Privacy Policy

Last modified: August 28, 2026

Summary in plain language

This summary is for convenience only. The full policy below governs.

Who controls your information. If you’re a homeowner or a technician, your service company controls your records — we process them for that company. Send your privacy requests to them; we’ll help them respond. We control the information you give us directly, and information collected on our marketing website (see “Our role”).

What we collect. Your contact details, service and transaction history, content you upload, device and usage data, technician location while working, and call recordings if you phone us.

AI. We use AI providers to power the assistant, imports, and routing. They are contractually barred from using your information to train their generally available models. AI actions on a service company’s behalf are confirmed by a person there by default; a service company can also let an assistant handle routine replies and scheduling automatically — if you’re dealing with an automated assistant we’ll tell you, and you can ask for a person. We never automate decisions about credit, insurance, employment, housing, or denial of service.

Selling and sharing — the honest split. Inside the ProValet apps there is no selling, no sharing for advertising, and no advertising or tracking software of any kind. On our marketing website (provalet.io) we do use advertising and analytics technologies, including Google and Meta, and this may count as a “sale” or “share” under state privacy law even though no money changes hands. You can opt out with the “Do Not Sell or Share” link in our website footer, by turning on Global Privacy Control in your browser, or by emailing privacy@provalet.io.

How long we keep things. Concrete periods are in the Data Retention table — seven years for financial and consent records, 24 months for technician location data, 90 days after account closure for most customer records.

Your rights. Know, access, delete, correct, opt out, and appeal if we say no. We won’t treat you differently for asking. Details and how to file are in “Your U.S. State Privacy Rights.”

Children. Not for anyone under 16. You must be 18 to hold an account or make a payment.

Contact. privacy@provalet.io, or write to us in Naples.

Introduction

Pure Coastal Technologies, Inc. (“Pure Coastal,” “we,” “us,” “our”) is committed to respecting your privacy and managing the personal data we collect as part of our business. This privacy policy (the “Privacy Policy”) explains the collection, use, and sharing of information from or about you in connection with your use of our website, https://app.provalet.io (the “Site”), and your use of our related products, platforms, applications, and services (collectively with the Site, the “Services”).

This Privacy Policy applies to all users of our Services, including service companies, service technicians, and customers using our Services for professional services management (such services, “Professional Services,” and all those covered in this Policy collectively, “users”).

Our role. For information that a service company collects from and about its own customers and technicians and processes through our Services, the service company is the controller (or “business”) and Pure Coastal acts as a processor (or “service provider”) on that service company’s behalf and under its instructions. If you are a customer or technician and you want to exercise a privacy right, contact your service company first; we will assist them in responding. For information we collect directly — such as when a service company signs up, when you visit our Site, or when you contact us — Pure Coastal is the controller.

By using the Services, you consent to the use of the information you provide to us in accordance with this Privacy Policy. We may update this Privacy Policy from time to time. If we materially alter it, we will notify you by posting a notice on our Site or applications or by providing the modified policy to you in another reasonable way. Your continued use of the Services will be deemed your acknowledgement of receipt of the updated policy.

This Privacy Policy is incorporated into and is part of the Terms of Service for our Services: - ProValet Platform Terms of Service (Service Company Agreement) - ProValet Customer Terms of Service - ProValet Technician App Terms of Service

In the event of a conflict between this Privacy Policy and the terms of any of those agreements, the terms of those agreements will control.

Children’s Privacy

Our Services are not intended for children under sixteen (16) years of age. We do not knowingly solicit personal information from or market to anyone under sixteen. If you are under sixteen, do not use the Services, register, use any interactive feature, or provide any information about yourself to us. You must be at least eighteen (18) to hold a customer or technician account or to make a payment through the Services. If we learn that we have collected personal information from a child under sixteen, we will delete it. To report such a collection, contact privacy@provalet.io.

Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Services:

Identifiers and contact information — name, postal address, email address, telephone number; and for service companies, business name, logo, business phone, and business address.

Account and profile information — username, password (stored in hashed form), account settings, role, and the service company you are associated with.

Commercial and transaction information — Professional Services purchased, provided, or offered through the Services; service history; invoices, estimates, tips, payment status, and transaction history.

