Thoro Clean Privacy Policy

• We collect what we need to quote, schedule, perform, and get paid for home-exterior and property-care services, and to run our network of independent partner businesses.
• We do not sell personal information for money, we do not sell or license personal information to data brokers, and we do not sell sensitive data. With your consent, our public website pages use Google and Meta advertising cookies to measure our ads and show them to people who visited the site. Some state laws treat this as "targeted advertising" or a "sale," and you can opt out at any time (Sections 9 and 12).
• Partners who do your job see only what they need for that job. We do not show them your card details, email, or phone number.
• The partner app records the partner's location at two moments of a job, when they tap Arrived and when they tap Complete. It does not track location in the background.
• Calls with us may be recorded and transcribed; an automated notice plays before any conversation is recorded (Section 2.4).
• You can ask us to delete your account by email, or in the app or at thoroclean.com/account/delete where that option is shown (Section 11).

2.1 Our websites (thoroclean.com, partners.thoroclean.com, referrals.thoroclean.com)

• Quote and contact forms: name, email, phone, ZIP code and optional street address, services you want, property details (size, how often), photos you upload, your message, how you heard about us, your contact preference, and any promo or referral code.
• Consent records: whether you agreed to texts about your request and, separately, to marketing texts and email, with the exact wording shown, the time, the page, and your IP address.
• Commercial and HOA requests: community or business name, management company, your role, number of homes or units, county, and areas to be serviced.
• Consultation bookings: name, email, optional phone, community, ZIP code, and the time you chose (this creates an event in our Google calendar).
• Partner call bookings: business name, services, service area, phone, and the time you chose.
• Newsletter (website pop-up) and "launching soon" sign-ups: email and, optionally, first name, ZIP code, services of interest, and phone (only with text consent).
• "Don't see your area?" requests: name, email or phone, city or ZIP code, and the service you want.
• Partner applications: business name, contact name, email, phone, trades, counties served, insurance status, and trade photos. If you contact us about becoming a partner and we can't reach you by phone, we may leave a voicemail and send one manual text with a link to book a call.
• Referral form: the referrer's type, name, company, email, and phone, and the referred person's name, property ZIP code, services, and contact details as provided by the referrer (see Section 2.5).
• Shop orders: items, sizes, colors, quantities, and prices; your email, shipping name and address, and phone (optional; carriers may need it); the shipping service you choose; sales tax; pre-order status, shipping, tracking, delivery, refund, and delay-notice dates; any Founding Collection credit the order earns; and the checkout's IP address (to limit abuse). You pay on Stripe's checkout page; we never receive your full card number.
• Technical data: IP address (used for rate limiting and security) and, only if you accept analytics or advertising cookies, the cookie data described in Section 9. Quote forms record how you arrived (UTM campaign tags, referring page, and ad click IDs such as gclid or fbclid) whether or not you accept cookies, and we use them inside our own system to measure which ads work. We do not send them to Google or Meta unless you accepted advertising cookies.

2.2 Customer app (thoroclean.com/customers and store apps)

• Account: name, email, phone, and password (stored only as a one-way hash), or, if you use Sign in with Google or Sign in with Apple where offered, that provider's account identifier for you, your name, your email (with Apple, this may be a private relay address if you choose Hide My Email), and the tokens needed to keep you signed in or end access. We do not get your Apple or Google password.
• Age confirmation: that you confirmed you are 18 or older, with the wording shown, the time, IP address, and browser.
• Properties: service addresses, property facts (size, roof, stories, water source, pets), and access notes. Codes entered in the gate, lockbox, or alarm code field are encrypted, stored separately, and shown only to the assigned partner shortly before the visit; each time staff reveal one, it is logged. If you type a code in your address or notes, we hide it from partners until then, but staff can see it. Please use the code field.
• Quoting information: to prepare a quote, we may look at public property imagery and county property records for your address, such as street-level images, roof data, and maps, and use any photos or videos you send us.
• Quotes, visits, invoices, receipts, payments, refunds, tips, ratings and comments (internal only), guarantee and damage reports, reschedule and cancellation requests, and recurring and season plans.
• Payment cards: you save a card on file through Stripe's secure form; we do not take deposits. We receive and keep only a Stripe reference, the card brand, last four digits, and expiration date, never the full card number.
• Support chat messages you send and our replies.
• Refer a friend: your referral code and link, who booked using it (shown to you only as a first name or similar and the booking status), and any reward recorded.
• Service credits: credit amounts, the reason, and the invoice each is applied to (including Founding Collection credit from shop orders and snow plan credits).
• Push notifications: if you turn them on, a push token or push subscription for that device, which our apps and browsers use to reach it through Apple, Google, or Mozilla.
• Photos you upload.

