Legal and trust
Privacy Policy
This Policy explains how Trough handles personal information when people visit the public site, create or use a business workspace, submit a contractor lead form, review or sign a proposal, or contact support.
Contractors control the homeowner and workforce data they place in Trough. Homeowners and contractor staff should usually contact that contractor first; Trough will assist with verified requests when required.
1. Who is responsible for data
Trough is responsible for account, billing, website, support, security, and service-usage information it collects for its own operations. For customer, homeowner, employee, applicant, and subcontractor information submitted by a contractor workspace, the contractor generally determines why and how the information is used and Trough processes it to provide the Service.
2. Information we collect
- Account and workspace information: name, email, company, role, authentication identifiers, invitations, settings, and legal acceptance records.
- Homeowner and job information: names, email addresses, phone numbers, property and service addresses, notes, appointments, surveys, measurements, drawings, estimates, proposals, signatures, photos, messages, and job status.
- Commercial information: plan, invoices, payment status, Stripe identifiers, deposits and recorded payments. Trough is designed not to store raw payment-card numbers.
- Workforce information: team roles, assignments, schedules, compensation configurations, payroll records, and activity logs entered by the contractor.
- Device and usage information: IP address, user-agent, page path, referring source, timestamps, feature actions, error and performance data, security events, and session or local-storage state.
- Support and communications: messages, attachments, call or email details, troubleshooting information, and feedback.
3. Sources
- Directly from account holders, contractor staff, homeowners, and people submitting forms.
- From contractors that import or enter their customer and workforce information.
- Automatically from browsers, devices, security systems, and service logs.
- From service providers and integrations such as Clerk, Stripe, Resend, Google Maps, property-data tools, and monitoring providers when enabled.
4. How we use information
- Provide, authenticate, personalize, support, and improve the Service.
- Create and maintain contractor workflows, proposals, signatures, communications, schedules, and payment records.
- Process subscriptions and facilitate contractor payment links through Stripe.
- Send requested, transactional, operational, security, and permitted marketing communications.
- Detect abuse, enforce tenant and role boundaries, investigate incidents, keep audit evidence, and protect users and the Service.
- Measure public-site use and product reliability without selling personal information or using it for cross-context behavioral advertising.
- Comply with law, enforce agreements, resolve disputes, and protect rights and safety.
5. When information is disclosed
Trough does not sell personal information for money and does not share it for cross-context behavioral advertising. If that practice changes, this Policy and any required opt-out mechanisms will be updated before the change.
- To authorized users in the applicable contractor workspace according to roles and job visibility.
- To service providers listed on the Subprocessors page for hosting, storage, authentication, payment, email, maps, monitoring, and other enabled functions.
- To a contractor's chosen integrations or recipients at the contractor's direction.
- To professional advisers, insurers, auditors, or transaction counterparties under appropriate confidentiality duties.
- To authorities or others when reasonably necessary to comply with law, protect safety or rights, investigate fraud, or respond to valid legal process.
- As part of a merger, financing, acquisition, reorganization, or sale, subject to appropriate safeguards.
7. Communications choices
Trough and contractor customers may send confirmations and operational messages connected to an account, quote request, appointment, proposal, payment, or job. Optional automated follow-up or marketing email requires the choice presented on the relevant form and can be stopped through an unsubscribe link or by contacting the contractor or support@trough.app. Security, legal, billing, and essential service notices may still be sent where permitted.
SMS delivery is not currently an active Trough sending feature. Before it is enabled, Trough will require appropriate opt-in language, opt-out handling, sender identification, and provider disclosures.
8. Retention and deletion
Trough keeps information only as long as reasonably needed for the purposes described here, the contractor's instructions, security and audit evidence, dispute and payment records, backup cycles, and legal obligations. Retention varies by record type and workspace status.
After cancellation, Trough intends to provide at least a 30-day opportunity to request an export unless the account must be suspended immediately for security or legal reasons. Deletion from active systems and expiration from provider backups may occur on different schedules. Customers should request export or deletion at support@trough.app; Trough will verify authority before acting.
9. Security
Trough uses tenant scoping, role-based access, audit logging, rate limits, security headers, managed secret storage, encrypted provider transport, and Stripe-hosted card collection as described in the Security Overview. No service can guarantee absolute security. Report suspected incidents to support@trough.app without sending sensitive credentials.
10. Privacy rights and requests
Depending on location and applicable law, a person may have rights to know, access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent; or appeal a denied request. Trough will not discriminate for exercising an applicable right.
Send requests to support@trough.app. Identify the relevant workspace and account or job relationship. Trough may verify identity and authority and may direct a request to the contractor that controls the record. Authorized agents must provide proof of authority. Some information may be retained or withheld where law permits, including security, audit, contractual, and legal records.
11. US state notice
For residents of states with comprehensive privacy laws, the categories collected and purposes are described in Sections 2–4, disclosures in Section 5, and retention in Section 8. Trough does not sell personal information or share it for cross-context behavioral advertising. Trough does not use sensitive personal information to infer characteristics. These statements apply where the relevant law covers Trough or a contractor customer.
12. Children
Trough is a business service and is not directed to children under 13. Accounts are limited to adults. If you believe a child supplied personal information directly to Trough, contact support@trough.app.
13. Processing location
Trough is operated for the United States. Information may be processed in the United States and other locations where disclosed providers operate. Customers should not use Trough for international personal data transfers until the required contractual and transfer safeguards have been reviewed for that use.
14. Changes and contact
Trough may update this Policy as the product, providers, or law changes. Material changes will be announced through the Service or account email when appropriate. Questions and requests may be sent to support@trough.app.