency varies. Reply STOP to opt out, HELP for help.” We record the wording, the time, and the IP address and browser used. Consent is never a condition of buying. Businesses are responsible for having consent for texts they send another way, such as to contacts they import or add by hand.

5.2 What messages you may get. Messages include appointment confirmations, reminders, on-my-way and job-finished updates, payment links, receipts, review requests, and replies to your messages, some written by AI (section 9). A Business may also send occasional marketing texts, such as offers. Message frequency varies.

5.3 STOP and HELP. Reply STOP (or END, QUIT, UNSUBSCRIBE, CANCEL, or OPT OUT) at any time to stop all texts from that Business’s number, including marketing and automated texts. Reply START to opt back in. Reply HELP for the Business’s contact information, or email support@suds.com. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

5.4 Your number is never shared for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties. Information may be shared with subcontractors that provide message delivery and support services (such as Twilio), solely to deliver messages on the Business’s behalf.

5.5 Carrier registration (A2P 10DLC). U.S. carriers require each Business to register before texting customers. With the Business’s permission, we send Twilio and The Campaign Registry the Business’s legal name, EIN or sole-proprietor details, address, website, a contact person’s name, email, and phone, and sample messages. This is used only for carrier registration.

5.6 Send times, countries, and the shared number. Automated texts go out only within sending hours based on federal and state rules and the Business’s settings. Texts go only to U.S. and Canadian numbers unless a Business adds other countries. If a Business has no texting number yet, its automatic job updates may come from a shared Suds number and start with “Suds:”; replies and calls to that number reach the Business that last contacted you. Some Businesses text through an iMessage line provided by Blooio.

5.7 Phone calls and recording. Calls that go through Suds are recorded, including calls to a Business’s Go High Level or Quo numbers that ring in Suds. Every recorded call starts with a notice (“This call may be recorded for quality and training purposes”), and people a Business calls hear it when they answer. The notice cannot be turned off. Businesses on the Sales Suite can play their call recordings. For other Businesses, Suds keeps the recording on the call, and only the Business’s owner and admins can play it. Recordings and voicemails may be transcribed and summarized by AI. If you do not want to be recorded, tell the Business or use text or email instead.

5.8 AI phone receptionist. Some Businesses use an AI receptionist (provided by Retell AI) to answer calls they miss. It says it is an AI assistant and that the call may be recorded, and it can answer questions and book appointments. The recording, transcript, and summary are saved for the Business.

6.1 Facebook and Instagram lead ads.

When you submit a lead form on a Facebook or Instagram ad run for a Business through Suds Ads, Meta sends us:

• the form’s IDs and the ad, ad set, and campaign IDs and names, the time, and the platform;
• your answers, such as your name, phone number, email, ZIP code, vehicle, and the service you asked about; and
• the consent wording shown on the form and whether you agreed to it.

We save this as a lead in that Business’s account only, so the Business can follow up and see which ads bring in customers. If the form’s consent wording allows it, Suds sends you one automatic first text from the Business.

6.2 Messenger, Instagram, and WhatsApp messages.

Suds is adding connections that let a Business answer Messenger messages sent to its Facebook Page, Instagram direct messages, and WhatsApp Business messages in its Suds inbox. Until a Business turns one on, we receive no Messenger, Instagram, or WhatsApp messages from Meta. When a Business connects one, we take:

• the ID Meta gives you for that Business (a page-scoped ID on Messenger, an Instagram-scoped ID on Instagram, or your WhatsApp ID), your name on Facebook, Instagram username, or WhatsApp profile name, and, for WhatsApp, your phone number;
• the text of messages you send the Business and any photos, files, or voice notes you attach, with their times; and
• the replies the Business, or AI acting for it, sends you.

We use this only to show the conversation to the Business, save you as a lead or customer so it can reply and book you, fill in missing details on your record, and, where the Business turns it on, suggest or send AI replies (section 9). We never use it for advertising and never sell it. A Business can also import WhatsApp threads it already has in GoHighLevel (section 8).

6.3 Access we hold. Suds connects to a Business’s Facebook Page through Meta with permissions to read lead-form answers, list the Page and its linked Instagram account, and manage that Business’s ads. We store only the Page’s and Instagram account’s IDs and usernames, and encrypt the access token. We hold no permission to read or send Messenger, Instagram, or WhatsApp messages until a Business connects messaging.

