Privacy Policy

Effective date: August 1, 2026 Applies to: the mobile app published as Lawn Dominators - Business Suite (iOS and Android) and the website at lawndominators.com.

---

The short version

If you read nothing else, read this. Every line here is explained in full further down, and nothing below contradicts it.

• We never store credit or debit card numbers. Stripe holds those. We keep only what is printed on a receipt: brand, last four digits, expiry.
• We never sell your personal information, and we never sell or share customer records, phone numbers, or text-message consent with anyone for marketing.
• A phone number on file never means permission to text. Consent is a separate, recorded decision, and it is re-checked on our server immediately before every automated text goes out.
• Crew location is foreground only, while a visit is in progress, and it is deleted the moment the visit is completed. There is no background tracking and no history trail.
• Photos are stripped of hidden data before they leave the phone — GPS coordinates, camera serial numbers, timestamps. A photo that fails that check is not uploaded at all.
• You can delete your account, and separately delete your whole company's data, from inside the app. Section 10 says exactly what each one removes and what it deliberately keeps.
• If a lawn-care company entered your details, that company controls them. Ask them first; section 11 explains why.
• Questions or requests: support@lawndominators.com.

1. Who we are

Lawn Dominators LLC ("Lawn Dominators", "we", "us") operates this app.

Company	Lawn Dominators LLC
State of formation	Oklahoma
Privacy contact	support@lawndominators.com
Online	https://lawndominators.com/business

2. The two kinds of people this policy covers

This app is used by two different groups, and the rules are different for each. Read the part that describes you.

If you are an app user — a homeowner tracking your own lawn, or a lawn-care business owner, office staffer, or crew member using the Business Suite — we are the company that decides how your data is handled. California law calls this a "business"; European law calls it a "controller." Sections 3 through 12 apply to you.

If you are a homeowner who is a customer of a lawn-care business that uses this app — your name, address, phone, email, and property photos were put into the app by that business, not by you. That business decides what happens to your information. We only store and move it on their instructions. California law calls us a "service provider" in that situation. If you want your information corrected or deleted, contact the lawn-care company that services your property. They control it; we act on their instruction. See section 11.

3. What we collect, in plain terms

3.1 Your account

When you sign in with Apple or Google, we receive and store your name (if you choose to share it) and email address, and Firebase issues a permanent account ID for you.

3.2 Your own lawn records (consumer features)

If you use the homeowner side of the app and are signed in, these records sync to your private cloud account: your profile, saved properties, application logs, schedules and reminders, diagnosis history, soil tests, tank mixes, inventory, garage maintenance, growing-degree-day sessions, yard work, deal watches, beginner progress, and connected-irrigation records.

(Verified: SYNCED_FIRESTORE_COLLECTIONS in supabase/functions/_shared/accountDeletion.ts.)

3.3 Your business's customer records (Business Suite)

If you run a lawn-care business on the Business Suite, the app stores the following about each of your customers. We do not choose to collect this — you enter it, and we hold it for you.

Field	What it is
name	Customer name
address, cityStateZip	Service address
phone	Phone number, always stored in international +1... format
email	Email address
marketingSmsConsent, marketingSmsConsentSource	Whether they agreed to marketing texts, and where that permission came from
smsConsentStatus, smsConsentSource	Whether they agreed to service texts (or opted out), and where that came from
contactPreference, preferredPaymentMethod	How they want to be contacted and to pay
cardOnFileStatus, cardOnFileBrand, cardOnFileLast4, cardOnFileExpMonth, cardOnFileExpYear	Card authorization status and safe display details only — see section 4
lawnSizeSqFt, grassType, measuredAreas	Property size and turf details
serviceCadence, servicePrice	Service plan
propertyPhotoUri, propertyPhotoGallery	Photographs of the property
accessNotes, propertyNotes	Free-text notes (gate codes, dog in yard, etc.)
location	The property's latitude and longitude, used for routing

(Verified: BusinessCustomer in src/business/domain.ts.)

We also store quotes, invoices, payment requests, message history, and pesticide/fertilizer application records tied to those customers.