Payment information — billing address and payment method details. Full payment card numbers and bank account numbers are collected and stored by our third-party payment processor, not by Pure Coastal. We retain limited information such as the payment method type and last four digits.

Geolocation data — precise location data from a service technician’s mobile device while using the ProValet Technician App, where enabled by the technician’s device permissions and configured by the service company; service and property addresses; and approximate location derived from IP address.

Content you submit — records, notes, photographs, videos, chemistry and equipment readings, messages, and files uploaded to the Services, including customer lists imported from other software.

Device and usage information — IP address, device and browser type, operating system, device identifiers, network name, pages and screens viewed, features used, access dates and times, referring pages, search queries on the Site, and other traffic and communication data.

Communications with us — records and copies of your correspondence, including email and SMS, and information you provide when you report a problem or respond to a survey.

Call recordings and transcripts — where you call us, we may record the call and generate a transcript. We use recordings and transcripts for quality assurance, staff training, dispute resolution, and to fulfil your request. We will tell you at the start of the call that it may be recorded, and if you prefer not to be recorded we will either stop the recording or offer another way to help you. Several states, including Florida, require the consent of all parties to record a call.

We do not use call recordings, transcripts, or their contents to train artificial-intelligence models, and we contractually require our providers not to do so. Where an automated voice assistant answers or helps with an inbound call, we will tell you that you are speaking with an automated assistant and you may ask to be transferred to a person.

Inferences — limited inferences drawn from the above to operate and improve the Services, such as usage patterns and route-efficiency estimates.

We collect this information: - Directly from you when you provide it; - Automatically as you navigate through the Services, through cookies, pixels, SDKs, and similar technologies; - From your service company or your technician’s service company, including through data your service company imports from other systems; and - From third parties, such as our payment processor and business partners.

Note on imported data. Service companies may import customer lists and related data from other systems into the Services. The importing service company is responsible for having the right and lawful basis to do so and for providing any required notices to the individuals in that data.

Information We Collect Through Automatic Data Collection Technologies

Our Services use cookies, pixels, software development kits, and similar tracking technologies. We use them to keep you signed in, remember your preferences, secure the Services, and understand how the Services are used so we can improve them.

We use PostHog as our product analytics provider to measure how users interact with the Services, diagnose functionality errors, and improve the product.

We configure PostHog so that it does not receive your name, email address, telephone number, or postal address. Analytics events are keyed to a pseudonymous internal account identifier and carry only non-identifying attributes — feature usage, record identifiers, status values, amounts, and error codes. Where we record product sessions to troubleshoot problems, all text you type and all images are masked, including payment card fields.

PostHog acts as our service provider and processes this information only on our behalf and under contract. We do not use it for advertising and we do not permit PostHog to use the information for its own purposes.

Our mobile applications contain no advertising or ad-attribution software. They do not request your device advertising identifier, do not show tracking-permission prompts, and do not track you across other companies’ apps or websites. The only third-party components in our mobile applications that transmit data are our payment processor, our crash-reporting provider, our product analytics provider, and the push-notification services operated by Apple and Google.

Most browsers accept cookies automatically, but you can change your browser settings to refuse or delete cookies. If you block cookies, some features of the Services may not work properly.

Do Not Track and Global Privacy Control. Our Site responds to Global Privacy Control (GPC) signals as an opt-out of any sale or sharing of personal information where applicable law requires. Our Site does not currently respond to browser “Do Not Track” signals.

How We Use Your Information

We use the information we collect to:

  • Provide, operate, maintain, and secure the Services;
  • Identify you and provide customer service and support;
  • Process payments for the Services and for Professional Services;
  • Transfer information among customers, service companies, and service technicians as necessary to facilitate the provision of Professional Services and in accordance with the applicable Terms of Service;
  • Provide information you request through the Services;
  • Provide the artificial-intelligence and automation features described below;
  • Enable service companies to route, schedule, dispatch, and verify service visits, including through technician location data;
  • Customize, measure, and improve our Services and their content and delivery;
  • Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or unlawful activity;
  • Assist you with managing your account and passwords;
  • Carry out our obligations and enforce our rights arising from contracts between you and us, including billing and collection;
  • Send you notices about our agreements, the Services, your transactions, and changes to the Services;
  • Comply with legal, tax, accounting, and regulatory obligations; and
  • Any other purpose we describe when you provide the information, or with your consent.

