Privacy Policy

This Privacy Policy explains how DumpsterVibes LLC (“we,” “us,” “our”), handles information in connection with the DumpsterVibes websites, booking pages, dashboards, and driver app (the “Platform”). It applies to the independent companies that use our software (“Companies”) and to the customers who book those companies (“Customers”).

Our two roles. For our own account, billing, and website data, we are the business that decides how information is used (a “controller”). For the Customer information a Company collects to run its jobs, we act as a service provider / processor on that Company's behalf — the Company is responsible for that data, and this Policy describes how we handle it for them.

Information you provide:

• • Companies: business name, contact details, address, EIN/state registration, logo, pricing, service area, and login credentials.
• • Customers: name, phone, email, service address, booking details, job notes, and photos related to a job.
• • Messages you send through the Platform (support, inbox replies, suggestions).

Customer lists a Company imports: a Company may upload a customer list it already keeps (name, address, phone, email, and similar contact details) to move its book onto the Platform. The Company is responsible for that data and for its right to import and use it; we store and process it on the Company's behalf as its service provider. See our Terms of Service (Section 12).

Information collected automatically: device and browser type, IP address, pages viewed, and similar log/usage data, plus approximate or GPS location when a driver enables live tracking during an active job. On a front-load or curbside route, the driver app records the route the truck drives while the driver has route mode on (from Start route until End route, clock-out, sign-out or the end of that day), in the background only if the driver allows it, so the Company's office can replay the route. A driver's job photos may record where they were taken; the Company keeps that location as proof of service, and the copies shown to Customers on status pages and invoices have it removed.

Payment information is collected and processed directly by Stripe (see Section 5). We do not receive or store full card or bank numbers.

From third parties: address/geocoding results from Google Maps, and status information from Stripe, Twilio, and Postmark about payments and message/email delivery.

• • Provide, operate, secure, and improve the Platform.
• • Take bookings, process payments, and send transactional messages (confirmations, reminders, ETAs, receipts).
• • Enable dispatch, routing, mileage, live tracking, and billing.
• • Prevent fraud and abuse, including detecting duplicate or restarted accounts, and enforce our Terms.
• • Provide support and respond to requests.
• • Comply with law, tax, and accounting obligations.

We do not sell personal information, and we do not use it for third-party advertising.

If you hold a DumpsterVibes account (a company owner or team member), DumpsterVibes LLC texts you only if you opted in, through the DumpsterVibes Account Alerts program: sign-in and verification codes, alerts for your company, account notices, and support replies. We record when you agreed, the wording you agreed to and the number. Message frequency varies; message and data rates may apply; reply STOP to opt out or HELP for help. Carriers are not liable for delayed or undelivered messages.

When you book, you consent to receive text messages about your order — booking confirmations, delivery and pickup updates, driver ETA, and payment. Message frequency varies with your order's activity. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Opting out never affects your ability to book — we'll reach you by phone or email instead.

The company you booked with is the sender of your service texts; they are delivered using DumpsterVibes software and each message names that company. Service texts cover your order — confirmation, scheduling, delivery, pickup, servicing, driver or crew ETA, payment links, and receipts. There is a single messaging consent box at checkout, and it also covers the occasional review request, mid-rental check-in, and rental-extension reminder about that order — there is no separate marketing sign-up, and replying STOP ends all of them.

Mobile information, telephone numbers, message content, and messaging-consent records are not sold, and are not disclosed to third parties or affiliates for their own marketing or promotional purposes. They may be disclosed to our messaging provider, telecommunications carriers, campaign registries, and other service providers solely as necessary to register messaging services, transmit messages, maintain delivery and opt-out records, prevent abuse, provide support, and comply with law.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service and order fulfillment, is permitted. All other use-case categories exclude text messaging originator opt-in data and consent; text messaging opt-in data and consent will not be shared with any third parties.

All payments are processed by Stripe. Card and bank details go directly to Stripe and never touch our servers — we store only a secure reference token, the card's brand/type, and whether it's a prepaid card (for fraud prevention). Stripe's handling of that data is governed by stripe.com/privacy.

We use only the cookies needed to keep you signed in, keep the Platform secure, and remember basic preferences (for example, the company you last booked). We do not use third-party advertising or cross-site tracking cookies. You can control cookies in your browser, though some features may not work without them.

Online booking visits. When you use a Company's online booking page, we record the pages and booking steps you reach, how long each takes, whether you book, the page that sent you there, your device and browser type, and your IP address with its approximate location. We use this to prevent fraud and to improve booking, and the Company you are booking with can see it. We do not record what you type beyond what your booking itself stores, and never card details. The full IP address is kept 90 days and then shortened. A visit that did not become a booking is deleted after 6 months. A visit that became a booking stays with that booking, and its IP address and device detail are removed after 13 months. If your browser sends Global Privacy Control or Do Not Track, we record only the booking steps, with no IP address, device detail or referring page.

• • With the Company you book — so it can perform and bill your job.
• • With service providers (subprocessors) who run parts of the Platform, listed below, each only for its function.
• • For legal reasons — to comply with law, respond to lawful requests, or protect rights, safety, and against fraud.
• • In a business transfer — if the business is merged, acquired, or sold, with continued protection under this Policy.

We do not share your data with other Companies on the Platform, and we do not sell it.