6.4 How long we keep it. Leads and Messenger, Instagram, and WhatsApp messages are kept while the Business’s account is active so the Business has your history. They are deleted, with the Meta IDs saved on your record, when the Business erases your record, when the Business deletes its account, or when you ask us to delete them (section 21).

6.5 Deleting Meta data. Section 21 explains how to delete data we received from Facebook, Instagram, Messenger, or WhatsApp, including through your Facebook settings.

6.6 Summary by app. Each row says what we receive, why, how long we keep it, and how to delete it.

7.1 SudsPAY. Card payments, deposits, saved cards, gift card purchases, Business plan charges, and Credits top-ups are processed by Whop, Inc. under the name SudsPAY. Whop uses Stripe, Inc. and other processors to handle card payments. Your card number and security code go directly to Whop’s secure form; Suds and the Business receive only the card brand, expiration date, last four digits, and payment status.

7.2 Deposits and saved cards. A Business may save your card at booking (checked for $0, so nothing is charged then) and charge it after the job for amounts you approve or owe, as described in the Customer cards on file terms. We keep the consent wording you agreed to and when. When a Business sends you a payment link, Whop may receive a private Suds email alias instead of your real email. To remove a saved card or question a charge, contact the Business.

7.3 Other payment methods. Suds does not process payments a Business records as paid outside Suds, such as cash, check, or another processor’s payment link (for example, a Stripe link the Business sends itself). Suds keeps only the record the Business enters.

7.4 Receipts and invoices. Receipts are emailed with a PDF copy through our email provider, Resend. Invoices, payment links, and payment confirmations may also be texted.

8.1 Bank accounts (Plaid). A Business can link bank accounts and cards through Plaid Inc. to track income and expenses. Bank sign-in details go directly to Plaid; Suds never sees them. We receive the institution name, account name, type, last four digits, balances, and up to 90 days of posted transactions (date, amount, merchant, and category), and encrypt the access token. Transactions are categorized by rules, not AI. This data is visible only to that Business. Plaid’s handling is described in its End User Privacy Policy. Disconnecting from the Profit & Loss page revokes access and deletes the token, the linked accounts, and transactions not yet added to the books.

8.2 Bookkeeping and receipts. Suds builds profit and loss reports from payments recorded in Suds and linked bank data. When a worker uploads a receipt for reimbursement, AI (Anthropic) reads the merchant, total, date, and category from the photo.

8.3 Payroll. If a Business turns on payroll, Suds sends Gusto each worker’s name and email. Workers enter their Social Security number, tax forms, and bank details in Gusto’s own secure screens, so Suds does not receive them. Suds keeps pay and payout records.

8.4 Accounting and sales tax. A Business can connect QuickBooks. For states where a Business collects sales tax, Suds sends the service address to Ziptax to look up the rate.

8.5 CSV imports. A Business can import customers, workers, jobs, campaign contacts, and bank statements from CSV files. Columns are matched by their headers, and the Suds Assistant can help with a spreadsheet attached in chat. Imported data is Customer Data handled under this policy. The Business must have the right to import it and any consent needed to message the people in it.

8.6 Moving from other software. A Business can move its data into Suds from earlier software, including GoHighLevel, Quo, Jobber, Housecall Pro, Urable, Detailing Bookie, Fieldd, OrbisX, and Gift Up. GoHighLevel imports read contacts, opportunities, text and WhatsApp conversations, calls, recordings, and transcripts through a read-only key; Suds sends nothing back to GoHighLevel. Quo imports read texts, calls, voicemails, recordings, transcripts, and contacts. Some moves sign in to the old software with a cloud browser from Browserbase. Sign-in details and keys are encrypted, used only for the move and any later refreshes the Business asks for, and deleted when no longer needed. After phone history is imported, AI and Twilio caller-name lookups may be used to name contacts.

