This document is in effect, but it has not yet been reviewed by an attorney. If it changes in a material way, we will tell you before the change applies.
This Data Processing Agreement ("DPA") is part of the Terms of Service between James Ventures LLC, doing business as Yardscale ("Yardscale", the "processor"), and the business that subscribes to Yardscale (the "Subscriber", the "controller"). It applies to the personal information about the Subscriber's customers, leads and team that Yardscale processes for the Subscriber ("Customer Data").
1. Roles
1.1 The Subscriber is the controller (under some US state laws, the "business") of Customer Data. Yardscale is the processor (or "service provider") and processes Customer Data only for the Subscriber.
1.2 Yardscale is a controller only for its own account, billing, security and support information, which the Privacy Policy covers.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the Yardscale Service |
| Duration | While the Subscriber's account exists, plus the deletion periods in section 9 |
| Nature and purpose | Storing, organising and displaying records; measuring properties; scheduling and routing; quotes, invoices and payment facilitation; sending messages; AI-assisted lookups; backups and support |
| People the data is about | The Subscriber's customers and prospective customers (leads), property contacts, people who receive messages, and the Subscriber's team members |
| Types of data | Names, company names, email addresses, phone numbers, postal and property addresses, map positions and yard outlines, property notes (which may include access codes), photos of properties, quotes, jobs, invoices and payment status (not card numbers), messages and message history, marketing preferences and campaign opens and clicks, lawn treatment records, and team members' names, roles, time entries and (if turned on) job location stamps |
| Sensitive data | Not intended. The Subscriber must not enter Social Security numbers, health information or payment card numbers into notes or other free-text fields |
3. Instructions
3.1 Yardscale processes Customer Data only on the Subscriber's documented instructions: the Terms, this DPA, and the Subscriber's use and settings of the Service (for example, choosing to send a message, use AI or take a payment).
3.2 Yardscale will not sell or share Customer Data, use it for its own advertising, combine it with information from other sources except as needed to provide the Service, or keep, use or disclose it outside its relationship with the Subscriber, except as the law allows.
3.3 Yardscale will tell the Subscriber if it believes an instruction breaks the law.
3.4 Text message opt-outs are shared. Texts for all Subscribers are sent from Yardscale's numbers. When someone replies STOP, texts to that phone number are turned off for every Subscriber, so the person's choice is respected; replying START turns them back on.
4. Confidentiality
Yardscale makes sure that anyone it allows to process Customer Data is bound by confidentiality. Yardscale personnel access Customer Data only when needed to provide, secure or support the Service, or when the law requires.
5. Security
Yardscale maintains these measures:
- encryption in transit (HTTPS) for all web and API traffic;
- database rules that keep each Subscriber's information separate, and role-based permissions within each Subscriber;
- passwords stored only as hashes by the login provider;
- private storage for job photos, viewed through links that expire after 1 hour;
- separate, restricted access for Yardscale's own servers;
- limits on repeated attempts at sign-in, sign-up, public forms and payment pages;
- activity, administrator-action and security-event logs;
- nightly encrypted database backups kept for 30 days, with a weekly automated restore test;
- monitoring of uptime, scheduled jobs and errors, with alerts;
- two-step sign-in on Yardscale's accounts with its hosting, database, code and email providers.
Yardscale does not hold SOC 2, ISO 27001 or similar certifications.
6. Subprocessors
6.1 The Subscriber authorises Yardscale to use the service providers listed in section 4 of the Privacy Policy.
6.2 Yardscale relies on data protection terms with each provider and remains responsible for their processing of Customer Data.
6.3 Yardscale will give at least 30 days' notice, by email or in the app, before adding or replacing a provider that processes Customer Data. The Subscriber may object on reasonable data protection grounds. If we cannot resolve the objection, the Subscriber may cancel and receive a refund of prepaid fees for the rest of the paid period.
7. Requests from individuals
7.1 If Yardscale receives a request from a person about Customer Data, it will pass the request to the Subscriber and will not answer it directly unless the law requires.
7.2 The Service lets the Subscriber view, correct and export a customer's information, delete a customer, or remove a customer's personal information while keeping invoice and payment amounts and lawn treatment records. Yardscale will help with other requests within a reasonable time.
8. Security incidents
8.1 Yardscale will notify the Subscriber without undue delay, and in any case within 72 hours, after confirming a security breach that led to unauthorised access to, or loss, change or disclosure of, Customer Data.
8.2 The notice will describe what is known: what happened, the information and people affected, the likely consequences and what Yardscale is doing. Yardscale will send updates and reasonably help the Subscriber with notices it must give under laws such as Utah Code section 13-44-202 and other state breach laws.
9. Deletion and return
9.1 The Subscriber can export Customer Data from Settings at any time.
9.2 When the Subscriber deletes its business, Yardscale deletes Customer Data from the live Service, including photos and logos. Encrypted backups containing it are replaced within 30 days.
9.3 While an account is read-only (after a trial ends or a plan is cancelled), Customer Data is kept until the Subscriber deletes it.
9.4 Yardscale may keep limited records where the law requires (such as billing records) and a minimal record that the business was deleted.
10. Information and audits
On written request, no more than once a year, Yardscale will answer reasonable written questions about its security and processing and provide the information needed to show it meets this DPA. Any audit is at the Subscriber's cost, on reasonable notice, and must not put other customers' information at risk.
11. International transfers
Customer Data is processed in the United States. Subscribers in Canada acknowledge this transfer, and Yardscale will cooperate with reasonable requests needed for Canadian privacy law. Before offering the Service in the European Union, the United Kingdom or other regions with transfer rules, Yardscale will put appropriate safeguards in place, such as Standard Contractual Clauses.
12. US state privacy laws
Where a US state privacy law applies to the Subscriber (for example the California Consumer Privacy Act, or the laws of Colorado, Virginia, Connecticut or Utah), Yardscale acts as the Subscriber's service provider or processor and will: process Customer Data only for the purposes in this DPA; comply with that law and provide the protection it requires; tell the Subscriber if it can no longer meet these obligations; and let the Subscriber take reasonable steps to stop unauthorised use. Yardscale understands and will comply with these restrictions.
13. Liability and priority
The limits of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms about Customer Data, this DPA controls.