• • Stripe — payments and payouts (privacy)
• • Intuit (QuickBooks Online) — accounting sync, for Companies that connect it (privacy)
• • Supabase — database and file storage (encrypted, US-hosted)
• • Twilio — text messaging
• • Postmark — email receipts and notifications
• • Google Maps — addresses, routing, and the live-tracking map
• • Apple Maps — receives a delivery or pickup address when a driver taps Navigate and has chosen Apple Maps on their phone
• • Waze — receives a delivery or pickup address when a driver taps Navigate and has chosen Waze on their phone
• • Hostinger — server hosting (US region) and the mailboxes for our own email addresses; mail you send to a DumpsterVibes address passes through them before it reaches us
• • Cloudflare — website delivery, security filtering and DNS; every visit to the Platform, including your IP address, passes through them
• • Cloudflare (R2) — encrypted off-site backup storage of database and uploaded files
• • Anthropic (Claude) — AI features that may process support messages and generate content. It also receives a daily summary request containing the results of our own automated health checks — operational text about the Platform itself, with no customer data in it.
• • Expo — delivery of push notifications to the driver and customer apps (receives the device push token)
• • Apple and Google — Expo hands each push notification to Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android), which deliver it to the phone
• • GitHub — hosts our source code and runs the automated steps that test, build and deploy the Platform; customer records are not stored there
• • Route optimisation — runs on our own servers, not a third party. Pickup and delivery addresses are used to order a driver's day and are not sent outside our systems.

Each processes only what its job requires, under its own privacy terms.

We keep information for as long as needed to provide the Platform and meet legal, tax, and accounting requirements. Job photos are automatically deleted 120 days after the job ends (the default; a Company may set a longer window, or keep them indefinitely, but not a shorter one — 120 days is the minimum we allow, because that is the card-dispute window the photo is evidence in). Branding assets a Company uploads are not on that clock. A route's recorded driving path is deleted 90 days after it was recorded. Booking, invoice, and payment records are retained longer for accounting and dispute purposes. Signed customer agreements are kept for a minimum of three years.

Text-messaging consent records. We keep the evidence of a mobile number's current messaging status — opted in, or stopped — for as long as that status applies, because it is what tells us whether we may text that number at all and is what we would have to produce if a complaint were made. Superseded history for a number (an older opt-in that a later choice replaced) is deleted after five years. We never delete the record of the choice that is currently in force, however old it is: deleting it would leave us asserting a consent, or a STOP, with nothing behind it.

When a Company leaves. After the notice and export window described in our Terms, we delete that Company's operational and customer data from the Platform. What we keep after that is our own business, contract, and compliance record — our accounting for the period the Company traded, its acceptance of our Terms and pricing, our security and audit trail, the messaging consent evidence described above, our own support correspondence with that Company, any product suggestions it sent us, the record of when its public listing was published or withdrawn, and the record of each outside connection we disconnected when it left — each for its own applicable period and then deleted. We do not retain a departed Company's working data for our own purposes.

Deletion is not instantaneous everywhere. We keep off-site encrypted backups of stored files. A file deleted from the live system is removed from those backups on a rolling window of roughly 120 further days, so worst-case removal from all systems takes longer than removal from the Platform itself. A Company can export its data at any time, and its records are not deleted out from under it if it cancels.

We use encryption in transit, access controls, tenant isolation so one company cannot see another's data, and reputable infrastructure providers. Sign-in follows NIST SP 800-63B password guidance: passwords do not expire on a schedule, a change is required only when a password was issued temporarily or may have been exposed, and every account signs in with a second factor (an authenticator app, or a one-time code by text or email). No system is perfectly secure, but we work to protect your information and to limit what we collect to what the job requires.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain uses. To make a request, email support@dumpstervibes.com — a person handles it, and we may need to verify your identity. If your data was collected by a Company using the Platform, we'll help route your request to that Company as needed.

What an erasure keeps. When a Customer's details are erased, their name, email, phone number, addresses and notes are removed from the customer record. Two things are kept as legal proof, each for the period in section 9: the name typed to sign a Company's terms, kept with that signed agreement, and the mobile number in our record of texting consent or STOP. Booking and payment records are kept for accounting and deleted three years after the erasure.

California (CCPA/CPRA): we do not sell or “share” personal information as those terms are defined, and we do not use sensitive information for purposes requiring an opt-out. California residents may exercise access and deletion rights as above without discrimination.

You can opt out of texts by replying STOP. We do not send marketing email — the email we send is transactional: confirmations, reminders and receipts for a job you booked, and account email to the company you work for. If we ever start sending marketing email, every one will carry a one-click unsubscribe link and this section will say so before the first one goes out.

The Platform is for adults running or hiring a business service. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a child provided us information, contact us and we will delete it.

A Company may connect its own Google Business Profile, or its own Facebook or Instagram account, to the Platform. We use each connection only for the Company that made it, and only for what it asks: to publish posts it writes or approves, to show it its own reviews and post the replies it approves, and to show it its own Google performance figures. We keep the sign-in tokens, the location or page ids it chose, the ids of the posts we published, and a saved copy of those figures. We never sell this data, never use it for advertising, and never share it with another Company.

DumpsterVibes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A Company can disconnect an account at any time from its Growth page, which deletes the stored token at once; the tokens and post history we kept are removed within 30 days. See Data deletion for every way to ask.

We may update this Policy; we'll change the effective date and version above and, for material changes, provide reasonable notice. For a company using the Platform, that notice is a banner across the top of its dashboard naming the new version, the date it took effectand what changed, shown for 30 days from that date. This Policy works alongside our Terms of Service.

Questions or requests? Email support@dumpstervibes.com or write to DumpsterVibes LLC, 722 Stokes Store Rd, Forsyth, GA 31029. A real person answers, because a real person runs this.