Privacy Policy

This Privacy Policy explains how Ollify LLC ("Ollify," "we," "us," or "our") collects, uses, stores, and shares information when you use our platform at ollify.app and all related Ollify services (collectively, the "Service"). It also explains your rights and how to exercise them.

This policy applies to all users of the Ollify platform, including business account holders ("tenants") and any individuals whose data tenants process through the Service. If you use Ollify on behalf of a business, this policy applies to your use on behalf of that business.

Questions? Contact us any time at privacy@ollify.app.

What We Do Not Collect — Read This First

Before we describe what we do collect, here is what we do not collect. We think this matters and we want to be upfront about it.

1. Information We Collect

1.1 Information You Provide Directly. When you create an account, use the Service, or contact us, you may provide:

• Account information — your name, email address, phone number, and password when you register.

• Business information — your company name, business address, and other details about your organization when you set up your tenant account.

• Customer Data — any data you enter into the platform as part of running your business, such as job records, client information, project and job site information, schedules, forms, documents, and files. Construction industry customers may store job site data, subcontractor records, equipment information, safety documentation, and client contracts as Customer Data. You control this data; we process it only to provide you the Service. You are responsible for complying with any industry-specific data retention requirements applicable to your business, including OSHA recordkeeping requirements and contract retention obligations.

• Communications — messages you send us through support channels or feedback forms. We keep support communications to help resolve issues and improve the Service.

• Olli conversations and requests — the text you type into Olli, our built-in AI assistant, and earlier messages in the same conversation. Unless your administrator has turned Olli's data features off, this also includes your Olli conversations saved in your workspace and the changes you ask Olli to make. See Section 13.

• Payment information — your billing address and payment method details when you subscribe. Your full card number is processed and stored by Stripe, Inc. and is never transmitted to or stored on Ollify's servers.

• Business communications — business-line voicemail via our phone system, once selected; call recordings, where used, are handled by a separate third-party service, not by Ollify directly.

1.2 Information We Collect Automatically. When you use the Service, we automatically collect certain technical and usage information:

• Usage data — how you interact with the Service, including features used, pages viewed, actions taken, search terms, and session duration. We use this to understand how the Service is used and where we can improve.

• Olli usage records — a record of each Olli request, including who made it, when, how large the exchange was, how many tools Olli used and which area of Ollify it worked in, and, for each change you confirm, which tool made it and which record was changed. These records never include the words. See Section 13.

• Olli page context — when you ask Olli about the page you are viewing, a general label for the page (for example, "Job page"). When Olli's data features are on, on a record page it also receives the record's name and ID, unless that record is excluded from Olli. See Section 13.

• Device and technical information — your browser type and version, operating system, IP address, device identifiers, and general location derived from your IP address.

• Cookies and similar technologies — see Section 6 for a full description of the cookies we use and your choices.

• Location data — if you use mapping or routing features powered by Mapbox, we collect location data as necessary to provide those features. In the web platform, address fields may also ask your browser to share your device's location so that address suggestions are ranked for where you are. This happens only if you allow it in your browser, and Ollify does not store it. See Sections 1.3, 2, and 3.1 for how this data is used and shared.

1.3 Information from Third-Party Services. We receive limited information from third-party services we integrate with:

• Mapbox — when you use mapping and routing features, location queries are processed by Mapbox and we receive geocoding results (e.g., a formatted address or coordinates). We do not receive Mapbox user data unrelated to your requests.

• Stripe — when you make payments, Stripe processes your payment and we receive confirmation of the transaction, the last four digits of your card, and billing address. We do not receive your full card number.

2. How We Use Your Information

We use the information we collect for specific, limited purposes. Here is exactly what we use your information for:

3. How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances, or with your explicit, informed consent for any other purpose:

3.1 Service Providers and Subprocessors. We share information with third-party companies that help us operate the Service ("subprocessors"). Our commercial providers are contractually required to process data only on our instructions and in accordance with our Data Processing Agreement. Our current subprocessors include:

• Stripe — payment processing and subscription billing. We send Stripe your business name, owner name, billing email and phone, billing address, account identifier, and plan and seat details. Stripe collects and processes your payment method details directly and is independently regulated as a payment processor. Stripe does not receive the jobs, customers, schedules, files, forms, and documents you keep in the Service.

