Privacy Policy

1. Introduction

This Privacy Policy explains how Jeremy Kidder ("we," "us," or "our") collects, uses, stores, and protects information through the MyWork platform ("Platform"), including the admin dashboard (mwadmin.makeitnice.world), owner portal (login.mywork.makeitnice.world), and public website (mywork.makeitnice.world).

MyWork is a multi-tenant SaaS platform. This means we handle two categories of data:

• Platform Data: Information we collect directly from Subscribers (business operators) and their team members to provide the Service.
• Subscriber Data: Information that Subscribers enter into the Platform about their own customers, contacts, and business operations. We process this data on behalf of our Subscribers.

By using the Platform, you consent to the practices described in this Privacy Policy. If you are a customer of one of our Subscribers (e.g., you use the owner portal), you should also consult that Subscriber's own privacy policy regarding how they handle your information.

2. Information We Collect

2a. From Subscribers and Team Members (Platform Data)

2b. From Subscriber's Customers (Subscriber Data)

Subscribers may enter and store information about their customers in the Platform, including:

• Names, email addresses, phone numbers, and physical addresses
• Project/job details, scheduling information, and service history
• Trade classifications, scope descriptions, cost breakdowns, and work codes
• Job event timelines, status transitions, and quality/satisfaction scores
• Documents, images, and files shared through the owner portal
• Messages exchanged through the Platform's messaging system
• Invoices, estimates, and payment records

We process Subscriber Data solely on behalf of and under the instructions of the Subscriber. The Subscriber is the data controller for their customer data; we are the data processor. See our Data Processing Agreement for details.

2c. Automatically Collected Information

• Session data: IP address, browser type, device type, operating system, and session timestamps.
• Session fingerprint: A hash of your user agent string and IP address subnet, used to detect session hijacking. This is not used for tracking across sessions.
• Website and portal analytics: Pages visited, scroll depth, click interactions, page load times, navigation patterns, browser timezone, and language preferences — collected across all pages and portals via our own first-party analytics system (no third-party trackers). You can opt out at any time via our self-exclusion page.
• Approximate location: IP-based geolocation (city/region/country) via ip-api.com, used for analytics across all platform pages.

3. How We Use Information

Platform Data (Subscriber/Team Member Info)

• Provide, operate, and maintain the Service
• Authenticate users and manage account security
• Process billing and subscription changes
• Enforce plan limits and usage quotas
• Provide customer support
• Send transactional emails (account verification, password resets, billing notifications)
• Improve the Platform based on usage patterns
• Comply with legal obligations

Subscriber Data (Their Customers' Info)

• Store and display data as directed by the Subscriber
• Enable owner portal access and messaging
• Facilitate document sharing between Subscribers and their customers
• Generate reports and analytics for the Subscriber

We do not use Subscriber Data for our own marketing, analytics, or any purpose other than providing the Service to the Subscriber.

4. Cookies and Session Technologies

We use a minimal number of first-party cookies and browser storage. We do not use third-party advertising or tracking cookies. For full details, see our Cookie Notice.

Cookie Consent Banner

On your first visit to either the admin panel or the public site, we show a small banner at the bottom of the screen with three choices: Accept all, Necessary only, or Customize. The choice is stored in the mw_consent cookie above so the banner doesn't show again. You can change your choice anytime by clicking Cookie Preferences in the footer of any page, or opening the preference panel right now. We do not fire analytics until you've made a choice and selected analytics on. The admin panel and public site maintain separate consent decisions (different subdomains = different services).

5. Third-Party Services

We share data with the following third-party service providers, solely for the purposes described:

We do not sell, rent, or trade personal information to third parties. We do not use Google Analytics, Facebook Pixel, or similar third-party analytics services.

Integrity Proof Chain

The Platform maintains an Integrity Ledger that creates tamper-evident records of critical business transactions (documents, payments, signatures, scheduling, communications). This system stores only cryptographic hashes (SHA-256) on external anchoring services:

• Bitcoin Network (via OpenTimestamps) — daily Merkle root anchoring for independent timestamp verification
• Ethereum Network (Sepolia) — individual proof hash logging via smart contract
• IPFS (self-hosted Kubo cluster across three nodes) — decentralized content-addressed storage of proof metadata. Historic CIDs created through April 2026 were also pinned via Pinata; Pinata was removed from the pipeline in April 2026.
• Cloudflare R2 — encrypted backup of proof payloads

No personal information (names, addresses, contact details, financial specifics) is ever transmitted to or stored on blockchain networks, IPFS, or external object storage. Only cryptographic hashes and record-type identifiers are anchored externally.

6. Data Security

We implement multiple layers of security to protect your data:

• Encryption in transit: All connections use HTTPS/TLS encryption.
• Tenant isolation: Multi-tenant architecture with strict data separation. Every database query is scoped to the authenticated tenant.
• Session security: 30-minute idle timeout, session fingerprinting (user agent + IP subnet hash) to detect hijacking.
• HTTP security headers: Content Security Policy (CSP), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy on all responses.
• Upload security: File uploads are validated by MIME type, checked for path traversal attacks, and scanned for malware using ClamAV antivirus.
• API rate limiting: Sliding-window rate limiting to prevent abuse.
• CSRF protection: Token-based CSRF protection with timing-safe comparison.
• Password security: All passwords are hashed using bcrypt. We never store plaintext passwords.
• Regular backups: Automated database and file backups.