2.3 Partner app (partners.thoroclean.com and thoroclean.com/contractors)

• Account and profile: business legal name, DBA, entity type, contact name, email, phone, services, counties served, availability, and time-off blocks. If you use Sign in with Google or Sign in with Apple, we also receive the items in Section 2.2.
• Crew and vehicles: crew and vehicle details, welcome-kit sizes and shipping address, and your home base location (from your address, not your device), which we use to work out distance to jobs.
• Documents: W-9 (the file includes the full taxpayer identification number; in our main database we keep only the last four digits), certificates of insurance, insurance carrier and policy details, workers' compensation exemption details and signed statements (including the names and exemption numbers of working members), Florida Sunbiz records and local business tax receipts, wastewater certification, New Jersey home improvement registration numbers, and other licenses.
• New-hire reporting: for an individual or owner who personally does the work, your legal name, address, date of birth (New Jersey), Social Security number or other tax ID, and the date you first performed services (Florida). We collect these on a separate secure form, restrict them to our owners, log each opening, and use them only for the state report.
• Proof of independent business: for example your website or advertising, an invoice for other work with customer details removed, how many people you employ, your main equipment, your EIN if you have one, and the rough share of your revenue from Thoro Clean jobs. The items differ by state.
• Workers: the names and coverage evidence for people who work on Thoro Clean jobs, and a record that each person using the app agreed to location and call logging. On request for an insurance audit or government inquiry, payroll records showing only the last four digits of any Social Security number. For Florida public jobs, E-Verify confirmation.
• Background checks: we do not run them or see reports. If you take jobs from an advertising program that requires one, we learn only whether the program cleared a person.
• Agreement signing: typed name, drawn signature, the acknowledgment wording shown, the time, IP address, and browser. If you sign for a company, your separate personal signature.
• Payouts: we pay partners by ACH through our payment provider (Mercury, or Stripe Connect for any partner set up there before we moved to Mercury). The provider collects bank account and tax details directly; we receive payout status, transfer records, the name on the account, and limited identifiers (a recipient or account ID and the last four digits of the account), not your full bank account number.
• Jobs: offers sent and accepted or declined (and an optional decline reason), job status steps, before and after photos and photos of pre-existing conditions or problems, notes, internal ratings, and any filming credit.
• Location: when you tap Arrived and when you tap Complete on a job, the app asks your device for its location and records one latitude/longitude point and the device time for each tap. That is two points per job. If you log a yard sign and tap to use your location, we also save that one point with the sign record. The app does not collect location at any other time or in the background. You can deny location permission and still complete the job.
• Calendar: if you connect a private calendar link, we store it encrypted and read only busy times from it. If you connect a Google or Microsoft calendar, we read busy times through that provider.
• Pay records: per-job share, tips, trip-fee shares, adjustments, holds, and weekly statements.
• Communications: SMS consent (optional, recorded with the wording shown), push subscriptions, support chat, and calls and texts with customers through our masked numbers.
• Recruiting and invitations: if we found your business through public sources or a business-data vendor (Section 2.6), how and when we contacted you; invitation codes we send you (we keep only a scrambled form of the code); and when the code was used.
• "Refer a customer": if you refer someone through the partner app, the details you give us about them (Section 2.5).