3.4 Crew location while a visit is in progress

When a crew member starts a visit, the app can record their phone's location so the office can see route progress. Three things are true about this and are worth stating precisely:

1. It is foreground only. The app uses a foreground location watch. It does not track a crew member's phone in the background or when the app is closed. (Verified: src/business/useCrewLocationTracking.ts — Geolocation.watchPosition, no background location mode requested.)
2. It only runs while a visit is in work. The fix stored is latitude, longitude, accuracy, heading, speed, and a timestamp. (Verified: VisitLocationSnapshot in src/business/domain.ts.)
3. It is deleted when the visit is completed. Completing a visit deletes the currentLocation and lastLocationAt fields outright — they are not kept as a history trail. (Verified: completeBusinessVisit in src/business/backend/firestoreRepository.ts writes deleteField() for both.)

3.5 Photos

• Property and job photos (Business Suite). Before any photo leaves the device, a native module re-decodes the image, applies the correct rotation, re-encodes it as a bounded JPEG, and then strips and structurally verifies that no metadata survived. That means embedded GPS coordinates, camera serial numbers, and timestamps in the original file are removed before upload. A photo that fails this check is not uploaded at all. (Verified: src/business/protectedImagePreprocessing.ts, android/.../BusinessProtectedImageModule.kt, ios/LawnDominatorsBusinessSuite/BusinessProtectedImage.mm.)
• Beta feedback screenshots. If you send beta feedback, the report can include a screenshot of whatever was on your screen at that moment, plus the screen name and app version. This is emailed to the owner. (Verified: src/business/betaFeedback.ts.)

3.6 Location for weather, mapping, and address lookup

Saved property coordinates and, with your permission, your device location are used for weather forecasts, growing-degree-day tracking, maps, address search, route planning, pest-activity alerts, and watering features. These are sent to the providers listed in section 5.

3.7 Push notifications

If you turn on notifications, we store your device push token, a device identifier, your account ID (if signed in), and which properties you want alerts for. Signed-out users can register for weather and deal alerts with no account ID attached. (Verified: supabase/functions/register-push-device/index.ts.)

3.8 Crash and diagnostic data

Firebase Crashlytics collects crash reports and technical context such as app version, device model, platform, and the screen that was active when the error happened. Crash reports are not tagged with your signed-in account ID. (Verified: src/services/crashReporting.ts sets attributes and logs only; it never calls setUserId.)

3.9 Purchases

Subscription and purchase status is processed by Apple, Google Play, and RevenueCat.

This app shows no advertising and does no advertising tracking. It contains no ad software, no Meta or Facebook software, and no advertising identifier is collected or shared. You will never see a tracking-permission prompt, because there is nothing here that would use it.

3.10 Connected accounts you choose to link

If you connect an irrigation controller, weather station, soil sensor, or QuickBooks, we store the connection tokens and configuration needed to keep it working, plus the readings and command history from those devices.

3.11 All of it in one table

The same information as above, in one place: what we hold, why we hold it, and which outside companies see it. The provider names are explained in section 5.

