Customer Privacy Policy

Table of Contents

1. Introduction
2. Information We Collect
3. How We Use Your Information
4. How We Share Your Information
5. Texas Data Privacy and Security Act (TDPSA) Rights
6. Sensitive Data
7. Data Security
8. Data Breach Notification
9. SMS Communications
10. Biometric Data
11. Children's Privacy
12. Data Retention
13. Third-Party Links and Services
14. Changes to This Policy
15. Contact Information

1. Introduction

Houston's Own Lawn App, LLC ("HOLA," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the HOLA platform as a Customer. HOLA operates a digital marketplace connecting property owners with independent landscaping contractors in Houston, Texas.

We are committed to protecting your personal information in compliance with the Texas Data Privacy and Security Act (TDPSA, Tex. Bus. & Com. Code Ch. 541), the Telephone Consumer Protection Act (TCPA), and other applicable laws.

2. Information We Collect

2.1 Information You Provide

When you create an account or use our services, you may provide:

• Full name
• Phone number (used for account authentication)
• Email address (optional)
• Property address(es)
• Service preferences and scheduling
• Profile photo (optional)
• Photos you capture in the app (such as issue-report photos), which may include precise GPS location metadata recorded by your device at the moment of capture
• Payment information (processed by Stripe — HOLA does not store card numbers)
• Gate codes for gated communities (encrypted at rest)
• Communications with Contractors through the platform

2.2 Information Collected Automatically

When you use the HOLA platform, we automatically collect certain technical information:

• Device information (type, operating system, browser)
• IP address
• Approximate location (derived from IP address)
• App usage data (pages visited, features used)
• Crash reports and performance data

2.3 Information from Third Parties

• Payment transaction data from our payment processor
• Authentication data from our authentication provider
• Address validation data from mapping services
• Translation data from third-party translation services used for in-app messaging

2.4 Information from Service Activity

• Service-related photos and videos captured by Contractors or the platform before, during, and after services (see our Media Consent & Release for details on how service media is used)
• Timestamps, GPS data, and location records associated with service activity
• Dispute and support records, including in-app tickets and mediation communications

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain platform services
• Process payments via Stripe Connect Standard
• Authenticate your identity using the login methods available on the platform
• Facilitate communication with Contractors
• Send transactional notifications (booking confirmations, job updates)
• Improve platform functionality and user experience
• Comply with legal obligations (including Texas Tax Code § 151.0242 marketplace facilitator requirements)
• Detect and prevent fraud
• Respond to your inquiries and support requests
• Resolve disputes, review re-service requests, and support in-app ticket mediation

4. How We Share Your Information

We do not sell your personal information. We share information only as follows:

4.1 With Contractors

When you book a service, we share your name, property address, service requirements, and gate code (if provided) with the assigned Contractor. This sharing is necessary to perform the service you requested.

4.2 Service Providers

• Stripe, Inc. — payment processing. Stripe may collect personal data about you, including through cookies and similar technologies, to provide its payment services, prevent fraud, and improve its services. Stripe's collection and use of your data is governed by Stripe's Privacy Policy.
• SMS and authentication providers — SMS delivery and account authentication
• Mapping providers — address validation and mapping
• Translation providers — In-app messages between you and Contractors may be processed by third-party AI and machine translation services to provide real-time translation. Message content sent for translation may include personal information exchanged in the conversation.
• Analytics providers (Plausible) — privacy-first analytics; no cookies, no personal data collected

4.3 Legal Requirements

We may disclose information to comply with applicable law, legal process, or government request.

4.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4.5 With Your Consent

We may share your information with third parties when you explicitly authorize such sharing.

Important: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5. Texas Data Privacy and Security Act (TDPSA) Rights

Under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541), Texas residents have the following rights regarding their personal data:

5.1 Right to Know

You may request confirmation of whether we process your personal data and access that data.

5.2 Right to Correct

You may request correction of inaccurate personal data we hold about you.

5.3 Right to Delete

You may request deletion of your personal data. We will respond within 45 days of receipt of your request (extendable to 90 days with notice). You may also delete your account at any time from within the app — see our Delete Your Account page for step-by-step instructions.

Even after deletion, we may retain a limited, de-identified subset of records (such as booking and payment history and dispute records) for as long as reasonably necessary for tax and legal compliance, fraud prevention, ban enforcement, and the security of our platform and users. These retained records are stripped of the identifiers that link them to you.

5.4 Right to Data Portability

You may request a copy of your personal data in a portable, readily usable format.

5.5 Right to Opt Out

You may opt out of:

• The sale of personal data — we do not sell your personal data
• Targeted advertising
• Profiling that produces legal or similarly significant effects

5.6 Non-Discrimination

We will not discriminate against you for exercising your TDPSA rights. Exercising your rights will not affect the quality or availability of services we provide to you.

5.7 How to Exercise Your Rights

To exercise any of the rights described above, contact us at privacy@gethola.com. We may verify your identity before processing your request.

