Privacy Policy

This Privacy Policy explains how Ribbler ("Ribbler," "we," "us," or "our") collects, uses, and shares personal information. It applies to our website, our software platform, and the related services we provide (collectively, the "Services").

Ribbler provides advertising management and revenue-attribution software to service businesses such as landscaping and home-service contractors (each, a "Customer"). This Policy is written for a United States audience and reflects U.S. privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA") and comparable state privacy laws.

1. Who This Policy Covers

This Policy describes our practices with respect to three groups of individuals:

• Website visitors: people who visit or interact with ribbler.com and our online content.
• Customers and their personnel: the business owners and staff who register for and use the Services.
• Our Customers' leads and customers: individuals who contact or transact with a Customer (for example, a homeowner who calls or submits a form to a contractor) and whose information is processed through the Services.

The way we handle information, and the choices available, differ by group. In particular, information about our Customers' leads and customers is generally processed on behalf of the Customer, as described in Section 6.

2. Information We Collect

Information you provide to us. When you express interest in, register for, or use the Services, we may collect your name, business name, email address, phone number, business address, account login details, and the content of communications you send us. If you purchase the Services, our third-party payment processor collects and processes your payment information; we do not store full payment card numbers.

Information collected automatically. When you visit our website, we and our service providers may automatically collect information such as your IP address, device and browser type, pages viewed, referring pages, and interactions with our content, using cookies and similar technologies as described in Section 5.

Information from connected accounts and sources. To deliver the Services, we access and process information from the accounts, tools, and sources a Customer connects or provides, which may include the Customer's Google Ads account, call- and form-tracking tools, Revenue Records (such as a CRM, spreadsheet, or exported reports), and content published on the Customer's website. We may also enhance this information using publicly available data about the Customer's business, such as details from the Customer's website, online business directories, and public reviews (for example, Google reviews), to improve the accuracy and relevance of the Services. This information may include personal information relating to the Customer's leads and customers, as described in Section 6.

3. How We Use Information

We use personal information to:

• Provide, operate, maintain, and improve the Services;
• Set up and manage Customer accounts and authenticate users;
• Create, manage, and optimize advertising campaigns and hosted landing pages, including through automated and artificial intelligence (AI) tools;
• Perform revenue attribution and produce reporting and analytics;
• Process payments and manage billing;
• Communicate with you about the Services, including service updates, support, and administrative messages, and (where permitted) marketing about our Services, which you may opt out of;
• Maintain the security and integrity of the Services and detect and prevent fraud or abuse;
• Comply with legal obligations and enforce our agreements.

Use of artificial intelligence. The Services rely on automated and AI tools, including to analyze websites and accounts, generate landing pages and advertising content, and optimize campaigns. To provide these features, we may use third-party AI providers that process information on our behalf as service providers, subject to obligations to protect the information and use it only to provide their services to us. We use AI providers under commercial terms that, by default, do not use the inputs or outputs we submit to train their general-purpose models.

4. Legal Bases and Purposes

We process personal information where we have a legitimate business need, where processing is necessary to provide the Services you or a Customer have requested, where we have consent (where required), or where we are required to do so by law.

5. Cookies and Tracking Technologies

We and our analytics and advertising partners use cookies, tags, pixels, and similar technologies on our website to operate the site, remember preferences, understand how the site is used, and measure and improve our marketing. These partners may include analytics providers (such as Google Analytics) and advertising platforms (such as Google Ads), which may set their own cookies and collect information about your activity over time and across websites.

You can control cookies through your browser settings and, where available, through opt-out tools offered by these partners. Many browsers also support a Global Privacy Control (GPC) signal, which we honor where required as a request to opt out of the "sale" or "sharing" of personal information. Disabling certain cookies may affect how the website functions.

Do Not Track. Some browsers offer a "Do Not Track" (DNT) setting. There is no common industry standard for how to respond to DNT signals, and we do not currently respond to them. We do, however, honor Global Privacy Control signals as described above where required by law.

6. Information We Process on Behalf of Our Customers

A core function of the Services is connecting a Customer's advertising to the actual jobs and revenue it produces. To do this, we process information about the Customer's leads and customers: for example, a homeowner's name, phone number, email address, the inquiry or form they submitted, call records, and associated job or revenue data drawn from the Customer's Revenue Records.

