Legal · Privacy

Privacy Policy

What DropclothOS collects when you ask for a consultation call or use the product, why we have it, who we share it with, and how to get it deleted.

Last updated October 19, 2026

Short version: we collect the name and mobile number you type into the setup form so a human can call and text you about setting up an account. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Reply STOP to any text to stop the texts; email us to have your record deleted.

1. Scope

This policy covers this website and the DropclothOS application. It applies to visitors, to people who request a consultation call, and to account holders (“you”). Where we process information about your customers on your behalf, you are the controller and we are the processor / service provider, and the customer agreement governs that processing rather than this policy.

2. What we collect

Identifiers you give usName and mobile phone number submitted through the setup form; business name, email and address if you open an account.

Consent recordThe exact disclosure text shown to you, a timestamp, your IP address and your browser user agent — kept so we can prove your call/text consent was given.

Commercial dataFor account holders: jobs, quotes, invoices, and the amounts collected through the product.

Payment dataHandled by our payments partner. We receive confirmations, amounts, card brand and last four digits. We never receive or store full card numbers.

Technical dataServer logs (IP, request path, timestamp, user agent) and error diagnostics, used for security, abuse prevention and debugging.

Sensitive informationWe do not ask for government IDs, health, biometric, precise-geolocation or financial-account credentials through this website.

We do not knowingly collect information from anyone under 16. This site is a business tool and is not directed at children.

3. Why we have it

To answer your request and call or text you about setting up an account (your consent).
To provide, secure and support the product you signed up for (performance of contract).
To prevent spam, fraud and abuse of our forms and payment rails (legitimate interests).
To keep records the law requires us to keep, including proof of messaging consent (legal obligation).

We do not use your information to train advertising profiles, and we do not run third-party advertising trackers on this site. We use Google Analytics for site measurement only (see Cookies and tracking below).

4. Calls and texts

When you submit the setup form we store the disclosure you agreed to, verbatim. As of this version it reads:

By continuing you agree to the DropclothOS Terms of Service and Privacy Policy, and you agree that DropclothOS may call and send recurring text messages to the mobile number you provided about setting up your account, including messages sent using an automatic telephone dialing system. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.

Consent to marketing calls or texts is never a condition of buying anything. See the SMS Terms for frequency, opt-out and carrier details.

4a. Cookies and tracking

We use Google Analytics (provided by Google LLC) to measure how visitors use the site: pages viewed, approximate location (country/city, IP addresses are truncated), device and browser, how you arrived, and whether a call was booked. Google Analytics sets first-party cookies (such as _ga) that last up to 2 years. We use it for measurement only: Google signals, ad personalization and advertising cookies are off, and we load no advertising pixels. Other browser storage is strictly necessary: keeping staff signed in and remembering your cookie choice.

Google Analytics, and any advertising tool we add in future, does not run for visitors in the EU, EEA, UK or Switzerland unless you accept it, and they will not run anywhere for a browser sending a Global Privacy Control or Do Not Track signal. We keep a record of each choice (what you chose, when, and which version of this notice you saw) so we can prove it, and a withdrawal is saved as a refusal, not deleted. You can change or withdraw your choice at any time from “Cookie settings” in the footer; the change applies immediately in every open tab.

Payments partnerProcesses card payments, payouts and disputes, and performs identity/bank verification for account holders under its own privacy policy.

Messaging and email providersDeliver the texts and emails you asked for.

Hosting and infrastructureRuns the site and stores the database, under contract and instructed not to use the data for their own purposes.

Analytics providerGoogle LLC receives site-usage data through Google Analytics to give us aggregate measurement reports, where your consent and privacy signals allow it. You can also opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout.

Professional advisersCounsel and accountants, where needed and confidentially.

Legal processWhen we are legally required to, or to protect rights and safety. We do not hand over data on a casual request.

Business transferIf the business is acquired, your data may transfer with it, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined by U.S. state privacy laws.

6. How long we keep it

Setup-call requests that never become accounts: while the enquiry is open, plus 24 months, then deleted.
Messaging consent and opt-out records: at least 5 years after the last message, because that is the exposure window for a messaging claim.
Account and transaction records: for the life of the account plus the period tax and accounting rules require.
Server logs: 90 days, except records retained for an active security or abuse investigation.

7. Your rights

Depending on where you live, you can ask us to confirm what we hold about you, give you a copy, correct it, delete it, or limit how we use it, and you can appeal a refusal. You will not be treated differently for asking. We answer within 30 days for EU/UK requests (GDPR) and within 45 days for U.S. state-law requests (CCPA/CPRA), and may take one extension where the law allows.

How to ask

Email services@painteros.co with the phone number or email you used, and say what you want done. We verify requests by matching the number or email on file; we do not require you to create an account to make one. An authorized agent may act for you with written permission.

We do not use automated decision-making that produces legal effects about you. We do not sell or share your information in the statutory sense, and we treat a Global Privacy Control signal as a valid opt-out of sale, sharing and targeted advertising. When we delete a record we erase your name, number and notes, and keep only an anonymized record of the consent you gave and when, which the law lets us retain as proof.

8. Security

Data is encrypted in transit, form submissions are signed and rate-limited, payment card data is tokenized by our PCI DSS-certified payments partner and never reaches our systems, and access to production data is limited to people who need it. No system is perfectly secure, and we do not claim otherwise; if a breach affects you we will notify you as the law requires.

9. Where data is processed

We operate in the United States and our providers may process data there. If you contact us from outside the U.S., you are asking us to process your information in the U.S., where privacy law differs from your own.

10. Changes

We will update the date at the top of this page when it changes, and we will tell you before a change materially reduces your rights. DropclothOS, LLC is the party responsible for the processing described here.

Who you are contracting with

DropclothOS, LLC, organized in Delaware.

services@painteros.co