Category of information	Examples	Why we use it	Who receives it
Account identity	Your name (if you share it), email address, Firebase account ID	Signing you in, tying your records to you, verifying a deletion request	Google / Firebase; Apple or Google as your sign-in provider
Your own lawn records	Properties, application logs, schedules, soil tests, tank mixes, inventory, garage maintenance, growing-degree-day sessions	Providing the features you asked for	Google / Firebase
Your business's customer records	Customer name, service address, phone, email, consent status and its source, service plan and price, property size and grass type, access and property notes	Scheduling work, building routes, quoting, invoicing, collecting payment, messaging	Google / Firebase; Stripe, Telnyx, Resend and Intuit only for the specific customer being billed, texted, emailed or synced
Card authorization status	Whether a card is set up, the brand, last four digits, expiry month and year	Showing you whether a customer can be charged	Stripe holds the actual card; we never see or store the number
Property and job photos	Yard, access, problem, before and after photos	Documenting the property and the work	Google / Firebase Storage. Hidden metadata is stripped before upload
Crew location during a visit	Latitude, longitude, accuracy, heading, speed, timestamp	Letting the office follow route progress while a visit is in work	Google / Firebase. Deleted when the visit is completed
Property coordinates and device location	Saved property coordinates; your device location if you allow it	Weather, growing-degree-day tracking, maps, address search, route planning, watering	Open-Meteo, Visual Crossing, NOAA MADIS, OpenStreetMap Nominatim, Apple Maps / Google Maps — a location only, never your name
Pesticide and fertilizer application records	Applicator and certification number, product, EPA registration number, rate, area, times, re-entry interval, weather	Keeping the records state law requires an applicator to keep	Google / Firebase
Messaging records	Message history; and in our send ledger, a provider message ID, organization and customer IDs, and a SHA-256 hash of the recipient's number	Sending the messages consented to, and routing a later opt-out to the right customer	Telnyx for delivery; Supabase for the ledger. The ledger never holds the raw number or the message text
Push notification registration	Device push token, a device identifier, your account ID if signed in, which properties you want alerts for	Delivering the alerts you turned on	Google / Firebase; Supabase
Crash and diagnostic data	App version, device model, platform, active screen, crash traces	Fixing crashes	Google / Firebase Crashlytics. Not tagged with your account ID
Purchase and subscription status	Purchase state, entitlement, an app user ID	Unlocking what you paid for	Apple, Google Play, RevenueCat
Connected-device credentials and readings	Connection tokens, configuration, sensor readings, command history	Keeping an irrigation controller, sensor or QuickBooks link working	Only the provider you linked — see section 5.5

4. What we deliberately do not collect

This is worth being explicit about, because it is a real design decision in the code rather than a promise.

• We never store credit or debit card numbers. The app stores only whether a card is authorized (not-set-up, setup-pending, ready, requires-action, expired, or revoked), the card brand, the last four digits, and the expiration month and year — the same details printed on a receipt. Actual card data lives with Stripe. The mobile app never handles card numbers and can never mark an invoice paid; that is server-owned. (Verified: CustomerCardOnFileStatus in src/business/customerPayments.ts; the comment on preferredPaymentMethod in src/business/domain.ts — "Provider credentials remain in a separate server-owned payment profile and never enter this model"; supabase/functions/business-billing/index.ts is the only code that talks to api.stripe.com.)
• We do not store the text or phone number of an automated text message in our analytics database. The send ledger stores only IDs and a SHA-256 hash of the recipient number, specifically so it cannot be browsed as a directory of phone numbers. (Verified: supabase/migrations/20260807120000_business_sms_rate_limit_and_send_ledger.sql.)
• We do not put Social Security numbers, bank details, or tax documents in the business profile. The one registration field is for a public contractor-license, registration, or tax-permit number. (Verified: comment on businessRegistrationNumber in src/business/backend/types.ts.)
• Community pest reports are anonymous. Firebase user IDs on those reports were replaced with salted installation hashes. (Verified: note in supabase/functions/_shared/accountDeletion.ts referencing migration 20260713011000.)

5. Who receives your data

Every company below was confirmed by reading the code that calls it. We do not sell personal information, and we do not share it for cross-context behavioral advertising at all.

5.1 Core infrastructure

Provider	What it does	What it receives
Google / Firebase	Sign-in, database, file storage, crash reporting, push delivery	Account identity, all synced records, uploaded photos, crash diagnostics, push tokens
Supabase	Serverless functions and Postgres database	Push registrations, referral records, irrigation automation records, messaging rate-limit and send-ledger rows, account-deletion audit rows

(Verified: @react-native-firebase/* packages in package.json; firestore.googleapis.com, storage.googleapis.com, fcm.googleapis.com, securetoken.google.com, oauth2.googleapis.com in the edge functions; supabase/ directory throughout.)