Our role. When we process this information, we act as a service provider / processor on behalf of the Customer, and we use it only to provide the Services to that Customer, including matching leads to advertising activity, performing revenue attribution, and uploading conversion data (including hashed identifiers) to advertising platforms such as Google to measure and improve campaign performance. We do not use this information for our own independent marketing purposes.

Customer responsibility and consent. The Customer determines what information is collected from its leads and customers and is responsible for providing appropriate privacy notices to, and obtaining any required consents from, those individuals. The Customer represents and warrants that it has all rights, permissions, and consents necessary under applicable law to provide that information to us and to allow us to use, disclose, and process it as described in this Policy. In particular, where a Customer uses the Services to build advertising audiences from customer contact data (for example, Customer Match), the Customer represents and warrants that it has obtained all rights, permissions, and consents necessary to use that data for advertising purposes, including to provide it to us for hashed upload to advertising platforms.

Individual requests. If you are a lead or customer of one of our Customers and you wish to access, correct, or delete information that a Customer has collected about you, please contact that business directly, as they control that information. We will assist our Customers in responding to such requests as required by law.

7. How We Share Information

We do not sell personal information for money. We may share personal information as follows:

• Service providers and subprocessors. With vendors that perform services on our behalf, such as hosting, payment processing, analytics, call- and form-tracking, AI providers, and advertising platforms (including Google), bound by obligations to protect the information and use it only to provide their services to us.
• Advertising platforms. To deliver the Services, we transmit conversion and attribution data (including hashed identifiers) to advertising platforms such as Google on behalf of our Customers, as described in Section 6.
• Advertising and analytics on our website. As described in Section 5, our use of advertising and analytics cookies on our website may constitute "sharing" of personal information for cross-context behavioral advertising under certain state laws. You may opt out as described in Sections 5 and 10.
• Legal and safety. When we believe disclosure is required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Ribbler, our Customers, or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be transferred as part of the transaction.

8. Data Retention

We retain personal information for as long as needed to provide the Services, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. Conversion and attribution data is also subject to the requirements and technical limits of the third-party tools and platforms we use, which may change over time. When information is no longer needed, we delete or de-identify it in accordance with our retention practices.

9. Data Security

We maintain reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Your Privacy Rights

Depending on your state of residence, you may have the right to:

• Know and access the personal information we have collected about you;
• Request correction of inaccurate personal information;
• Request deletion of your personal information;
• Opt out of the "sale" or "sharing" of personal information and of certain targeted advertising; and
• Not be discriminated against for exercising your rights.

To exercise these rights, contact us at support@ribbler.com. We will verify your request as required by law before responding, and we will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request on your behalf, subject to verification.

If your request concerns information that we process on behalf of one of our Customers (see Section 6), we will refer the request to the relevant Customer or assist that Customer in responding, as that Customer controls the information.

11. California Privacy Disclosures (CCPA/CPRA)

In the preceding twelve months, we may have collected the following categories of personal information: identifiers (such as name, email, phone number, and IP address); commercial information (such as services purchased and billing records); internet or network activity (such as website usage and interactions); geolocation derived from IP address; and professional or business information. We collect this information from the sources described in Section 2 and use it for the purposes described in Section 3.

Sale and sharing. We do not sell personal information for monetary consideration. We may "share" personal information for cross-context behavioral advertising through advertising and analytics cookies on our website (see Sections 5 and 7). You may opt out by adjusting your cookie settings or by sending a Global Privacy Control signal from your browser.

Sensitive personal information. We do not collect or use sensitive personal information for purposes that require an opt-out under the CCPA/CPRA.

California residents may exercise the rights described in Section 10 and, under California's "Shine the Light" law, may request information about disclosures of personal information to third parties for their direct marketing purposes.

12. Children's Privacy

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@ribbler.com and we will take appropriate steps to delete it.

13. Third-Party Websites and Services

Our website and the Services may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

14. Where Information Is Processed

We are based in the United States and process personal information in the United States. The Services are intended for use by businesses and individuals in the United States.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy.

16. Contact Us

If you have questions about this Policy or our privacy practices, contact us at support@ribbler.com.