You may opt out of marketing communications by using the unsubscribe link in any marketing email, replying STOP to a marketing text, or contacting us at privacy@provalet.io.

Artificial Intelligence and Automated Processing

We offer features that use artificial intelligence and automation to help service companies operate their businesses. Examples include an in-application assistant that answers questions about a service company’s own data and, at the service company’s direction and confirmation, takes actions such as preparing communications, creating or updating customer records, scheduling services, and mapping and importing data; and tools that analyze service addresses to estimate route efficiencies.

Information processed. To provide these features, we and our service providers process information you and your service company submit, which may include your name, contact information, service address, service history, invoices and amounts, messages, and the contents of records and files uploaded to the Services — including customer lists imported from other software.

Third-party AI providers (sub-processors). We use trusted third-party artificial-intelligence and cloud infrastructure providers to deliver these features. When an AI feature is used, relevant information may be transmitted to and processed by these providers on our behalf. We contractually require these providers to: - process the information only to provide services to us, and not for their own independent purposes; - not use the information to train their generally available AI models; - maintain appropriate technical and organizational safeguards; and - delete or return the information in accordance with our agreements with them.

We maintain a current list of our AI providers and other sub-processors at https://www.provalet.io/subprocessors, and we provide a mechanism there to receive notice of material changes to that list.

Who directs these features. Actions taken by our AI assistant on a service company’s behalf are, by default, proposed to a person at that service company and performed only after that person reviews and confirms them. A service company may also enable an assistant to handle routine matters automatically — for example replying to a customer message, scheduling or rescheduling a visit, dispatching a technician, or preparing an estimate — without a person reviewing each one. In either case the service company, not Pure Coastal, directs and is responsible for those actions and for the information it enters or imports.

Talking to an automated assistant. Where an automated assistant is handling your message rather than a person, you will be told, and you may ask to be handed off to a person at your service company.

Accuracy. AI-generated output may be inaccurate or incomplete. It is a productivity tool, not a substitute for human judgment. If you believe information about you generated or entered through an AI feature is inaccurate, contact your service company, or contact us at privacy@provalet.io and we will assist your service company in correcting it.

Limits on automated decision-making. Some routine operational steps may be automated at a service company’s direction, as described above — scheduling, dispatch, estimate preparation, and message responses. We do not use these features to make decisions about credit, lending, insurance, employment, housing, or education, to deny or terminate service, or to make any other decision producing a legal or similarly significant effect about you, without human involvement. We do not profile you for any of those purposes.

Third-party AI assistants. A service company may choose to connect the Services to a third-party AI assistant or agent. If it does, information is exchanged with that third party under that third party’s own terms and privacy practices, and we are not responsible for its handling of that information.

Your choices. Service companies control whether they use AI features and may disable them for their account. If you are a customer or technician and have questions or requests regarding automated processing of your information, contact your service company, or contact us at privacy@provalet.io and we will assist.

Disclosure of Your Information

We share personal information only as described in this Privacy Policy. We disclose information:

  • Among users of the Services — only the information necessary between customers, service technicians, and service companies to effectuate the provision and receipt of Professional Services agreed to between those parties. Service companies that offer Professional Services are independent third parties that are not controlled by Pure Coastal and for which Pure Coastal is not liable. We cannot guarantee the accuracy or completeness of information shared between users, nor that all users will handle your information in conformance with this Privacy Policy.

  • To service providers and sub-processors that perform functions on our behalf, including cloud hosting and infrastructure, payment processing, artificial-intelligence providers (as described above), email and SMS delivery, product analytics, error monitoring, customer support, and mapping and routing. These providers are contractually restricted to using the information only to provide services to us.

  • To third-party artificial-intelligence and cloud infrastructure providers that process information on our behalf to provide the features described in “Artificial Intelligence and Automated Processing,” under contractual confidentiality and use restrictions.

  • In a business transaction — where we sell or transfer any or all of our business or assets to a third party, or in connection with a merger, acquisition, financing, reorganization, or bankruptcy. We will require any acquirer to honor this Privacy Policy or provide notice of any material change.