5.2 Communications and money

Provider	What it does	What it receives
Telnyx	Sends automated text messages	The recipient's phone number and the message body
Resend	Sends automated invoice emails	The recipient's email address and the message content
Stripe	Card payments, hosted checkout, saved cards	The customer's name and email, an internal customer ID, and the payment amount. Card details go to Stripe directly, not through us
Intuit / QuickBooks	Optional accounting sync	Customer display name, email address, phone number, and billing address, plus invoice and payment records
RevenueCat	Subscription entitlement management	Purchase status, and an app user ID (the organization ID for business entitlements)
Apple / Google Play	Subscription billing	Purchase and billing information under their own policies

(Verified: supabase/functions/_shared/telnyxSms.ts → api.telnyx.com/v2/messages; supabase/functions/_shared/resendEmail.ts → api.resend.com/emails, sending from notifications@notify.lawndominators.com; supabase/functions/business-billing/index.ts → api.stripe.com; supabase/functions/_shared/quickBooksCustomerTransportPolicy.ts maps DisplayName, PrimaryEmailAddr, PrimaryPhone, BillAddr; src/config/purchases.ts and react-native-purchases.)

5.3 Advertising

No advertising or ad-tracking provider receives anything from this app.

(Verified: react-native-google-mobile-ads, react-native-fbsdk-next, and react-native-tracking-transparency are absent from package.json; AppDelegate.mm contains no Facebook SDK initialization; PrivacyInfo.xcprivacy declares NSPrivacyTracking=false with no tracking domains.)

5.4 Weather, mapping, and address lookup

Open-Meteo, Visual Crossing, NOAA MADIS, OpenStreetMap Nominatim (address search), and Apple Maps / Google Maps (map display and directions). These receive a location — usually a property's coordinates or a typed address — but not your name or contact details. (Verified: api.open-meteo.com, weather.visualcrossing.com, madis-data.ncep.noaa.gov, nominatim.openstreetmap.org, maps.apple.com, react-native-maps.)

5.5 Optional connected devices

Only if you link them: Rachio, Hunter Hydrawise, Netro, WeatherFlow Tempest, Ambient Weather, Ecowitt, Wyze, and LinkTap. These receive the commands and credentials needed to run your irrigation or read your sensors. (Verified: api.rach.io, cloud-rest.rach.io, app.hydrawise.com, api.netrohome.com, swd.weatherflow.com, api.ambientweather.net, api.ecowitt.net, wyze-lockwood-service.wyzecam.com, www.link-tap.com.)

5.6 Other disclosures

We may disclose information when the law requires it, to protect our rights or someone's safety, or to a buyer in a merger or sale of the business.

6. Why we use your data

• To provide the features you asked for.
• To schedule work, build routes, generate quotes and invoices, and collect payment.
• To send the service messages you or your customers consented to.
• To keep pesticide and fertilizer application records the law requires operators to keep.
• To detect abuse and enforce rate limits.
• To fix crashes and improve the app.
• To bill for subscriptions.
• To show ads in the free tier, subject to your consent choices.

7. How long we keep things

Data	Retention
Your account and synced records	Until you delete them or delete your account
Crew location during a visit	Deleted the moment the visit is completed
Pesticide / fertilizer application records	Set per organization; the app defaults to 7 years and computes an expiry date from the date of service
Business customer records, quotes, invoices	For as long as the business keeps its account. These are the operator's business records, and some are required to be kept by state pesticide rules and by tax law
Messaging send ledger	Kept indefinitely, and deliberately so. Each row holds a provider message ID, the organization and customer it belonged to, and a SHA-256 hash of the recipient's number — never the number itself and never the message text. It is kept because an opt-out reply can arrive years after the last message and still has to be matched to the right customer record. There is no automatic purge, and the database grants our server permission to add and read these rows but not to delete them
Messaging rate-limit records	The per-send records our abuse limiter keeps are deleted automatically after 7 days. They hold only hashed identifiers — no phone number, no message text
Crash reports	Per Firebase Crashlytics' own retention schedule

Application-record retention is deliberately configurable because states differ — Tennessee requires two years from the date of use, Washington requires seven — and the app defaults to the longest common requirement so a misconfigured organization over-retains rather than under-retains. (Verified: retentionExpiresAt and DEFAULT_RETENTION_YEARS = 7 in src/business/applicationRecord.ts, with the state citations in that file's header comment.)

8. Security

These are the specific measures in place, not a general assurance.