9.1 AI features.

The Service uses AI in these features:

9.2 AI providers that receive data.

• Anthropic (Claude models): most features above. Some requests reach Anthropic’s models through OpenRouter.
• OpenAI: call and voicemail transcription and image creation.
• TypeSafe: JEV.
• ElevenLabs: Suds Voice samples and reminder text.
• Retell AI: the AI receptionist, which runs on models Retell provides (including OpenAI’s).
• Soniox: live call transcription, where turned on.
• DataForSEO: AI search checks about a Business (business information only).

9.3 Training. We send AI providers only what each task needs, through their business APIs, under terms that do not allow them to train their models on that data. We do not use personal information or message content to train foundation AI models. The S.U.D.S. agent learns from conversation outcomes within each Business; it may also learn from de-identified patterns across Businesses (such as which reply styles lead to bookings), and a Business can opt out of that sharing. We maintain de-identified data only in de-identified form, will not attempt to re-identify it, and contractually require any recipient to do the same.

9.4 AI can be wrong. AI output can contain mistakes. Businesses are responsible for reviewing it, and a confirmed booking, invoice, or payment record always controls over anything an AI said.

10.1 Campaigns. A Business can send text and email campaigns to its Customers and, if it chooses, to leads. Text campaigns skip anyone who replied STOP, is blocked, or has marketing texts turned off, and every one ends with “Reply STOP to opt out.” Email campaigns go only to Customers, skip anyone who unsubscribed, bounced, or reported spam, and include a one-click unsubscribe link and the Business’s postal address. Unsubscribing does not stop receipts or appointment emails.

10.2 Reviews. After a job, a Business may text you a link to leave a review. If the Business connects Google Business Profile, Suds reads its reviews to route happy Customers to Google and to help the Business follow up privately on low ratings (section 11).

10.3 Suds Ads. Through Suds Ads, our team runs Facebook and Instagram lead ads for a Business using the Business’s ad account. We receive lead-form answers (section 6), ad spend, and results, and connect each lead to the ad it came from so the Business can see which ads lead to sales. Lead forms from Google, TikTok, and LinkedIn can also be sent to a Business’s Suds account by webhook.

10.4 No conversion uploads. Suds does not upload conversions, hashed contact details, Customer lists, or audiences to Meta, Google, TikTok, or other ad platforms. When a Business connects Google Ads, Suds only reads campaign numbers from it (section 11.5) and sends no Customer data to Google. We will update this policy before that changes.

10.5 Tags a Business adds. A Business can add its own Google Analytics, Google Tag Manager, Meta Pixel, or TikTok Pixel tags to its pages on its own domain. Those tags send data directly to those companies under the Business’s own accounts and policies. They do not load when your browser sends a Global Privacy Control signal.

10.6 Text-us links. When you tap a Business’s “text us” short link, we record the tap, device and browser type, approximate location, and referring page under an anonymous ID that changes daily. We do not store your IP address for these taps.

11.1 Google Business Profile. If a Business connects its Business Profile, we read its locations, review links, and reviews (reviewer name or anonymous status, rating, comment, dates, and the Business’s public reply). We use low ratings to open a private follow-up ticket for the Business and suggest the matching job, which a manager must confirm. We do not post, edit, reply to, or delete anything on the profile, and we do not read Business Profile messages.

11.2 Search Console. For a Business whose own domain runs on a Suds website, Suds verifies the domain with Google by serving Google’s verification file on that site, adds the site to Suds’s own Search Console, and submits its sitemap. If the Business connects its Google account, Suds reads the list of sites in the Business’s Search Console to find its website, adds Suds’s service account (a Google account Suds runs for this work) as an owner of that site, and, when Suds verified the site first, adds the Business’s Google account as an owner as well, so the Business can open Search Console itself. Suds then reads the site’s search numbers (clicks, impressions, searches, and pages) and whether Google has indexed its main pages, to show reports and suggestions inside Suds. Suds never removes the Business’s own owners or settings. Every change Suds makes in Google is logged.

11.3 Google Analytics on Business pages. Websites and booking, quote, gift, and lead pages Suds runs for a Business may use Google Analytics in the Business’s own account. Suds sends visits, taps, booking steps, and confirmed bookings, leads, and payments with amounts. Suds never sends your name, phone, email, address, vehicle, or messages to Google, removes private link codes from page addresses, turns off Google signals, and redacts ad data. Visitors from the EEA, UK, and Switzerland are asked for consent first, and ad features stay off for browsers that send Global Privacy Control. You can also use Google’s opt-out add-on.