No system is 100% secure. While we implement reasonable and appropriate safeguards, we cannot guarantee absolute security. We will notify affected users promptly in the event of a data breach, as described in our Data Processing Agreement.

7. Data Retention

• Active accounts: Data is retained for the duration of your subscription.
• Cancelled accounts: Data is retained for 90 days after cancellation to allow for reactivation, then permanently deleted.
• Terminated accounts: Data is retained for 90 days to allow for export requests, then permanently deleted.
• Public site analytics: Aggregated analytics data is retained indefinitely. Individual session records may be purged after 24 months.
• Support tickets: Retained for the life of the account plus 12 months for quality assurance.
• Billing records: Retained as required by applicable tax and financial regulations.

8. Data Isolation and Multi-Tenancy

MyWork is a multi-tenant platform. This means multiple Subscribers share the same infrastructure, but their data is strictly isolated:

• Every database query includes tenant-scoping to prevent cross-tenant data access.
• Subscriber A cannot view, search, or access Subscriber B's data under any circumstances.
• Team members and owner portal users are scoped to their Subscriber's tenant.
• File uploads are stored in tenant-specific paths.

9. Your Rights

All Users

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Data portability: Request your data in a standard, machine-readable format.
• Opt-out: Unsubscribe from promotional communications at any time.

If You Are a Subscriber's Customer

If your data is stored in the Platform by one of our Subscribers (e.g., you are a customer who uses the portal), your primary point of contact for data rights requests is the Subscriber who entered your data. They are the data controller. If you cannot reach the Subscriber, you may contact us and we will make reasonable efforts to assist.

California Residents (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know what personal information we collect, use, disclose, or retain.
• Right to delete personal information we hold about you (with limited statutory exceptions, including financial records we are required to retain).
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information as defined by the CCPA. See our dedicated Do Not Sell or Share My Personal Information page for the formal statement and details on how CCPA defines these terms.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising any of the above.

European Residents (GDPR / UK GDPR)

If you are located in the EEA, the UK, or Switzerland, you have specific rights under the GDPR (and the UK GDPR):

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request that inaccurate data be corrected.
• Right to erasure ("right to be forgotten") — request deletion, subject to overriding legal obligations.
• Right to restrict processing in defined circumstances.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent where consent is the legal basis.
• Right to lodge a complaint with your local supervisory authority.

Legal bases for processing: contract performance (providing the Service); consent (for marketing emails and optional cookies); legal obligation (financial records, dispute documentation); legitimate interest (security, fraud prevention, Service improvement). For Subscriber Data, we act as a data processor on behalf of the Subscriber (data controller), pursuant to our Data Processing Agreement. International data transfers rely on Standard Contractual Clauses (SCCs) where required.

How to Exercise Your Rights

To exercise any of the rights above, contact us using the information in Section 14. We will respond within the timeframe required by the applicable law (generally 30 days for GDPR, 45 days for CCPA). Self-service tools for download and deletion are on our compliance roadmap; until then, we handle requests manually at no charge to you.

For the Integrity Proof Chain specifically: cryptographic hashes anchored to public blockchains (Bitcoin, Ethereum, IPFS) cannot be deleted from those networks. However, the underlying data that is hashed lives in our database; we can delete that underlying data on request, leaving only an unlinkable hash on-chain.

10. Children's Privacy

The Platform is a business tool and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly.

11. SMS/Text Message Policy (TCPA Compliance)

Our SMS program complies with the U.S. Telephone Consumer Protection Act (TCPA) and the carrier rules under 10DLC. If you opt in to receive SMS/text messages from us, or from a Subscriber using the Platform to communicate with their own customers:

• Express written consent is required before any message is sent. We retain a record of the consent date, the source, and what was consented to.
• What is sent: transactional messages (appointment confirmations, project updates, payment receipts, reminders) and — only if separately selected — promotional messages.
• Frequency varies by activity. Standard message and data rates may apply.
• Opt out anytime by replying STOP to any message. We process opt-outs in real time and send a final confirmation reply.
• HELP reply available for assistance.
• Consent is not a condition of purchase or service access.
• Third-party processor: we use Telnyx (a licensed CPaaS provider) to deliver messages. Telnyx and your carrier process delivery metadata as required to transmit the message. Phone numbers and SMS opt-in status are never shared with any third party for marketing or other unrelated purposes.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will post the updated policy on this page with a new "Last updated" date.
• We will notify active Subscribers via email or in-platform notification.
• Continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Related Documents

• Platform Terms of Service
• Cookie Notice
• Data Processing Agreement

14. Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise your rights, contact us:

• Email: [email protected]
• Phone: (719) 654-1610
• Address: 2316 N Wahsatch Ave, #253, Colorado Springs, CO