Getting in

• All traffic to our services uses HTTPS.
• Sign-in is handled by Apple and Google. We never see or store a password.
• Account deletion requires you to have signed in recently, comes from an allow-listed origin, and is rate-limited to three attempts per fifteen minutes.
• Deleting a whole company's data additionally requires that no other member is still active, that you type the company name exactly, and that you return a single-use confirmation that expires after 15 minutes.

Who can read what

• Firestore security rules restrict every record to the account or organization that owns it, and are enforced by the database itself rather than by the app.
• Photo storage is deny-by-default. The only writable path is under organizations/{organization id}/, uploads are checked against the uploader's active membership and role, and a file must declare matching organization, uploader, record and media identifiers to be accepted at all.
• Data held by Google Firebase and Supabase is encrypted at rest by those providers.

Limiting what a mistake can cost

• The mobile app can never mark an invoice paid and never handles a card number; both are server-owned.
• The text-message send ledger stores a SHA-256 hash of the recipient's number instead of the number, so it cannot be browsed as a directory of customers.
• Automated texting is rate-limited per organization, and the limiter fails closed — if it cannot be reached, the message is not sent.
• Inbound text-message webhooks from Telnyx are verified with an Ed25519 signature; unsigned requests are rejected with a 403.
• Uploaded photos are stripped of metadata and structurally verified before upload; a photo that fails verification is not uploaded.
• Connected-device credentials are held in the device keychain or in protected server storage.
• Account deletion is all-or-nothing: if any step fails, the sign-in is kept and you are asked to retry, so data is never orphaned behind a deleted login.

No system is perfectly secure. We cannot guarantee that a determined attacker will never succeed, and we do not want you to read this section as a promise that one never will.

9. Your choices

• Permissions. Turn location, camera, photo, and notification permissions on or off in your device settings at any time.
• Connected services. Disconnect any linked irrigation, sensor, or QuickBooks account from within the app.
• Text messages. Reply STOP to any automated text. See our SMS Terms at https://lawndominators.com/business/sms-terms.
• Subscriptions. Manage or cancel in the App Store or Google Play. Deleting the app or your account does not cancel a subscription.

10. Deleting your account and data

There are two different deletions, because deleting your login and deleting your company's books are not the same act and do not have the same consequences. Both are available in the app under More → Delete your data (crew members see More → Delete your account). Account deletion is also available at https://lawndominators.com/delete-account.

10.1 Deleting your account (your login)

Here is exactly what that does, based on the code:

1. You must re-authenticate with Apple or Google. The request is rejected if your sign-in is not recent.
2. Every workspace membership you hold is revoked. Your team-member record in each company workspace is stripped of your name and email address and marked removed, and your personal workspace index (users/{your id}/businessOrganizations/...) is deleted. Your user ID remains attached to work you recorded — an invoice or a pesticide application record still shows who filed it — because those records must stay attributable. Nothing that identifies you personally stays with it.
3. Your entire private Firestore subtree (users/{your id}/...) is deleted, covering all nineteen synced record types listed in section 3.2.
4. Your rows are deleted from our Supabase database: irrigation automation controllers, zones, sensors, policies, commands, observations, evaluations, approvals and incidents; push device registrations and pending push jobs; referral codes, referrals, referral rewards, referral purchase events, and referral audit events; and automation audit events.
5. Referral rewards that a friend earned are detached rather than deleted, so we do not destroy someone else's record.
6. Your Apple sign-in token is revoked, your Firebase Auth user is deleted, your push token is removed, and the app wipes its local data on the device.
7. We write one audit row recording that the deletion happened, containing your former user ID, the platform it came from, and how many rows were removed.
8. If any step fails, the account is not deleted and you are told to retry — we never delete the sign-in while data is still reachable, because that would orphan it permanently.

One case is refused outright. If you are the owner of a company workspace that still has other active members, deleting your account is blocked and nothing is destroyed. Your workspace's owner is fixed at creation and cannot be reassigned automatically, so if your login vanished, your teammates would keep access to customer and payment data with nobody able to administer it, invite, remove, or close the workspace. Remove your remaining team members (or contact us to transfer ownership) and then delete your account.

