TerraVex Privacy Policy

Effective date: on publication · Last updated: October 7, 2026

This Privacy Policy explains how TerraVex LLC, a Florida limited liability company that operates the TerraVex platform ("TerraVex", "we"), collects, uses, discloses, and protects personal data in connection with the TerraVex platform, its websites, and its web app, including when the web app is installed to a device's home screen (together, the "Service"). The Service is offered to businesses in the United States.

1. Our two roles (important)

TerraVex plays two different privacy roles:

• Controller: for personal data we handle for our own purposes: information about the residential and commercial pest control businesses that subscribe ("Customers"), their Authorized Users' account and login data, billing contacts, website visitors, and support communications.
• Processor: for personal data a Customer uploads or generates about its own clients, properties, Portal End Users, team members, and people it is onboarding (including new hires who do not have a login yet) ("Customer Personal Data"). There, the Customer is the controller and we process on its behalf under our Data Processing Addendum (https://app.terravexos.com/legal/dpa). If you are a Portal End User or a client of a TerraVex Customer and want to exercise privacy rights over that data, please contact that business (the Customer); we will assist them as processor. Portal End Users also use the portal under the Portal Terms of Use (https://app.terravexos.com/legal/portal-terms).

2. Personal data we collect, and how

a) Account & business data (controller), which you give us when you sign up or edit your profile: name, business name, email, phone, title, role, address, company details (including business and applicator license details you choose to enter), tax rate/currency settings, authentication identifiers (including your Google or Apple sign-in identifier if you use one), and the date, version, IP address and device type of your acceptance of our terms.

b) Billing & payments (controller): subscription plan, transaction and payout metadata, and platform application-fee records. Card details are entered on our payment processor's (Stripe's) own pages; TerraVex never sees or stores full card numbers. We keep the card brand and last four digits so you can recognize the card. Payments from your clients run on the Customer's own connected Stripe account.

c) Customer Personal Data (processor) submitted or generated by the Customer, which may include: client and contact names, emails, phones, additional contacts and an optional birth date; property and facility addresses, map coordinates, and access details (for example gate, alarm or lockbox codes, key location, pets, parking, special instructions); property plans and measurements (the building model: floors, rooms, walls, slabs, crawl spaces, attics, square and linear footage, and the location of bait stations, monitors, traps and other devices); inspection photos and findings (for example pest activity, evidence of wood-destroying organisms, damage, and conducive conditions such as moisture, wood-to-soil contact or entry points); treatment and application records (for example the products and EPA registration numbers used, amounts and dilutions, target pests, areas and sites treated, weather conditions, the date and time, and the name and license or certification number of the applicator); inspection reports, including wood-destroying organism (WDO) reports; service agreements and records of notices given to clients; job, estimate, invoice, payment, tip and scheduling records; texts exchanged with clients through the Service; photos, reference images, and photos of checks and receipts; team member and new hire records, including home address, emergency contact (name, phone and relationship), pay type and rate, applicator license and certification details, and time-clock and location stamps; documents a team member uploads or the company adds, such as a certificate of insurance, a professional or applicator license or certification, or a signed company document. The Service does not ask for Social Security or taxpayer identification numbers, tax forms (such as a W-2, W-4 or W-9), Form I-9, government ID images, or payment card or bank account numbers, and the Acceptable Use Policy prohibits uploading them; electronically signed documents, each with the signer's typed name, drawn signature, date and time, IP address, browser, and a fingerprint (hash) of the document as signed; records of each company policy or TerraVex notice a person acknowledged, with the version, the exact statements shown, the time, IP address and device; background-screening and drug-screening status, the screening provider's recommended outcome label and a link to the report, returned by Checkr when a Customer orders a screening (the full reports stay with Checkr); and property-walkthrough recordings (video frames and voice notes) plus their AI-generated transcriptions and analysis.

d) Data collected through your device, only when you use the feature (controller for Authorized Users; processor for Customer Personal Data). The web app asks your device's permission first, and you can say no:

• Precise location: only at the moment a team member taps clock in/out or check in/out at a job, while the app is open. It is stored with that time stamp and its distance to the property. We do not track location in the background. If you decline, clock-in still works and is marked "location off".
• Camera, microphone and photos: only when you choose to take or attach a photo or record a walkthrough. If you dictate into a text box with your keyboard's microphone key, that is your device's own dictation, not TerraVex's; only the resulting text is saved.

e) Usage, device & diagnostic data (controller): IP address, device and browser type, pages and features used, timestamps, audit logs of actions taken in a workspace, and offline-sync metadata. When something goes wrong, an error report is sent to our error-monitoring provider (Sentry) with your user ID, email, company ID and role, the page, and your device and browser type; a small sample (about 5%) of sessions also sends performance timings. Error reports may include the last few actions before the error.

f) Cookies & similar technologies: see the Cookie Policy (https://app.terravexos.com/legal/cookies).

No tracking, no advertising. The Service contains no advertising and no advertising or product-analytics SDKs, and we do not track you across other companies' apps or websites.

g) New hire onboarding links (processor). A Customer can send a new hire an emailed (and, if the Customer has texting on, texted) link that works without a login. The link is unique to that person and expires after 14 days unless the Customer sends it again. Through it the hire enters their details, reads and acknowledges or signs the Customer's documents, acknowledges TerraVex's notices, uploads documents the Customer asked for (such as an applicator license), and can request a login. We record the time, IP address and device for each step. The Customer is the controller of this information.

The Service is not designed to hold Social Security or taxpayer identification numbers, government ID numbers or images, immigration status, or payment card or bank account numbers, and Customers agree not to upload them. The sensitive information the Service may hold is property access details and the drug-screening status described in 2(c). We use this information only to provide the Service to the Customer, never to infer characteristics about anyone. We do not intentionally collect data from children (see Section 10). The only health-related data the Service is designed to hold is the drug-screening status described in 2(c), which a Customer receives through its own Checkr account and which is visible only to that Customer's authorized administrators. Customers should not record health information about their clients or occupants (for example a client's sensitivity to pesticides) beyond what pesticide laws require them to keep, such as a notification registry. Voice and video inputs are transcribed to text; we do not create voiceprints, perform speaker identification, or otherwise use them for biometric identification. Sensitive operational data such as property access codes is access-restricted within the Service (field-level and role-based controls) and is your responsibility to have a lawful basis to store.

3. How we use personal data

As controller, we use data to: (a) provide, secure, maintain, and support the Service; (b) authenticate users and enforce role-based access and tenant isolation; (c) process subscriptions, billing, and platform fees; (d) communicate about the Service (service messages, security alerts, and, where permitted, product updates); (e) monitor, debug, prevent, and investigate fraud, abuse, and security incidents; (f) comply with law and enforce our Terms; (g) create de-identified analytics to operate and improve the Service (see Section 8); and (h) provide support, including, where a Customer asks for help or we are investigating a problem or security concern, having authorized TerraVex personnel access that Customer's workspace with the same permissions as its administrators. Such access is limited to what the task requires, is restricted to personnel bound by confidentiality, and is recorded in an audit log available to the Customer's administrators.

As processor, we process Customer Personal Data only to provide the Service and per the Customer's documented instructions and the DPA. We do not use data collected for one purpose for an unrelated purpose without asking first.

4. AI features and your permission

Some features use artificial intelligence provided by OpenAI through its API: photo- and video-based estimating, transcription of property-walkthrough voice notes, rewriting walkthrough and service notes into client-ready wording, and (for TerraVex staff only) drafting training-course content.