5.8 Appeal

If we deny your request, you may appeal our decision by contacting us at privacy@gethola.com. If your appeal is denied, you may file a complaint with the Texas Attorney General at texasattorneygeneral.gov.

6. Sensitive Data

Under the TDPSA, certain categories of data are considered "sensitive" and require your consent before processing:

• Precise geolocation data: We collect your property address for service delivery, and we do not continuously track your real-time location in the background. When you choose to capture a photo within the app (for example, to document a lawn issue), that photo may include precise GPS location metadata embedded by your device at the moment the photo is taken. This precise location is collected only when you actively take a photo, is used to associate the photo with the correct service location, and is subject to your device's location permission, which you may grant or revoke at any time in your device settings.

We do not collect the following categories of sensitive data:

• Racial or ethnic origin data
• Religious beliefs
• Health or medical data
• Biometric identifiers
• Sexual orientation data
• Citizenship or immigration status
• Children's data (persons under 13)
• Genetic data

7. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information per Texas Business and Commerce Code § 521.052. Our security practices include:

• Payment data is handled exclusively by Stripe (PCI DSS Level 1 certified) — HOLA never stores credit card numbers.
• Gate codes are encrypted at rest using industry-standard encryption.
• Authentication is handled by our authentication provider — HOLA does not store plaintext credentials.
• App data cached locally on your device is encrypted at rest using industry-standard encryption.

While we take reasonable measures to protect your information, no security system is impenetrable. We cannot guarantee the absolute security of your personal information.

8. Data Breach Notification

In the event of a data breach involving your personal information, HOLA will:

• Notify affected individuals within 60 days of discovery, per Texas Business and Commerce Code § 521.053
• Notify the Texas Attorney General within 30 days if 250 or more Texas residents are affected
• Provide details about the breach, the types of information involved, and steps you can take to protect yourself

9. SMS Communications

9.1 Transactional Messages

By creating an account, you consent to receive transactional SMS messages including booking confirmations, job status updates, and one-time verification codes. These messages are necessary for platform operation. Standard messaging rates may apply. Consent to receive transactional messages is not a condition of purchasing any goods or services.

9.2 Marketing Messages

We will not send marketing or promotional SMS messages without obtaining your separate, express written consent per the TCPA (47 U.S.C. § 227) and Texas Business and Commerce Code Chapter 305.

9.3 Opt-Out

You may opt out of transactional SMS messages at any time by replying STOP to any message or contacting us at privacy@gethola.com. We will honor opt-out requests within 10 business days per FCC rules effective April 11, 2025. Note that opting out of transactional messages may affect your ability to use certain platform features.

9.4 Message Frequency

Transactional message frequency varies based on your activity on the platform. We do not send more messages than necessary for platform operation.

10. Biometric Data

HOLA does not collect biometric identifiers as defined by the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001). We do not use facial recognition, fingerprint scanning, retina or iris scanning, voiceprint analysis, or hand or face geometry in our platform. Profile photos uploaded by users are not processed using biometric technology. Any identity verification required for payment processing is handled by Stripe, not HOLA.

11. Children's Privacy

The HOLA platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. You must be at least 18 years old to create an account and use our services.

If we learn that we have inadvertently collected information from a child under 13, we will promptly delete it. If you believe we have collected information from a child under 13, please contact us at privacy@gethola.com.

12. Data Retention

We retain your personal information for the following periods:

• Account data: Retained while your account is active. Upon account deletion, your identifying account data is promptly rendered unreadable or removed; a limited de-identified subset may be retained (at least 30 days, and longer where needed) for fraud prevention, ban enforcement, platform security, and legal compliance
• Transaction records: Retained for at least 7 years for tax and legal compliance
• Communications: Retained for at least 2 years after the last interaction
• Service records, dispute evidence, and support records: Retained for as long as reasonably necessary to operate the platform, resolve disputes, prevent fraud, comply with legal obligations, and enforce our agreements
• OTP/authentication logs: Retained for at least 90 days
• Analytics data: Aggregated and anonymized — no personal data retained
• Gate codes: Deleted within a reasonable period after property removal from your account

Upon account deletion, we will render your personal data unreadable or otherwise destroy it per Texas Business and Commerce Code § 521.052. Certain data may be retained longer where required by law, or — in a de-identified form that no longer identifies you — for fraud prevention, ban enforcement, and the security of our platform and users.

13. Third-Party Links and Services

The HOLA platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties, and this Privacy Policy does not apply to their services. We encourage you to review the privacy policies of any third-party services you access through our platform.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on the platform with a new "Last Updated" date. For significant changes, we may also provide additional notice such as an in-app notification.

Your continued use of the HOLA platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Houston's Own Lawn App, LLC

Privacy Inquiries: privacy@gethola.com

Legal Inquiries: legal@gethola.com

Katy, Texas 77450

For TDPSA-related requests or complaints, you may also contact the Texas Attorney General at texasattorneygeneral.gov.