• Mapbox — mapping, routing, and geocoding features.

• AWS End User Messaging (Amazon Web Services) — text message delivery when messaging features are used.

• Expo (Expo, Inc.) — mobile application build and delivery, and push notifications.

• Amazon Web Services (AWS) — cloud infrastructure, hosting, and data storage.

• Anthropic, PBC — AI language-model processing for the Olli assistant (see Section 13). Anthropic processes the text you type into Olli, earlier messages in the same conversation, the page you are on (on a record page, the record's name and its ID) and the date. Unless your administrator has turned Olli's data features off, Anthropic also processes your business name and hours, the names, field labels and help text of the record types and workflows you have set up (other than any your administrator excluded), role names, which add-ons you have or could add, your name and role, instructions your administrator has given Olli, and the workspace records Olli looks up for you, such as jobs, customers and other contacts (including phone numbers, email addresses, addresses and notes), schedule items, tasks, forms, documents (including the names of people who signed) and files you are permitted to see, and, for add-ons your business holds, related records such as glass parts orders, vehicles and routes. Data in categories and workflows your administrator has excluded is not sent. Olli is told only the labels of excluded categories (for example "financial and billing data") and how many workflows are excluded, not their names or fields. When Olli proposes a change, Anthropic processes the proposed change. Your content is not used to train Anthropic's models. Anthropic's own subprocessors are listed at anthropic.com/subprocessors.

• Other subprocessors as listed at ollify.app/legal/subprocessors.

3.2 Legal Compliance. We may disclose information when we believe in good faith that disclosure is required to:

1. (a)

   comply with applicable law, regulation, court order, or government request;

2. (b)

   enforce our Terms of Service;

3. (c)

   protect the rights, property, or safety of Ollify, our users, or others; or

4. (d)

   respond to lawful requests from public authorities.

Where permitted by law, we will notify you before disclosing your information in response to legal process.

3.3 Business Transfers. If Ollify is involved in a merger, acquisition, asset sale, or other corporate transaction, your information may be transferred as part of that transaction. We will provide notice by updating this Privacy Policy and, where feasible, by sending you an email or in-app notification before your information is transferred and becomes subject to a different privacy policy.

3.4 Aggregated and De-Identified Data. We may share aggregated or de-identified data that cannot reasonably be used to identify you or your business. For example, we may publish aggregate statistics about platform usage. This data is not personal information and is not subject to this Privacy Policy.

4. Subprocessors

A current and complete list of our subprocessors is available at ollify.app/legal/subprocessors. We update this list when we add or change subprocessors.

We will provide at least thirty (30) days' advance notice of any new subprocessor that may materially affect the processing of your data. Notice will be provided by:

1. updating the subprocessor list at ollify.app/legal/subprocessors; and

2. sending an email notification to account holders.

Customers who have accepted our Data Processing Agreement have additional rights with respect to new subprocessors, including the right to object. See your DPA for details.

5. Data Retention

We retain data only for as long as necessary to provide the Service and comply with our legal obligations. Here is how we approach retention for different types of data:

When data reaches the end of its retention period, we securely delete it from our systems. We may keep aggregated or de-identified usage statistics that cannot be linked back to you.

6. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service. A full description of the specific cookies we use is available in our Cookie Policy at ollify.app/legal/cookie-policy.

6.1 Types of Cookies We Use.

• Strictly Necessary Cookies — These cookies are required for the Service to function. They enable authentication, session management, and security features. You cannot opt out of strictly necessary cookies without disabling the Service.

• Functional Cookies — These cookies remember your preferences (such as your interface theme and map display settings) to improve your experience. Functional cookies are enabled by default but you may disable them in your browser settings or, on our marketing site, through the cookie preferences panel.