2.4 Calls and texts

When you call or text us (including a staff member's direct line), when our staff call you, or when a partner and customer talk through a masked visit-day number, our phone provider, Twilio, carries the call or text. We keep call details (numbers, time, duration, who answered, outcome, and notes our staff type during or after the call) and the text of SMS messages.

Calls may be recorded, monitored, and transcribed for quality, training, and record-keeping. An automated notice plays before any conversation is recorded; if no notice plays, the conversation is not recorded. If you stay on the line after the notice, you agree to this. Please tell anyone listening with you. If you don't want a call recorded, tell us. Staff can stop recording on calls they place; on other calls, we will call you back on an unrecorded line or continue by email. Calls may be transferred to another team member or extension, or forwarded to a team member's phone. If you leave a voicemail, it is recorded and transcribed. Recordings and transcripts are kept with the call record for the period in Section 10.

2.5 Information about you from other people

• Referrals: a customer or referral partner may give us your name and contact details so we can reach out. We use them only to contact you about the service referred. We will not text you unless you opt in, and we will not make a sales call to you if your number is on the Florida or national do-not-call list unless you have asked us to.
• Referrals by partners: a partner may submit a person's name, phone, email (optional), ZIP code, street (optional), and the service wanted through the partner app's "Refer a customer" feature. We do not treat the partner's submission as your consent to texts.
• Website referral form: a realtor, property manager, or other referrer may submit your name, property ZIP code, services needed, and notes, and confirm that you agreed to be contacted. We record that confirmation and the wording the referrer was shown. It is the referrer's statement, not your own consent, and we will not text you unless you opt in yourself.
• Contacts on an account: a customer or commercial account may list other contacts (for example a property manager or family member).
• Neighbor credit: if a neighbor names your snow plan or address to claim a snow plan credit, we use it only to check and apply the credit.
• Property records: to prepare a quote we may look up public property records, roof data, and imagery for an address.

2.6 Business contact information from public sources (B2B)

To recruit partners, find referral partners, and offer commercial services, we compile contact information about businesses (for example cleaning companies, real estate offices, property managers, community associations, insurance agencies, builders, and commercial properties) from:

• public sources, such as business websites, public directories, and business profiles on networks such as LinkedIn, Instagram, and Facebook;
• Google Maps Platform (Places) search results, where our staff review the results and keep only the businesses they choose to add (we keep the Google place identifier and, for those businesses, the name, address, phone, website, and the date Google returned them); and
• business-data vendors whose lists we buy or export (for example Instantly SuperSearch).

This includes business name, contact name and role or title, business email and phone, website, street, city, county, state, ZIP code, business type, services of interest, and our notes.

We use this information to contact businesses about becoming a service partner, a referral partner, or a commercial customer, by email sent through Instantly from separate sending domains (such as thorocleanpartners.com, thorocleanpros.com, thorocleanreferrals.com, thorocleanhome.com, and getthoroclean.com), by phone calls made by our staff, and by connection requests and direct messages on LinkedIn and Instagram. Every outreach email identifies Thoro Clean and includes our postal address and a way to unsubscribe. If you unsubscribe or ask us to remove you, we stop emailing and calling your business, and we act on it within 10 business days. We do not send cold texts to these contacts, and we do not use automated or prerecorded calls to them. If a business becomes interested, its contact becomes an ordinary lead or applicant and this Policy applies as it does to any customer or partner. If you ask, we mark your business do-not-contact and remove it from our outreach lists. We keep a minimal record (your email or phone, the business name, and the date you asked) so that we do not contact you again (Section 12.7).