  • To professional advisors — auditors, attorneys, accountants, insurers, and consultants, subject to confidentiality obligations.

  • For legal and safety reasons — to comply with law, regulation, subpoena, court order, or other legal process; to cooperate with law enforcement or governmental investigations; to prevent or investigate a possible crime such as fraud or identity theft; to enforce a contract; or to protect the legal rights, property, or safety of Pure Coastal, our affiliates, our users, or the public. We reserve the right to report activities we in good faith believe to be unlawful.

  • In aggregated or de-identified form — we may disclose aggregated or de-identified information that does not identify any individual or company, without restriction. We will not attempt to re-identify such information.

Sale and Sharing of Personal Information

Within the ProValet application (app.provalet.io and our mobile applications): we do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws. Service company, customer, and technician data processed through the application is never disclosed to third parties for their own marketing purposes. The application and our mobile applications contain no advertising tags, ad-attribution software, or advertising software development kits. The analytics we run inside them are limited to product and error diagnostics performed by service providers on our behalf, configured so that those providers do not receive your name, email address, telephone number, or postal address.

On our marketing website (provalet.io): we use advertising, lead-generation, and analytics technologies provided by third parties, including Google (Google Analytics and Google Tag Manager) and Meta/Facebook. Under California and several other state privacy laws, the use of these technologies may constitute a “sale” or “sharing” of personal information, even though we receive no money for it.

Your opt-out. You may opt out of this sale and sharing at any time by: - using the “Do Not Sell or Share My Personal Information” link in the footer of provalet.io; - enabling a Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out on our website; or - emailing privacy@provalet.io.

Opting out does not affect your use of the ProValet application or the services your service company provides.

We do not knowingly sell or share the personal information of anyone under sixteen (16) years of age.

Data Retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by the type of information and the purpose for which it is processed.

Category General retention period
Service company account and business records Duration of the account, plus seven (7) years for tax, accounting, and legal-defense purposes
Customer and technician records within a service company’s account Duration of the service company’s account, then deleted or de-identified within ninety (90) days after account closure, subject to the export period in the service company’s agreement
Transaction, invoice, and payment records Seven (7) years, for tax, accounting, and chargeback purposes
Consent and e-signature records (terms acceptance, payment authorizations) Duration of the relationship plus seven (7) years, as evidence of authorization
Technician geolocation data Twenty-four (24) months, unless the service company configures a shorter period
Product analytics and device/usage logs Twenty-five (25) months
Security and audit logs Twelve (12) months, or longer where needed to investigate an incident
Support correspondence Three (3) years
Backups Overwritten on a rolling cycle not exceeding thirty-five (35) days

Information transmitted to third-party AI providers is retained by those providers only as permitted under our agreements with them, and is not used to train their models. In the ordinary course, our principal AI provider deletes inputs and outputs within thirty (30) days. Where content is flagged by that provider’s automated trust-and-safety systems as a possible violation of its usage policy, or where retention is legally required, the provider may retain that content for a longer period — currently up to two (2) years for the content itself and up to seven (7) years for safety classification scores. Certain advanced models require a mandatory thirty (30) day retention period that cannot be waived. Current provider-specific details are available at https://www.provalet.io/subprocessors.

Where we are required to retain information for a longer period by law, legal hold, or ongoing dispute, we will retain it for that period and then delete or de-identify it.

Data Storage and Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the information we collect. These include encryption of data in transit and at rest, access controls and role-based permissions, logging and monitoring, and periodic review of our security practices.

No website or database is completely secure, and we cannot guarantee the security of information you submit to us. Any transmission of personal information is at your own risk. You are responsible for protecting your password from unauthorized use or disclosure.

Security incidents. If we become aware of a security incident affecting your personal information, we will notify you or the applicable service company without undue delay and consistent with applicable law. Where Pure Coastal acts as a processor for a service company, we will notify that service company so it can meet its own notification obligations.

Accessing and Correcting Your Information

You can review and change the personal or company information you provided to us by logging into the Services and visiting your account profile page.

You may also email privacy@provalet.io to request access to, correct, or delete personal information you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or would cause the information to be incorrect.

If you are a customer or technician of a service company, that service company controls your records. Direct your request to your service company. If you contact us instead, we will forward your request to the applicable service company and assist them in responding.