• Local Storage — Olli, our AI assistant, saves your recent help conversation (up to the most recent 40 messages) in your browser's local storage, or in the mobile app's storage on your device, so it is there when you return. You can clear it by starting a new conversation, turning Olli off, or signing out, or by clearing your browser data.

6.2 Your Cookie Controls. You can control cookies through your browser settings. Most browsers allow you to:

1. (a)

   view what cookies are set;

2. (b)

   delete existing cookies; and

3. (c)

   block new cookies.

Note that blocking strictly necessary cookies will prevent you from logging in and using the Service. Refer to your browser's help documentation for instructions on managing cookies.

7. Your Rights and Choices

You have rights over your personal data. We honor these rights for all users, regardless of where you live in the United States — not just for users in states with specific privacy laws.

7.1 Rights Available to All Users.

• Right to Know — You can ask us what personal information we hold about you and how we use it.

• Right to Access and Export — You may request a copy of your personal information at any time by emailing privacy@ollify.app. We will verify your identity before fulfilling the request and provide your data in a structured, machine-readable format, in compliance with California Consumer Privacy Act portability requirements.

• Right to Delete — You may request deletion of your account and personal information by emailing privacy@ollify.app, subject to certain exceptions. Upon a confirmed and verified deletion request, we remove your personal information from active systems promptly, and remaining copies then cycle out of backup and archive systems in accordance with our data retention schedules. Certain records are exempt from deletion: messaging opt-out records (retained permanently so opt-outs are never forgotten), billing records required for tax purposes, and information subject to a legal hold or other legal retention requirement.

• Right to Correct — You can correct inaccurate personal information directly in the platform (Settings > Account) or by contacting us at privacy@ollify.app.

• Right to Opt Out of Marketing Emails — Every marketing email includes an unsubscribe link. You can also opt out in Settings > Notifications. Opting out of marketing does not affect transactional emails, which are required for the Service.

7.2 California Residents. If you are a California resident, your rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA") are described in full in our California Privacy Notice, available at ollify.app/legal/california-privacy-notice.

7.3 Other State Privacy Laws. Users in states with enacted comprehensive privacy laws — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Indiana (INCDPA), Tennessee (TIPA), Delaware, Nebraska, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Rhode Island, and other states with enacted or pending privacy legislation — generally have rights similar to those described in Sections 7.1 and 7.2, including rights to know, access, delete, correct, and opt out of certain data uses. We honor these rights for all users regardless of state. If your state has specific opt-out mechanisms, appeal rights, or other rights that differ from those described above, please contact us at privacy@ollify.app and we will assist you.

7.4 How to Exercise Your Rights. You may exercise any of the rights described in this Section by:

• Email — Send a request to privacy@ollify.app from the email address associated with your account.

We will respond to verifiable requests within forty-five (45) days. If we need more time (up to an additional 45 days), we will notify you within the initial 45-day period. We may need to verify your identity before fulfilling a request. We will not require you to create an account to submit a request, but we may need to verify your identity to protect against unauthorized requests.

If you are a tenant's customer (i.e., a person whose data is processed through the Service by an Ollify business customer), please contact that business directly. Ollify processes that data on the business's behalf and cannot fulfill individual rights requests without the business's authorization.

7.5 Do Not Track Signals. As required by the California Online Privacy Protection Act (CalOPPA), we disclose how we respond to "Do Not Track" (DNT) browser signals: because we do not currently use analytics or advertising cookies of any kind, our data practices do not change based on whether your browser sends a DNT signal — we treat all visitors the same way regardless. If we introduce analytics or advertising technology in the future, we will evaluate and disclose our DNT response at that time. See our Cookie Policy at ollify.app/legal/cookie-policy for more detail on cookies and tracking technologies specifically.

8. Children's Privacy

The Service is designed for and marketed exclusively to businesses, and its users must be at least 18 years old. We do not knowingly collect, use, or share personal information from individuals under the age of 13. If you believe a child under 13 has provided personal information to Ollify, please contact us immediately at privacy@ollify.app and we will promptly delete that information. The Service is not intended to be used by or to process data about children. Separately, under the California Consumer Privacy Act, we do not sell or share (as California law defines those terms) the personal information of anyone, including consumers under 16 years of age.