(Verified: supabase/functions/delete-account/index.ts, supabase/functions/_shared/accountDeletion.ts, supabase/functions/_shared/firestorePurge.ts, src/services/accountDeletion.ts, __tests__/accountDeletionService.test.ts, __tests__/accountDeletionPurgePlan.test.ts.)

10.2 Deleting all of a company's data

Deleting your account does not delete your company's records, and we will not do that silently. Those are business records: other members read and write them, invoices are tax records, and pesticide/fertilizer application records carry a state retention duty (section 7).

A company owner can delete them deliberately, in the app under More → Delete your data → Delete all company data. That flow:

1. Requires a recent sign-in, and requires that no other member of the workspace is still active. Remove your team first — that way nobody loses their workplace records without knowing.
2. Shows you a server-computed count of exactly how many records of each kind will be destroyed, and how many will be kept, before anything happens.
3. Requires you to type the company's name exactly, and to send back the short-lived confirmation issued with those counts, so the numbers you agreed to cannot be stale. The confirmation expires after 15 minutes and is single-use.
4. Then permanently deletes every customer, property, quote, visit, crew record, message, message template, inventory record, expense, invoice, payment record, QuickBooks link, audit event, membership record, and every photo stored for that company in Firebase Storage (objects under organizations/{organization id}/).

What survives, and why. Pesticide and fertilizer application records still inside their retention period (section 7 — 7 years by default) are kept, along with a minimal record of the company name so they remain traceable to the business that performed the work. That is what a state inspector may require you to produce. Everything else about the company — contact details, address, logo, billing configuration, and all other records — is removed, and the retained application records are removed automatically once their retention period ends. Application records whose retention period has already ended are deleted with everything else. A record with no usable application date is kept rather than guessed at, because the safe failure mode for a legal record is to keep it.

If you would rather not do this yourself, email support@lawndominators.com.

(Verified: supabase/functions/business-organization-deletion/index.ts, supabase/functions/_shared/businessOrganizationDeletion.ts, src/business/backend/businessOrganizationDeletion.ts, src/business/screens/DeleteAccountSheet.tsx, __tests__/businessOrganizationDeletion.test.ts, supabase/functions/business-organization-deletion/index.test.ts.)

What deletion still does not do

We have to be honest about this rather than imply a clean sweep:

• The text-message send ledger is retained. It maps a provider message ID to an organization and customer so that an opt-out arriving years later can still be routed to the right record. Recipient numbers are stored only as a SHA-256 hash, and the message text is never stored there at all. The database grants our server permission to add and read these rows but not to delete them, so this ledger survives both kinds of deletion. (Verified: supabase/migrations/20260807120000_business_sms_rate_limit_and_send_ledger.sql.)
• Photos are tied to the company, not to your login. Every photo this app uploads is stored under organizations/{organization id}/, and there is no path in which a photo is filed under an individual user. Those objects are deleted by company deletion (section 10.2). Deleting your personal account on its own does not remove them, because they are the company's records rather than yours. (Verified: storage.rules — the single writable Storage path is organizations/{organizationId}/{recordType}/{recordId}/{fileName}; every other path is denied.)

11. Rights of homeowners served by a business using this app

If a lawn-care company put your details into this app, that company is responsible for them. We process that information only on their instructions and we do not use it for our own purposes, do not sell it, and do not use it for advertising.

To access, correct, or delete your information, contact the lawn-care company that services your property. If you cannot reach them, email support@lawndominators.com and we will pass the request on, but the company — not us — decides the outcome.

12. Your privacy rights, and how to use them

If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon, or another state with a comprehensive privacy law, you have the rights listed below. We extend the same rights to everyone who uses the app, wherever you live, because operating two standards is how mistakes happen.