2.7 Social media, content, and reviews

• If you fill in one of our lead forms on Facebook or Instagram, Meta sends us your answers (for example your name, phone, company, trade, county, and insurance status), and we add them to our partner or customer records.
• If you message our Instagram account, automated replies are sent through ManyChat.
• If you answer one of our posts or ads on a site such as Craigslist, Nextdoor, or Yelp, we receive what you send us and may add it to our partner or customer records.
• If you follow, comment on, tag, or message our Facebook, Instagram, Google Business Profile, or other social pages, we see what the network shows us (for example your public profile name and what you posted or sent). The network's own privacy policy applies to it.
• Our social inbox stores comments and messages sent to our pages, with the name, handle, and picture the network shows, and we may add you to our partner or customer records from them.
• Our marketing dashboard receives only daily totals from Google and Meta (for example visits, ad clicks, followers, reach, and engagement on our own posts). It does not receive or store names, comments, or who engaged.
• We plan and schedule posts with our own systems and social media scheduling tools. We do not put customer names, addresses, or identifying photos into posts without the customer's permission (see Terms of Service Section 13.5).
• Reviews you leave on Google or Facebook are public and governed by that site's terms. We record whether you clicked our review link, and we may copy your public review and name from Google and match it to your visit.

• To provide the service: quote, schedule, assign partners, give partners the details they need, carry out and document the work, invoice, charge the card on file, and pay partners.
• To communicate: confirmations, reminders, arrival updates, receipts, support, guarantee and claims handling, account messages, and (with consent) marketing.
• Service follow-up and safety: customer ratings, guarantee and damage cases, reviewing calls with our own staff, partner compliance (insurance, documents, agreements), fraud prevention, and security. We do not use job photos, location points, or masked calls to direct how a partner does the work.
• Partner payments and tax: payouts, statements, annual tax reporting (Form 1099-NEC), and state new-hire reports.
• Review requests: after a completed, paid job, we may ask you to review us on Google or Facebook (Terms of Service Section 14.4).
• Shop orders: process payment, calculate sales tax, buy shipping labels, ship and track orders, handle returns and refunds, and issue any Founding Collection credit.
• Referrals and rewards: attribute bookings to referral codes, links, and referral forms, and record rewards, credits, or referral-partner fees.
• Business outreach: find and contact businesses that may want to become service partners, referral partners, or commercial customers (Section 2.6), and honor opt-outs.
• Marketing content: plan and publish posts and ads about our services, with consent for anything that identifies a customer.
• Analytics and advertising (public website pages only, with consent): measure visits and which ads lead to quote requests, and show our ads to people who visited our site.
• Legal: comply with law, keep required records, and protect our rights and the safety of customers, partners, and staff.

AI tools. We use artificial-intelligence services (currently Anthropic) to help our team draft marketing content and messages and to help run day-to-day operations, including reading leads, partner records, and messages to prepare replies and call notes. The information may include names, contact details, job details, and messages. The provider processes it to provide its service to us. Our store apps, once released, will ask your permission before information collected through those apps is shared with AI services, and your answer will not affect your service.

We do not use personal information to make decisions that produce legal or similarly significant effects about you solely by automated means. A partner's new job offers may be paused under the Partner Agreement; the partner is told why and can ask a staff member to review it.

We share personal information as described here.

4.1 Partners

The partner assigned to your visit sees the service address, the scope of work, the property facts and access notes they need, the gate, lockbox, or alarm code if you gave one, your first name, and the photos for the job. Before accepting a job offer, partners see only the service, day, time window, city, ZIP code, job price, and their estimated pay. We do not show partners your payment details, card details, email, phone number, or your other jobs. Customers see the first name of the Service Specialist on their own visit. On a New Jersey home improvement job, your contract also names the partner's business, business address, registration number, and insurance details, as the law requires.

4.2 Service providers (processors)

We choose these providers to work for us and share what they need for the job. Their contracts and their own terms limit how they may use it. Some of them, such as Stripe, also use limited data for their own fraud prevention, security, and legal duties, under their own privacy policies. Google and Meta advertising tags are different: see Section 4.3.