11.4 Setting up Google Analytics. If a Business connects its Google account for Google Analytics, Suds reads its Analytics accounts, properties, and web streams to find the property for its website. When there is none, Suds creates a property and a web data stream for the website in the Business’s own account, or opens Google’s sign-up when the Business has no Analytics account. Suds adds its service account to that property as an Editor, so it can keep the setup correct without keeping the Business’s sign-in for that. With the Business’s yes in Suds, Suds sets the time zone, currency, 14-month data retention, key events for bookings and leads, the event fields Suds’s pages send, and a key for sending confirmed bookings and payments, and turns Google signals off. Suds also reads which Google Ads accounts are linked to the property (section 11.5). For some Businesses, Suds instead creates the property and web stream in Suds’s own Analytics account. Suds shows the Business its own numbers inside Suds. Every change is logged.

11.5 Google Ads. If a Business connects its Google Ads account, the Suds team signs in with the Business’s Google account, and Suds asks Google for Google Ads access and for that Google account’s email address and account ID, which Suds keeps only to know which sign-in it holds. Suds uses the Google Ads access only to read: the list of Ads accounts that sign-in can see (account ID, name, currency, and whether it is a manager account) so the Business’s account can be picked, and then, for that account, campaign names and status and each day’s spend, clicks, impressions, and conversions. Suds shows these numbers to the Business and its Suds team and uses the spend to work out the Business’s cost per lead and cost per booking. Suds never creates, changes, pauses, or deletes campaigns, ads, budgets, or settings, and does not upload conversions or Customer details to Google Ads, or build audiences there (section 10.4). Google Ads data is not sold, not shared with other Businesses or anyone else, and not used for advertising. Suds stores the Google sign-in encrypted and reads the numbers from Google each time they are shown, without keeping a copy of the campaign report. Separately, when someone reaches a Business’s page from a Google ad, Suds keeps the ad click ID and campaign tags with the booking or lead, so the Business can see which ads bring bookings. Answers to a Business’s Google lead form ads can arrive in its Suds account by webhook as new leads. When the Business’s Analytics property is linked to Google Ads, Suds allows ad cookies on its Analytics tag. They stay off for browsers that send Global Privacy Control, and where visitors are asked first, until they agree. A Business that has not connected Google Ads can type its ad spend into Suds by hand. To disconnect, a Business asks the Suds team (or the Suds team taps Disconnect Google Ads on the Business’s page): Suds deletes the stored sign-in and revokes its access at Google, unless the same Google account is still connected to Suds for something else. A Business can also remove Suds’s access at any time from its Google Account at myaccount.google.com/permissions.

11.6 Google Calendar. A worker can connect a Google Calendar so busy times block scheduling. We read free/busy times only, never event titles, details, attendees, or locations.

11.7 Google Maps Platform. We use Google Maps to show maps, look up and complete addresses, plan routes and arrival times, and show a Street View image of a service address. We also use Google Places to find public business listings for our own sales outreach to shops.

11.8 Limited Use. Suds’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to provide the features described here, never for advertising and never to train AI models, and people at Suds read it only with the Business’s permission, for security, or as the law requires.

11.9 Disconnecting. A Business can disconnect Google at any time (Business Profile from Reviews → Settings, Calendar from the worker’s profile, Search Console and Analytics from the website settings, Google Ads through the Suds team). Disconnecting deletes the stored tokens, revokes Suds’s Google Ads access at Google, and removes the Search Console owners Suds added. When disconnecting Analytics, the Business chooses whether Suds’s service account leaves its property too.

12.1 Dispute fighter. When a Customer disputes a card payment, Suds can build a response for the Business from its records: signed agreements (with signer name, time, IP address, and browser), before and after photos, payment and refund records, messages with the Customer, survey answers, the job timeline, and the Business’s policies. AI (Anthropic) may draft the letter and choose the evidence. The response goes to Whop and the card network. A Business can review it first or turn on automatic submission.