If you delete content from the Services, copies may remain in cached or archived pages, or may have been copied or stored by other users.

Your U.S. State Privacy Rights

This section is our notice to California residents under the California Consumer Privacy Act as amended by the CPRA, and our notice to residents of every other U.S. state with a comprehensive privacy law. There is no separate CCPA notice — everything California requires is stated here.

Depending on where you live, you may have the rights described below. These rights apply to information for which Pure Coastal is the controller. Where a service company is the controller, direct your request to that service company.

Your rights may include: - Know / Access — to know what personal information we collect, use, disclose, and retain, and to obtain a copy in a portable format; - Delete — to request deletion of personal information we collected from you; - Correct — to request correction of inaccurate personal information; - Opt out — of the sale or sharing of personal information, of targeted advertising, and of profiling with legal or similarly significant effects. We do not sell or share personal information or use it for targeted advertising or such profiling. - Limit use of sensitive personal information — we do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under California law; - Non-discrimination — we will not discriminate against you for exercising any of these rights.

Categories collected in the last 12 months. Identifiers; customer records and financial information; commercial information; internet or network activity information; precise geolocation (technicians only); professional or employment-related information; audio, electronic, or visual information (photos, videos, call recordings where applicable); and inferences. The sources, purposes, and disclosure recipients for each are described in the sections above.

How to submit a request. Email privacy@provalet.io, or write to Pure Coastal Technologies, Inc., 365 5th Avenue South, Suite 201, Naples, FL 34102, Attn: Privacy, or call 239.349.9400. We will confirm receipt within ten (10) business days and respond within forty-five (45) days, with one forty-five (45) day extension where reasonably necessary.

Verification. We will take reasonable steps to verify your identity before responding, which may include asking you to confirm information already associated with your account. We will not use information provided for verification for any other purpose.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require written proof of the agent’s authority and may ask you to verify your own identity directly.

Appeals. If we decline your request, you may appeal by emailing privacy@provalet.io with the subject line “Privacy Appeal.” We will respond to your appeal within forty-five (45) days. If we deny your appeal, you may contact your state Attorney General.

Additional California disclosures

Sensitive personal information. We do not collect or use sensitive personal information for purposes that would give rise to a right to limit under California law. We do not use or disclose precise geolocation for advertising.

Notice at collection. The categories in this section, together with the purposes and retention periods stated above, constitute our notice at collection.

Minors. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Financial incentives. We do not offer financial incentives in exchange for personal information.

“Shine the Light.” California residents may request information about our disclosure of certain categories of personal information to third parties for those third parties’ own direct marketing purposes. We do not make such disclosures. Requests may be sent to the address above.

Metrics. Where required, we will publish annual request metrics.

If you are outside the United States

The Services are not offered to residents of the European Economic Area, the United Kingdom, or Switzerland, and we do not maintain a GDPR compliance program. See “International Users” above.

International Users

The Services are offered to, and intended for, users located in the United States. We do not direct or offer the Services to individuals or businesses in the European Economic Area, the United Kingdom, or Switzerland. All information we collect is stored and processed in the United States.

If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

We may provide links to websites owned and operated by unrelated third parties. Those sites have their own privacy policies, which we recommend you review. This Privacy Policy applies only to information collected through the Services, and we have no liability with respect to third-party sites or their privacy practices.

Governing Law and Dispute Resolution

This Privacy Policy is governed by the laws of the State of Florida without regard to its conflict of law provisions.

Any dispute arising in connection with this Privacy Policy is subject to the dispute resolution provisions — including the arbitration agreement and class action waiver — set forth in the Terms of Service applicable to you, linked in the Introduction above.

Contact Us

For questions, requests, or complaints about this Privacy Policy or our privacy practices:

Pure Coastal Technologies, Inc. Attn: Privacy 365 5th Avenue South, Suite 201 Naples, FL 34102 Email: privacy@provalet.io Phone: 239.349.9400

We will endeavor to respond within 24 to 48 hours in most cases, and in all cases within the timeframes required by applicable law.

Accessibility Statement

We are committed to making sure our website is accessible to everyone. To access this Privacy Policy in an alternative format, please email us at the address above.

Version 2026-08-28 · The controlling copy is the text above.