BounceDay Privacy Policy

Effective date: August 26, 2026 · Last updated: October 11, 2026

BounceDay ("BounceDay," "we," "us") is operated by ARDEO LABS LLC, a Florida limited liability company. This policy explains what we collect, why, and your rights. It covers our mobile and web apps, our website (including booking-request pages, client portals, and setup-record PDFs), and support. It applies to operators (rental businesses with BounceDay accounts) and to their clients.

The short version: your data is yours. We don't sell it or rent it, we don't run ads, and we don't share it with third parties for their own advertising. We don't use your content to train AI models. You can export or delete everything at any time.

1. What we collect

Account information. Email address, name, and authentication credentials (held by our authentication provider).

Your business content. Fleet units and photos, prices, expenses, bookings, contract and waiver text, weather thresholds, safety checklists, and the branding and payment links you display.

Your clients' details. Names, emails, phone numbers, event and delivery addresses, and notes, entered by you or submitted on your booking page. You must have the right to share them with us. We use them only to run the service for you, never for our own marketing.

Delivery distance. We send your delivery base address and your bookings' event addresses to our geocoding provider (see §8) to compute delivery distance and run instant-book checks. If a visitor taps "Use my location" on your booking page, their coordinates go only to our website, to find the nearest ZIP code. We don't pass them on or store them.

E-signature records. When a client signs a contract, we record the typed name, the date and time, a hashed IP address, and browser information as evidence of signing.

Photos. Fleet photos for AI listing drafts, day-of checklist photos with timestamps, and photos clients attach to reviews. Photos are never location-tagged; the app never asks for location permission.

Payment information. Stripe handles web subscriptions. Apple or Google handles in-app subscriptions, and RevenueCat manages them for us (see §8). We receive your subscription status only. We never receive or store card numbers, card brands, or billing card details of any kind. Payments through your own payment links happen outside BounceDay; we never see them. With integrated collection, Stripe processes client payments under your own Stripe account and they settle directly to you. We receive the amount, status, and payment method type (never card numbers or card identifiers) to show your ledger, reconcile bookings, calculate the platform fee, and send receipts.

Usage and device data. PostHog collects analytics events (screens used, features triggered), device type, OS version, and approximate region (city and region, derived from your IP address), including on booking portals. In the apps, events are keyed to your account ID. Sentry collects crash and error diagnostics.

Session recording. On our own website's pages we record the browsing session (mouse movement, scrolling, and the page as displayed), with everything you type into a form masked, to see where the site confuses people. We never do this on your clients' booking, portal, or payment pages, on setup records, or on our legal pages.

Your analytics choice. Visitors in the EU/EEA, United Kingdom and Switzerland are asked before usage analytics turns on; elsewhere it is on by default. You can change your choice at any time with the "Analytics preferences" link in the footer.

Site analytics. Our websites use Cloudflare Web Analytics only to count page views and measure load speed. It works without cookies, without fingerprinting, and without cross-site tracking, and it gives us no name, email address, or precise location.

Support communications. Emails to our support address and messages from our contact form or in-app support form. The in-app form also sends app version and build, platform, OS version, device model, language, time zone, and any photos you attach.

Device permissions.

• Contacts: the app reads only the one contact you pick to add as a customer (name, phone, email). We never read or upload your address book.
• Camera and photos: used only when you photograph a unit, your logo, or a day-of check, or pick an existing photo.
• Notifications: we store a push token to deliver the notifications you turn on. It is removed when you delete your account or the device unregisters (for example, after you uninstall the app).

2. How we use it

• Run, maintain, and improve the service (including offline sync and backups).
• AI fleet capture: unit photos you submit are sent to Anthropic's API to draft a listing. Drafts land in a review queue; nothing is created without your confirmation, and prices are never AI-generated.
• AI contract import: a contract or waiver document you upload (PDF or text) is sent to Anthropic's API to suggest wording for your contract's sections. Nothing changes until you choose to use a suggestion.
• Weather checks: for bookings you enable, we send the event location's coordinates to the U.S. National Weather Service to check forecasts against your thresholds. The app never cancels or reschedules anything on its own.
• Send the push notifications you enable and the transactional email the service requires.
• Measure overall usage, diagnose crashes, prevent fraud and abuse, and comply with law.