12.2 Collections. Where a Business turns on collections, it can send an unpaid invoice to Debitura, a collections partner. Suds then sends Debitura the Customer’s name (or company), address, email, phone, the amount and due date, a note, and proof such as the invoice, signed documents, quote, and photos.

13.1 Cameras. A Business can connect Ring cameras (through Ring’s partner API) or compatible shop cameras for Live Shop. Live video streams to the viewer on demand; Suds does not store camera video, does not use it to train AI, and does not derive biometric information from it. Camera logins and tokens are encrypted and deleted when the Business disconnects.

13.2 Voice and face information. Suds Voice makes a voice model only after the speaker gives written consent in the app, by checking a box confirming it is their own voice or that they have the owner’s written permission. The recording goes straight to ElevenLabs to make the model and is not kept by Suds. The model is used only for that Business’s voice memos, voice notes, and phone greetings, and is never sold or shared. Suds deletes the model when the Business turns Suds Voice off, removes the voice, or asks to delete its account, and 1 year after it was last used. Selfies Suds asks workers to take for their profile are stored as photos only; Suds does not make face templates and does not match faces.

13.3 Service addresses. We geocode service addresses so Businesses can plan routes and show arrival maps.

13.4 Worker location. While a worker is on the way to a job and has chosen to share it, their phone sends its location so the Customer’s tracking page can show an arrival time. Sharing stops when the job starts or the worker turns it off. We do not track workers in the background.

13.5 Workers. A Business controls its workers’ information in Suds (section 2). Privacy requests about it should start with the employer, and we help the employer answer them.

14.1 Cookies and storage we use.

14.2 Analytics. We use Vercel Web Analytics and Speed Insights in the Suds app, which measure page views and speed without cookies. The suds.com marketing site uses no analytics cookies.

14.3 Your controls. You can block or clear cookies in your browser; signing in needs the essential cookies. We honor the Global Privacy Control signal as an opt-out of sale and sharing. We do not respond to “Do Not Track” signals.

15.1 Who receives personal information.

• The Business you deal with, which uses it to serve you.
• Subprocessors that run parts of the Service for us (section 16), under contracts that limit their use of it.
• Third-Party Services a Business connects, as described above and as the Business directs.
• Authorities and others when the law requires it, to answer valid legal process, or to protect people, the Service, or our rights.
• A buyer or successor in a merger, acquisition, or sale of assets, which must honor this policy.

15.2 No sale. We do not sell personal information for money or other value. Section 20 explains the limited case where tags a Business adds may count as “sharing.”

16.1 Current list. These companies process personal information for the Service. Some only receive data when a Business turns on the related feature.

16.2 Changes. We update this list when we add or replace a Subprocessor and announce new Subprocessors to Businesses by email or in the app. Questions go to support@suds.com.

17.1 General rule. We keep personal information for as long as needed for the purposes in this policy, then delete or de-identify it.

18.1 Safeguards. We use encryption in transit (TLS) and at rest. Bank, ad, Search Console and Analytics tokens, import and camera credentials, W-9s, and private document photos also get application-level encryption (AES-256-GCM). Sign-in uses one-time codes (stored only as hashes), with a second step for money actions and admin access. We separate each Business’s data, limit staff access to what their job needs, rate-limit sign-in and public forms, and log sensitive actions.

18.2 Breaches. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant Business as the law requires, without undue delay. A Business gets notice within 72 hours after we confirm a breach of its Customer Data.

18.3 Report a problem. Report a security concern to support@suds.com.

19.1 Choices for everyone.

• Texts: reply STOP to any text.
• Marketing email: use the unsubscribe link, or email us.
• Sale and sharing: send Global Privacy Control, or email us with the subject “Do not share.”
• Access, correction, deletion, and a copy: email us (section 21 for deletion).

19.2 How to make a request. Email support@suds.com or ask the Business you deal with. We verify requests by matching the email or phone number on file, and may ask for more information if needed. An authorized agent may act for you with your signed permission; we may ask you to confirm your identity directly. We respond within 45 days and tell you if we need up to 45 more.

19.3 Requests about Customer Data. When we hold your information for a Business, we may pass your request to that Business and help it respond, as its service provider.

19.4 No discrimination. We will not deny service, charge different prices, or give a different quality of service because you used a privacy right.