9. Security

We take the security of your data seriously and implement industry-standard technical and organizational measures designed to protect it from unauthorized access, disclosure, alteration, and loss. Our security practices include:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).

• Encryption at rest — Customer Data stored on our servers is encrypted at rest using AES-256 or equivalent industry-standard encryption.

• Authentication controls — we support strong password requirements, sign-in rate limiting with a CAPTCHA step-up after repeated failed attempts, and server-side session revocation. Multi-factor authentication for customer accounts is not available as of this policy's Effective Date. We may introduce MFA for customer accounts in a future release.

• Access controls — access to Customer Data is restricted to authorized personnel on a need-to-know basis. Ollify employees and contractors may access Customer Data only as necessary to provide support, maintain the Service, or comply with legal obligations.

• AI access controls — Olli can look up or change only what the person asking is already permitted to see or change, every change Olli proposes requires that person's confirmation before it is made, and confirmed changes are recorded in the audit log.

• Incident response — we maintain a security incident response process and will notify affected users in accordance with applicable law and Section 15 of this Policy.

Our current security practices are described in more detail in our Security Documentation, available at ollify.app/legal/information-security-policy.

10. International Users

The Service is intended for use within the United States. Our servers and infrastructure are located in the United States. If you access the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. Messages you send to Olli are subject to the location note in Section 13.1.

By using the Service from outside the United States, you consent to the transfer and processing of your information in the United States in accordance with this Privacy Policy.

11. Text Messaging Features and Data Processing

The Service includes text messaging (SMS/MMS) functionality that Customers may use to communicate with their own clients, drivers, contractors, or other contacts ("Text Messaging Features"). This section explains how Text Messaging Features affect your data and the data of individuals you message. Text Messaging Features are being enabled following launch; until then, this section describes how they will work once available.

11.1 What Data Is Processed. When Text Messaging Features are used, we process:

1. (a)

   the phone numbers of message recipients;

2. (b)

   the content of text messages sent and received;

3. (c)

   delivery, read, and reply status; and

4. (d)

   opt-in and opt-out ("STOP") status for each recipient.

This data is processed through AWS End User Messaging (Amazon Web Services), our subprocessor for text message delivery, as identified in our Subprocessor List.

11.2 Consent and Opt-Out. Federal law (the Telephone Consumer Protection Act, or "TCPA") and applicable state law require prior express consent before sending text messages to an individual. Customer is solely responsible for obtaining and documenting the required consent from each message recipient before using Text Messaging Features to contact them, and for honoring any opt-out request (including replies of "STOP," "UNSUBSCRIBE," or similar). The Service automatically processes "STOP" replies and suppresses further messages to that number, but this is a safeguard only and does not relieve Customer of its own compliance obligations, which are further described in the Acceptable Use Policy.

11.3 Retention. Text message content and delivery logs are processed and retained by AWS End User Messaging (Amazon Web Services) on Ollify's behalf, in accordance with our data retention practices described in Section 5 of this Privacy Policy and Section 9 of our Data Processing Agreement.

11.4 Message and Data Rates. Standard message and data rates from the recipient's mobile carrier may apply to text messages sent through the Service. Ollify is not responsible for carrier charges incurred by message recipients.

12. Mobile Application Privacy

If you access the Service through a mobile application, the following additional privacy disclosures apply. The Ollify mobile application is being made available following launch; until then, this section describes how it will work once available.

12.1 Push Notifications. We may send push notifications to your mobile device for the following purposes:

1. (a)

   transactional alerts — job updates, form submissions, document activity, and account security events;

2. (b)

   operational reminders — scheduling reminders and dispatch notifications; and

3. (c)

   optional marketing notifications — product updates and feature announcements, sent only with your consent.

You can manage push notification preferences at any time through:

1. (a)

   your device's operating system notification settings (iOS: Settings → Notifications → Ollify; Android: Settings → Apps → Ollify → Notifications); or

2. (b)

   in-app settings under Settings → Notifications.