12.1 What you can ask for

Right	What it means
Know	Ask what categories of information we hold about you, where it came from, why we have it, and who receives it. Section 3.11 answers most of this already
Access	Get a copy of the personal information we hold about you
Correct	Have inaccurate information fixed
Delete	Have your information deleted. Section 10 describes the in-app path and states plainly what deletion keeps and why
Opt out	Opt out of targeted advertising, of any activity a state law treats as a "sale" or "sharing," and of profiling that produces legal or similarly significant effects. Nothing to opt out of: we do not sell, share, advertise, or profile
No retaliation	Use any of these rights without being charged more, given a worse service, or having your account penalized

12.2 How to make a request, and how long we take

• The fastest route is in the app. Deletion is under More → Delete your data (crew members see More → Delete your account), and is also at https://lawndominators.com/delete-account.
• For anything else, email support@lawndominators.com. Put "privacy request" in the subject line and tell us what you want.
• We verify you first. We confirm your identity through your signed-in account before we act, because handing someone else's customer list to the wrong person is the failure that matters most here. In-app deletion additionally requires a recent sign-in.
• We respond within 45 days. If a request is genuinely complex we may take one further 45-day extension, and we will tell you before the first 45 days are up, why, and when to expect an answer.
• You may appeal. If we refuse a request, we will tell you why in writing. Reply to that email, or write to support@lawndominators.com with "privacy appeal" in the subject, and a different decision-maker will review it and respond within 45 days. If we deny the appeal, we will tell you how to complain to your state attorney general.
• An authorized agent may make a request for you. We will ask for proof that you authorized them, and we will still verify your identity.

12.3 Specific commitments

• We never sell personal information, and we never sell or share business customer records, phone numbers, or text-message consent with anyone for marketing. We do not use any of it to build profiles or to make automated decisions about you.
• No advertising, so nothing to opt out of. This app shows no ads, contains no advertising or tracking software, and collects no advertising identifier. Nothing here is "sharing" under any state privacy law, so there is no "Do Not Sell or Share My Personal Information" link to provide and no tracking-permission prompt to decline.
• Sensitive information. We do not ask for or want Social Security numbers, bank account numbers, government ID numbers, health information, or precise background location, and the Terms of Service forbid putting them in the app.
• Children. The Business Suite is a tool for running a lawn-care business. It is not directed to children, it is not marketed to them, and using it requires membership in a company workspace and an account holder who is at least 18 (Terms of Service, section 1). We do not knowingly collect information from anyone under 13. If you believe a child has given us information, email support@lawndominators.com and we will delete it.
• Oklahoma. We are an Oklahoma company. The Oklahoma Consumer Data Privacy Act (Senate Bill 546, signed March 20, 2026) takes effect on January 1, 2027. It applies to companies above volume thresholds we are well below, so it does not compel us today. We have written the rights, timelines, and appeal process in this section to meet it anyway, and we will honor them for Oklahoma residents whether or not the Act reaches us.

13. Where data is processed

We are a United States company, and the Business Suite is built for lawn-care businesses operating in the United States.

Our Firebase data — the Firestore database that holds your records and the Cloud Storage bucket that holds uploaded photos — is stored in Google's us-central1 region in the United States. Our other providers process data in the United States and, in some cases, in other countries where they operate, under their own policies; the weather and address-lookup services listed in section 5.4 include providers based outside the United States, and they receive a location rather than your name or contact details.

We do not offer or market the Business Suite in the European Economic Area or the United Kingdom, and we have no EEA or UK users. This policy therefore does not include the additional GDPR and UK GDPR terms — a lawful-basis table, international-transfer safeguards, a data protection officer — that an EEA or UK audience would require. If that ever changes, this policy changes with it before the first such user is signed up.

If you use the app from outside the United States anyway, your information will be transferred to and processed in the United States, where privacy laws may differ from the ones where you live.

14. Changes to this policy

If we change this policy in a way that materially affects you, we will update the effective date and notify you in the app. Continuing to use the app after a change means you accept the updated policy.

15. Contact

Lawn Dominators LLC, an Oklahoma limited liability company.

Email support@lawndominators.com for anything in this policy — a privacy request, a question about what we hold, or a correction. Email is how we take privacy requests, and it is the fastest route to a person; we will verify your identity through your signed-in account before we act on one.

Our Business Suite pages, including the current version of this policy, are at https://lawndominators.com/business.