3. Public pages, portals, and PDFs

Some pages live at unguessable links, and anyone who has such a link can view that page:

• Booking portals show the client's name, the quote, and the operator's contract, weather policy, waiver, and payment links.
• Setup-record PDFs show the client's name, event date and address, the units delivered, and each checklist item with photo and timestamp, for operators to share with insurers, schools, or municipalities.
• Booking-request pages show the operator's fleet and prices, and collect the details a client submits.

Treat these links like the documents themselves. Operators control who receives them.

4. If you're a client of a BounceDay operator

Your rental company is responsible for its relationship with you; we process your details (contact info, event address, signature record) on their behalf. If you pay through a BounceDay page, Stripe collects your card on its own pages under your rental company's Stripe account. We give Stripe your email to fill in the form and never receive your card number. To access, correct, or delete your information, contact your rental company, or email us and we'll help.

Text messages (SMS). If your rental company sends booking texts, we send transactional texts about your booking on their behalf to the mobile number you give: a day-before confirmation, an on-the-way notice, and weather-reschedule notices. There are two ways that number is recorded for texts, and we keep a record of which one applied to you: you give the number on your rental company's booking form, which says directly under that field that we will text booking updates and how to stop them, or you can text START to our number yourself. Giving a number is optional and does not affect your booking. How booking text updates work shows the exact wording. Message frequency varies; message and data rates may apply. Reply STOP at any time to stop all texts (or HELP for help). Opt-out takes effect immediately, applies to every rental company that texts you through BounceDay, and is honored for all future bookings. Reply START to turn texts back on. Mobile phone numbers and SMS consent records are never shared with or sold to third parties or affiliates for marketing or promotional purposes. Twilio delivers these texts and uses your number only to send them.

5. Where your data lives

Supabase stores your data (PostgreSQL and file storage) in the United States. Public pages can read only the booking data allowed for their link.

6. How long we keep it

• While your account is active: we keep your content. You can export it (JSON/CSV) at any time, on any plan, including after you cancel a subscription.
• When you delete your account: you are signed out and your organization's content is scheduled for permanent deletion in 7 days; the app shows the date. Sign back in before then to cancel and restore everything. After that, a daily job permanently removes your records and stored files. Your content is gone within 30 days, except minimal records we must keep for legal, tax, or security purposes (such as invoices).
• Subscriptions: a Stripe web subscription is cancelled when you request deletion, and the remaining paid time is not refunded. App Store and Google Play subscriptions keep billing until you cancel them with Apple or Google.
• Team members who are not the account owner are removed from the organization and their account is deleted immediately, with no grace window and no restore.
• Backups age out within 30 additional days.

7. Your rights and choices

• Access & portability: export everything from Settings → Your data → Export my data.
• Correction: edit your content in the app.
• Deletion: delete your account in the app (Settings → Your data), or email [email protected] from your account email and we'll delete it.
• Marketing opt-out: every non-transactional email has an unsubscribe link.
• State privacy rights: depending on where you live, you may have rights to access, delete, correct, or get a copy of your personal information, and to non-discrimination for exercising them. We honor these requests for everyone. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.
• If we ever wrote to you before you were a customer: the same request path applies, you do not need an account, and the only record we keep after you opt out is a suppression entry for your address so we never contact you again.

To exercise any right: [email protected]. We verify requests through your account email and respond within the time the law requires (generally 45 days).

8. Service providers (subprocessors)

Each provider processes data only to provide its service to us, and we require each of them, by contract, to protect your data to the standard this policy describes.

9. Children

BounceDay is a business tool for adults; you must be 18+ to hold an account. We do not collect information from children and the service is not directed at them. If you believe a child has given us information, contact us and we will delete it.

10. Security

Your data is encrypted in transit (TLS) and at rest. Row-level security on every table limits access to your own organization's data. We use scoped credentials and keep no card data. No system is 100% secure; if we learn of a breach affecting your personal information, we will notify you as required by law.

11. Changes

We'll post changes here and update the date above. For material changes, we'll notify you in the app or by email before they take effect.

12. Contact

ARDEO LABS LLC
[email protected]