Disabling push notifications will not affect your ability to use the Service, but you may miss time-sensitive job or account alerts.

12.2 Third-Party Services Used in Mobile. Our mobile application may use the following third-party services for notification delivery and mobile infrastructure:

• Firebase Cloud Messaging (FCM) / Apple Push Notification Service (APNs) — used to deliver push notifications to Android and iOS devices respectively. These services receive device tokens necessary to route notifications to your device.

• Additional third-party mobile SDKs will be disclosed in this section as they are added. We will provide at least 30 days' notice before adding any new third-party service that accesses mobile device data.

12.3 Mobile-Specific Data. When you use our mobile application, we may collect device identifiers (for example, device model and operating system version) for compatibility and security purposes. The app does not currently include crash reporting or usage analytics tooling. The app does not request or read your device's location. Its map and routing features instead use location data saved in your account (addresses and coordinates), which Mapbox processes as described in Sections 1.3, 2, and 3.1. If we add crash reporting, analytics, or device-location features, we will update this Policy first.

13. The Olli Assistant

Ollify includes Olli, a built-in AI assistant. Olli answers questions about how to use Ollify. Olli can also answer questions about your workspace by looking up records the user is permitted to see, unless your administrator has turned that off, and propose changes that take effect only when the user confirms them, within a monthly allowance. Olli is labeled as AI in the Service. This Section explains what Olli processes and how that information is handled. A shorter plain-language description is available at ollify.app/legal/olli-explainer.

13.1 What Olli Processes. When you send Olli a message, the following are processed by our AI subprocessor, Anthropic, PBC, to generate an answer:

1. (a)

   the text you type and earlier messages in the same conversation;

2. (b)

   Ollify's own published help guides that are available to you; and

3. (c)

   a general label for the page you are on (for example, "Job page") and today's date.

Unless your administrator has turned Olli's data features off, Olli also receives: (4) the page you are on (on a record page, the record's name and its ID); (5) your business name and hours, the names, field labels and help text of the workflows and record types you have set up (other than any your administrator excluded), role names, and which add-ons you have or could add; (6) your name and role, and a summary of what your role lets you access; (7) instructions your administrator has given Olli, if any; and (8) the workspace records Olli looks up to answer you, such as jobs, customers and other contacts (including phone numbers, email addresses, addresses and notes), schedule items, tasks, forms, documents (including the names of people who signed) and files, and records from add-ons your business holds, but only records you are permitted to see and your business has not excluded. Olli looks up records only as needed to answer a request, and it never receives another business's data. If you type personal or customer information into a question, that text is processed as well. Please do not type sensitive personal, health, or payment information into Olli. Ollify has enforced US-only routing for its account with Anthropic, and the models Olli uses support it, so Olli requests are intended to be processed in the United States. Anthropic, not Ollify, runs this processing, so we cannot guarantee that no request is ever processed outside the United States. If we learn that this has changed, we will tell you through our Subprocessor List.

13.2 Your Agreement and Controls. Olli asks for your agreement before your first message is sent, and asks again if how Olli works changes in a way that affects what is shared. You can turn Olli off at any time in your Profile. Olli's data and action features are on for your workspace unless your administrator turns them off. Your administrator can turn them off for your whole business and can exclude categories of data (billing and financial data starts excluded) or individual workflows from Olli. Olli is told only the labels of excluded categories and how many workflows are excluded. On paid plans, your administrator can also turn them on or off for individual roles and people and set limits for them. Olli's activity-log lookups (management users only) are not filtered by exclusions and show record IDs and who changed what, not content. Turning those features off does not turn off help answers. Turning Olli off stops Olli from sending your questions to our AI provider and deletes Olli conversations saved on your device.