20.1 Who this covers. This section applies to residents of California and of other states with consumer privacy laws, including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, to the extent those laws apply to Suds.

20.2 Your rights.

Depending on your state, you have the right to:

• know what personal information we collect, use, disclose, sell, or share, and why;
• access it and get a portable copy;
• correct it;
• delete it;
• opt out of its sale, sharing, or use for targeted advertising;
• opt out of profiling for decisions with legal or similarly significant effects;
• limit the use of sensitive personal information;
• get a list of the third parties we disclosed it to, where your state provides it; and
• not be discriminated against for using these rights.

20.3 Categories (last 12 months).

We use these categories for the purposes in section 4 and keep them as described in section 17.

20.4 Sensitive personal information. We use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), so we do not offer a separate “Limit” link.

20.5 Sale and sharing. We do not sell personal information and have not in the last 12 months. Suds itself does not share personal information for cross-context behavioral advertising. When a Business adds its own ad tags to its pages (section 10.5), that may count as “sharing” by the Business; those tags do not load when your browser sends Global Privacy Control. We do not knowingly sell or share the personal information of anyone under 16.

20.6 Appeals. If we decline your request, you may appeal by replying to our decision within 45 days. A different person will review it and answer within the time your state’s law allows. If you disagree with the result, you may contact your state attorney general.

20.7 California Shine the Light. We do not disclose personal information to third parties for their own direct marketing.

20.8 Financial incentives. We do not offer financial incentives in exchange for personal information.

21.1 Customers and leads, including data from Facebook, Instagram, Messenger, or WhatsApp.

You can delete your data in any of these ways:

• Email us. Send an email to support@suds.com with the subject “Delete my data.” Include your name, the phone number, email, name on Facebook, or Instagram username you used, and the business you contacted, if you know it.
• Use your Facebook settings. If Suds is listed in your Facebook settings under Settings & privacy → Settings → Apps and websites, select it, choose Remove, and follow the steps to request deletion. Facebook sends us the request and shows you a confirmation code and a link back to this page. Messaging a business’s Page or Instagram account does not add Suds to that list, so if Suds is not listed there, email us instead.
• Ask the business. The business you contacted can erase your record, including messages, from its Suds account.

We confirm the request, find your records in each Business’s account, and delete your contact details, messages, form answers, recordings, and transcripts, along with any page-scoped, Instagram-scoped, or WhatsApp IDs saved with them, within 30 days, then tell you it is done. We keep only what the law requires (such as payment records) or a note that you opted out of texts, so we can keep honoring it. Deleting your data in Suds does not delete data held by Meta; manage that in your Meta account.

21.2 Business accounts. The Account Owner can go to My Account → Info → Delete account, or email support@suds.com from the account email with the subject “Delete my account.” Renewals stop right away, and the account can be restored for 30 days. After that, we delete or de-identify the account’s data, including its Customer Data, within 30 days, except records we must keep by law. Ask for an export first if you need one. See Support → Account & data deletion for step-by-step instructions.

21.3 Connected services. Disconnecting Google, Plaid, Ring, Meta, or another connected service deletes its stored tokens as described above.

22.1 Under 13. The Service is for adults and businesses. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 gave us personal information, email support@suds.com and we will delete it.

22.2 Under 16. We do not knowingly sell or share personal information of anyone under 16.

23.1 Where data is processed. Suds serves businesses in the United States and Canada and processes data in the United States. If you use the Service from outside the U.S., your information is transferred to and processed in the U.S., where privacy laws may differ from yours. Where the law requires, we protect transfers with appropriate safeguards and honor the rights that law gives you.

24.1 App store disclosures. Suds can be installed from the browser, and we may offer it through the Apple App Store and Google Play. The data we declare there matches this policy: contact information, financial information (never full card numbers), location, user content, identifiers, purchase history, and usage data, linked to the account. The Suds app itself does not track you across other companies’ apps or websites, and account deletion is available in the app and by email (section 21).

25.1 Updates. We may update this policy and will change the “Last updated” date when we do. For material changes, we notify Businesses by email or in-app notice before the change takes effect. We will not use personal information in a materially different way than described when it was collected without the notice or consent the law requires.