4.3 Other sharing

• Advertising partners (public website pages, with consent): Google and Meta receive website usage and ad click data through their tags and may use it for their own purposes under their terms, which is why we treat it as targeted advertising you can opt out of (Sections 9 and 12).
• Legal and safety: when required by law, subpoena, or court order, or to protect the rights, property, or safety of customers, partners, staff, or the public.
• Government reporting: state new-hire and tax reports the law requires, including New Jersey's or Florida's new-hire directory.
• Insurers: information about a damage or injury claim, shared with the partner's insurer, or ours if we have coverage for the claim, to handle the claim.
• Professional advisers and collectors: our lawyers, accountants, and tax authorities, and anyone we use to collect an unpaid balance.
• Business transfers: in connection with a merger, sale, or financing of our business, subject to this Policy.
• At your direction: for example, when you ask us to send something to a property manager or association.

If you opt in to texts, we text you from our registered numbers. On the day of a visit, your Service Specialist may also text you about that visit through a Thoro Clean number that hides both numbers; reply STOP to end those texts. Message frequency varies; message and data rates may apply. Reply STOP to stop or HELP for help. Service texts and marketing texts have separate opt-ins, and agreeing to texts is never a condition of purchase. Our Text Message Terms (thoroclean.com/messaging) give full details. We do not sell or share your phone number or text-message opt-in data with third parties or affiliates for their marketing. We share it only with service providers that work for us (Section 4.2) and as Section 4.3 describes, never for anyone's own marketing.

• Customers: we use your service address to schedule and route your visit. The customer app does not collect device location.
• Partners: as described in Section 2.3, the partner app collects one location point when the partner taps Arrived and one when they tap Complete, to confirm the visit took place at the service address and to help resolve customer questions and claims. If a partner logs a yard sign and taps to use their location, we also save that one point with the sign record. Location is kept with the job record. It is never collected in the background and is not used to monitor partners' movements.

Job photos are kept in private storage. We show them to you, the partner on the job, and our staff, and share them with insurers and our advisers for claims and with our storage providers. We may use exterior job photos for marketing as described in our Terms of Service (Section 13.2) unless you opt out by emailing hello@thoroclean.com or calling (844) 998-4676. We will not use a photo showing your name, face, house number, street sign, license plate, or address without your permission (Section 13.5 of the Terms), and we will not film or publish video of your property without your permission.

If you turn on notifications, we send push notifications through Apple, Google, or Mozilla push services. A push subscription or token belongs to the person signed in on that device. It is removed when you turn notifications off, sign out, or the push service reports it is no longer valid, and unused subscriptions are deleted after 90 days.

9.1 Essential cookies keep you signed in, keep the site secure, and remember your cookie choice. They are always on.

9.2 Analytics and advertising cookies are off until you agree in our cookie banner. On our public website pages (thoroclean.com, partners.thoroclean.com, and referrals.thoroclean.com), and only with your consent, we use Google Analytics 4, Google Ads conversion tracking, and the Meta Pixel, either directly or through Google Tag Manager, with Google Consent Mode set to your choice. They help us measure site visits and ad performance. With advertising consent, the Meta Pixel and Google Ads tags also let us show our ads to people who visited our site ("retargeting" or remarketing audiences). These tools are not used inside the customer app, the partner app, or our staff system.

9.4 We do not respond to "Do Not Track" browser signals, because there is no common standard for them. Our website does not yet act on Global Privacy Control signals. To opt out, decline or withdraw advertising consent as Section 9.3 describes.

We keep personal information only as long as needed for the purposes in this Policy, including legal, tax, and accounting requirements, and then delete or de-identify it. We review these records and delete them by hand or automatically around these times.

• Website (customers and partners): email hello@thoroclean.com from the address on your account, or use thoroclean.com/account/delete where the option is shown.
• Apps: use the delete option in the customer or partner app, where it is shown.

If you have a visit booked, an unpaid invoice, open jobs, or pay not yet sent, deletion waits until those are settled, and we tell you what is holding it up. After you confirm, sign-in stops, plans are paused (a prepaid snow season plan is cancelled when your deletion goes ahead, as Section 5.8(l) of our Terms says), and you have 14 days to change your mind. We then remove your sign-in, push subscriptions, and personal details; mark your saved card removed so it can't be charged; and delete or de-identify your data within 30 days after that period, except records we must keep (Section 10), which we keep securely and use only for that purpose. City, state, ZIP code, and property facts stay with those records. For partners, records about jobs you did, pay, and tax documents are kept as required by law. Amounts already owed remain due. Stripe keeps its own transaction records as the law and card rules require.

