Privacy Policy

Effective date: July 22, 2026 | Last updated: July 22, 2026

How PayCovay / ReCoil collects, uses, protects, and shares information.

1. Information We Collect

• Account information: name, email, phone number, business name, login details, preferences, and workspace settings.
• Business and content data: websites, leads, customers, jobs, messages, articles, files, invoices, quotes, domains, connected repositories, analytics, and campaign data you provide or connect.
• Connected-account data: limited tokens, IDs, permissions, metadata, and API responses from providers you connect, such as Google, Microsoft, GitHub, Vercel, Cloudflare, Stripe, Meta, WhatsApp, email, SMS, hosting, CMS, or search services.
• Usage and device data: pages visited, feature usage, browser, device, IP address, approximate location, timestamps, logs, diagnostics, and error reports.
• Communications: support requests, emails, WhatsApp/SMS messages, call notes, and responses you send through the service.

2. How We Use Information

• Provide, operate, secure, troubleshoot, and improve the service.
• Run requested workflows, such as scans, reports, automations, publishing, indexing, routing, reminders, quotes, invoices, or customer follow-up.
• Authenticate users, maintain sessions, enforce approvals, and prevent fraud or abuse.
• Send transactional messages, alerts, reminders, confirmations, and support responses.
• Analyze feature usage and site performance.
• Comply with legal, tax, security, and platform obligations.

3. Analytics, Cookies, and Pixels

We may use essential cookies for login and security. We may also use privacy-conscious analytics and advertising or measurement tools such as Google Analytics, Meta Pixel, Microsoft, or similar services where enabled. These tools may collect identifiers, events, device information, referral data, and page activity. Users can manage cookies in their browser and may opt out of some third-party advertising through the provider settings.

4. AI Processing

When you ask for AI features, relevant prompts, files, pages, messages, or business records may be sent to model providers or processed by local models, depending on the configured workflow. AI results may be stored with the task history so you can review, reuse, or audit them.

5. Third-Party Providers

We may use providers for hosting, database, authentication, payments, email, SMS, AI, analytics, storage, search, DNS, source control, and integrations. These may include Cloudflare, Supabase, Stripe, Resend, Twilio, Meta/WhatsApp, Google, Microsoft, GitHub, Vercel, OpenAI, Anthropic, and similar services selected for the product. Each provider processes data according to its own terms and privacy commitments.

6. Sharing

We share information only as needed to operate the service, complete your requested actions, comply with law, prevent harm, handle a business transfer, or with your direction. We do not sell your customer lists, lead data, private business records, or connected-account data.

7. Security

We use reasonable administrative, technical, and organizational safeguards, including HTTPS, access controls, environment secrets, provider security controls, audit logs where available, and tenant separation. No internet service can guarantee absolute security.

8. Data Retention

We keep account and business data while your account is active or as needed to provide the service. After cancellation or deletion request, data may be retained for a limited period for backup, fraud prevention, dispute handling, legal, tax, or security reasons.

9. Your Choices and Rights

You may request access, correction, export, or deletion of personal information where applicable. You may disconnect integrations, revoke third-party tokens, unsubscribe from marketing emails, or text STOP to opt out of supported promotional SMS workflows. Transactional or security messages may still be sent where required to provide the service.

Location Data and Connected Providers

Some features may use location to provide maps, nearby-provider search, cleaner or contractor matching, property/job routing, local SEO, delivery, field-service workflows, or other location-based automation. We may process approximate location from IP address, business address, service area, job address, property address, or user-provided location details.

Precise device location is used only when a feature clearly asks for it and the user grants permission through the browser, device, or connected app. Connected providers such as WhatsApp/Meta, Google, Microsoft, Cloudflare, Stripe, maps and geocoding services, SMS/email providers, analytics tools, hosting providers, and user-authorized integrations may also process IP address, device data, approximate location, or permission-based location data under their own privacy policies and permission prompts.