13.3 What We and Our Provider Keep. We do not store the content of your Olli help conversations on our servers. A copy of your recent help conversation (up to the most recent 40 messages) stays on your device until you start a new conversation, turn Olli off, or sign out. On a phone, the saved copy can be included in the phone's own backups. When you ask Olli about your workspace, we store the conversation (your messages, Olli's answers, the changes Olli proposed, and the information Olli looked up, whose lookup details are blanked after 30 days; Olli's own answers and proposals stay until the conversation is erased) in your workspace, in your own account. Only you can see it; your workspace administrators cannot read it. On a written request from your business's account owner for legal, security or compliance reasons, or where the law requires it, we may provide copies of data conversations to your business. You can delete it at any time. A deleted conversation is moved to Trash, where your administrators see only that it was deleted, by whom and when, not its title or content, and can restore it or delete it permanently. It is permanently erased after your business's recovery period (30 days unless your business sets a different period; the nightly clean-up can take a few extra days), and backups expire 35 days after that. A conversation you have not touched in 18 months moves to Trash automatically (pinned conversations are exempt). We may keep conversations longer where the law requires it, for example under a legal hold. We keep a record that a question was asked or a change was confirmed, including who asked, when, how large the exchange was, and which record was changed, but not the words, and a change you confirm through Olli appears in your business's activity log as your own change, with a separate entry showing it was made through Olli; these records are kept in our audit logs for the period stated in Section 5, and workspace administrators with access to the audit log can see them, along with the IP address and device details recorded with them. We also keep a record of your agreement to use Olli, including the version you accepted, in the same audit logs. Under its current policy, Anthropic deletes the content it receives from its systems within thirty (30) days of receipt or generation, unless it must retain it longer for safety or legal reasons.

13.4 No AI Training. We do not use your Olli questions or your Customer Data to train AI models. Under our agreement with Anthropic, content submitted through the service may not be used to train Anthropic's models.

13.5 Accuracy and Limits. Olli can be wrong. Its help answers are only as current as Ollify's help guides, and its answers about your workspace are only as good as the records it can see. Olli does not make decisions about you, your account, or your customers. Olli cannot change anything in your account unless a user confirms the specific change, and it never sends an email, text, or message to anyone. Olli does not answer questions about Ollify's own pricing, billing, plan, refunds, credits, cancellation or legal terms, whether you ask it for help or about your workspace. It cannot make billing changes, and it never says whether a refund, credit or cancellation is possible. It tells you it can't help with that and points you to support at support@ollify.app and to the Billing page. Olli answers questions about your own business figures in Ollify, such as a part price, as it would any other information.

13.6 Your Rights. We do not store help conversations, so you can clear the copy on your device at any time. You can delete your own data conversations from your conversation history at any time. Your workspace administrators cannot read them. Information in Olli conversations and in the records Olli looks up is Customer Data: your business is the controller and Ollify is its processor, so to use a privacy right about it, contact your business (see Section 7.4), or email privacy@ollify.app and we will pass your request on. To exercise your other privacy rights, see Section 7.

13.7 Future Olli Features. Olli features that speak or listen by voice are not active. Before any such feature is activated, we will update this Policy and give notice consistent with Section 4.

14. Email Communications

We send different types of email and each is handled differently:

In compliance with the CAN-SPAM Act, every marketing email we send includes:

1. a clear identification that it is from Ollify;

2. our physical mailing address: Ollify LLC, 901 N State St. STE N, Jackson, MS 39202; and

3. a clear and easy unsubscribe mechanism that we honor within ten (10) business days.

15. Data Breach Notification

In the event of a security incident that results in unauthorized access to or disclosure of your personal information, we will notify you in accordance with applicable law. Our notification practices by jurisdiction:

Our breach notification will include, to the extent known at the time of notification:

1. a description of the nature of the breach;

2. the categories of personal information involved;

3. what we are doing to address the breach; and

4. steps you can take to protect yourself.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Post the updated Privacy Policy at ollify.app/legal/privacy with a new "Last Updated" date;

• Send an email notice to the email address associated with your account at least thirty (30) days before the change takes effect; and

• Display an in-app notification about the update.

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated policy, you must stop using the Service before the effective date of the change.

For minor or non-material changes (such as correcting a typo, clarifying existing language, or updating contact information), we may update the policy without advance notice.

17. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

QUICK REFERENCE — YOUR DATA AT A GLANCE

This table summarizes key data practices described in this Privacy Policy.