If you signed in with Apple, we use Apple's service to revoke our sign-in tokens when your account is deleted, and we delete your Apple identifier and tokens. You can also stop using Sign in with Apple or Google for our app in your Apple or Google account settings. That stops that sign-in method but does not delete your Thoro Clean account or data; to do that, use the steps above.

12.1 Everyone can: see and correct most account information in the app; opt out of texts (reply STOP) and marketing email (use the unsubscribe link); turn off push notifications; change cookie choices (Section 9.3); and ask to delete their account (Section 11).

12.2 State privacy rights. Depending on where you live, you may have the right to:

• confirm whether we process your personal data and access it;
• correct inaccurate data;
• delete personal data;
• get a portable copy of your data;
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• appeal our decision on your request.

The New Jersey Data Privacy Act (P.L. 2023, c. 266) gives these rights to New Jersey residents for businesses it covers. Whether or not that Act or another state's law applies to us, we choose to honor these requests from our customers and partners, including Florida residents, in the way described below and subject to the same exceptions those laws allow (for example, records we must keep, and information needed to complete a job, resolve a claim, or prevent fraud). Doing so doesn't make us subject to any law that doesn't otherwise apply to us.

12.3 How to make a request. Email hello@thoroclean.com with the subject "Privacy request" or call (844) 998-4676. You do not need an account to make a request. We will verify your identity (usually by confirming control of the email or phone on your account) and respond within 45 days, which we may extend once by another 45 days when reasonably necessary, telling you why. Requests are free of charge at least once a year. An authorized agent may make a request for you with proof of authority. You do not have to verify your identity to opt out of targeted advertising. We may ask for more information only if we reasonably believe an opt-out request is fraudulent, and we will tell you why.

12.4 Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject. We will respond in writing within 45 days and explain our decision. If we deny your appeal, you can file a complaint with the New Jersey Division of Consumer Affairs at www.NJConsumerAffairs.gov or 1-800-242-5846.

12.5 We will not discriminate against you for exercising your rights.

12.6 Sensitive data. We do not need sensitive data to do your job and do not ask customers for it. If you choose to tell us about a health condition so a partner can plan around it, you are agreeing that we may use it for your visits and share what the partner needs. You can ask us to remove it at any time by emailing hello@thoroclean.com, and we will stop using it within 15 days. We do not sell sensitive data. The partner app collects the location of partners at two moments of a job, as described in Section 6. We collect partners' Social Security numbers and dates of birth only for tax and state reporting.

12.7 Business contacts. If we hold your business contact information (Section 2.6), you can ask us what we hold, correct it, or have it removed from outreach as described in Section 2.6, and you can unsubscribe from any outreach email at any time.

Our services, apps, and texts are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you think a child has given us information, contact us and we will delete it.

We use encryption in transit (TLS) for our websites and apps, and encryption at rest for our main database and file storage. We hash passwords and session tokens, limit staff access by role, keep audit logs of sensitive actions (such as revealing a gate code or opening a W-9), and encrypt partner calendar links. No system is perfectly secure. If a breach affects your personal information, we will notify you as required by law (N.J.S.A. 56:8-163; Fla. Stat. 501.171).

We store data in the United States.

We will post updates here with a new effective date and, for material changes, notify you by email or in the app before they take effect. If we want to use personal data we already hold for a new purpose that is not reasonably related to the purposes in this Policy, we will ask for your consent where the law requires it.

Thoro Clean (Thoroclean Auto Appearance LLC)
Email: hello@thoroclean.com
Phone: (844) 998-4676
Web: thoroclean.com
Mail: 865 NJ 33 Business, Ste 3, Unit #157, Freehold, NJ 07728