Sensitive Information, Payments, and Uploaded Files

We do not intentionally request sensitive personal information unless a specific workflow clearly needs it and you choose to provide it. Do not upload Social Security numbers, medical records, government IDs, passwords, private keys, or other highly sensitive information unless the product explicitly asks for it and you understand the risk.

Payment details are handled by payment processors such as Stripe. We may store billing status, subscription status, customer IDs, connected-account IDs, receipts, plan names, and related metadata, but we do not store full card numbers or bank credentials on our own servers.

Images, screenshots, files, videos, and other uploads may be processed to provide the requested feature, such as alt text, SEO checks, visual review, OCR, accessibility checks, training-data preparation, or report generation. Where a workflow is temporary, we aim to avoid keeping the raw upload longer than needed; where a workspace, article, audit, or project history needs the file, it may remain stored until deleted or the account is closed.

Legal Bases for Processing

Where EU, UK, Canadian, or similar privacy laws apply, we process personal information only when we have a valid reason, such as providing the service you requested, your consent, legitimate business interests, security and fraud prevention, legal obligations, vital interests, or a business transaction. You may withdraw consent where consent is the basis for processing, but that may limit features that depend on the information.

Cookies and Tracking Choices

We may use strictly necessary cookies or browser storage for login, security, preferences, accessibility settings, and feature state. If analytics, pixels, ads, or measurement tools are enabled, they may use cookies, pixels, device data, referral data, page events, and similar technologies. You can manage cookies through your browser settings and, where available, provider opt-out tools.

Do Not Track and Advertising Choices

Some browsers and devices offer Do Not Track or similar signals. Because there is not yet a single accepted standard for how every website must respond to those signals, we do not currently change behavior automatically when a Do Not Track signal is received. If a binding standard applies to us in the future, we will update this policy.

You can usually remove or reject cookies through your browser settings. Rejecting cookies may affect login, preferences, analytics, accessibility settings, or other features. For interest-based advertising choices, you may also use industry opt-out tools such as the Digital Advertising Alliance or provider-level ad settings where available.

California Shine the Light and Minor Content Rights

California residents may request information about categories of personal information, if any, disclosed to third parties for their direct marketing purposes during the preceding calendar year. We do not sell personal information, and we do not intentionally disclose customer data for third-party direct marketing without permission.

If a California user under 18 has an account and publicly posts content through a service feature, they may request removal of that publicly posted content. Removal from public display may not remove every copy from backups, logs, archives, third-party caches, or records we must keep for legal, safety, security, or fraud-prevention reasons.

California and Other Privacy Rights

Where applicable law gives you privacy rights, you may ask to know what personal information we collect, request access, request correction, request deletion, request a portable copy, object to certain processing, restrict processing where available, or opt out of sale or sharing if that ever applies.

We do not sell personal information. If we disclose information to service providers, we do it so they can perform services for us under contract, such as hosting, analytics, payments, communications, security, support, or automation. We may also use information for internal research, product improvement, security testing, and service demonstration. That internal use is not a sale of personal information.

You may use an authorized agent to submit a privacy request where the law allows it. We may require proof that the agent is authorized to act for you. We may also need to verify your identity by matching information you provide with information already connected to your account, email, phone number, or prior interaction. Information provided for verification is used only for verification, security, and fraud prevention.

We will not discriminate against you for exercising privacy rights. Some requests may be limited by legal obligations, security needs, fraud prevention, free speech, accounting records, dispute handling, backups, or technical limits involving de-identified data.

10. California, Europe, UK, and Canada

Depending on your location, you may have additional privacy rights, including the right to know, access, correct, delete, restrict, object, portability, or appeal certain decisions. Contact us to exercise those rights. We will respond within a reasonable period required by applicable law.

11. Children

The service is not directed to children under 13, and business-account features are intended for users 18 and older. If you believe a child provided personal information, contact us and we will take appropriate steps.

12. Contact

Privacy questions or requests can be sent to [email protected].