• We ask first. Before any photo, video frame, recording, transcript or note is sent to OpenAI, the Service asks the signed-in person for permission. Nothing is sent if they say no; they can do the same work by hand. The answer is saved on their login.
• Property owners who send photos to a pest control company through a video-estimate link choose with an unticked box whether AI may read them. Without it, no AI runs and the company looks at the photos itself.
• Withdrawing permission. Signed-in users can withdraw (or give) permission at any time under the user menu > Privacy & AI. After withdrawal nothing more is sent, and the Service asks again before any later AI use.
• What OpenAI does with it. OpenAI processes the inputs only to return the result to TerraVex, does not use them to train its models, and may keep them for up to 30 days to detect abuse before deleting them.

See the AI Features Disclosure (https://app.terravexos.com/legal/ai) for how AI works, its limitations, and responsible-use requirements. You must have the necessary rights and consents (including any voice/video recording consents from the people recorded) before submitting content to AI features.

5. Legal bases

We process personal data we control to perform our contract with Customers and Authorized Users; for our legitimate interests in securing, supporting and improving the Service and preventing fraud; with consent where the law requires it or where we ask for it (such as AI features and device permissions); and to comply with legal obligations such as tax and accounting. For Customer Personal Data processed on a Customer's behalf, the Customer is responsible for the legal basis.

6. How we share personal data

We share personal data only as needed:

• Subprocessors / service providers that help run the Service. Each is bound by a written agreement that requires it to give personal data the same or equal protection as this Policy and our DPA, and to use it only to provide its service to us. The current list, with each provider's purpose, the data it processes and its region, is the Subprocessors list at https://app.terravexos.com/legal/subprocessors, which is the single source of truth for the vendors we use. This includes the third-party AI provider described in Section 4.
• Services a Customer chooses to connect (for example QuickBooks, Checkr or a payroll provider), and web addresses a Customer sets up to receive its own data through the Service's API or webhooks. When a Customer connects one, data moves between TerraVex and that service at the Customer's direction, and the service's own terms and privacy policy apply to what it holds.
• Within the Customer's own workspace: data is visible to that Customer's Authorized Users according to the roles the Customer configures. We enforce strict tenant isolation so one Customer cannot access another Customer's data.
• Regulators, at the Customer's direction: TerraVex does not send records to any pesticide regulator itself. Where a Customer exports or sends an application record or inspection report to a regulator, a client, a lender or a real estate party, it does so as controller.
• Legal/protection: to comply with law, respond to lawful requests, or protect rights, safety, and security.
• Business transfers: in a merger, acquisition, or asset sale, subject to this Policy, and any successor is bound by the Terms and the DPA with respect to Customer Data.

We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA.

6A. Text messages (SMS)

Pest control companies that use TerraVex can send their customers texts through the Service. This section describes how the feature is designed to work.

• Service texts. Booking confirmations, appointment reminders, "on my way" notices, service records and invoice links, and a request for a review after a service. These are transactional messages about a service the customer scheduled, sent as the company configures them.
• Marketing texts. A company may also send marketing texts, for example a seasonal offer or a reminder to book again after a period without service. Marketing texts go only to customers whose consent to marketing texts is recorded on the customer record, and only between 8 AM and 8 PM in the recipient's local time.
• Consent. Texts are sent only to customers who opted in, either by ticking the (unticked by default) consent box on the company's booking page or by telling the company yes when asked by phone or in person. The opt-in, its date and its source are recorded on the customer record. Consent is not a condition of booking. The company, not TerraVex, is responsible for obtaining the consent the TCPA and state law require.
• Frequency. The Service is designed to send no more than four service texts per scheduled service. Message frequency varies with how often a customer books.
• Cost. Message and data rates may apply according to the customer's mobile plan.
• Opting out and help. Reply STOP to any message to stop receiving texts, or HELP for help. A customer who replies STOP is marked opted out and receives no further texts from that company through TerraVex.
• Team members and new hires. Customers can also text their own team members and new hires about their work, for example a new hire's onboarding link or a technician's route for the day. These texts are sent at the Customer's direction and only to a number the person gave the Customer. Reply STOP to stop them.
• No sharing of mobile information. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from every other category of sharing described in this Policy, and that information is not shared with any third party. Mobile phone numbers and opt-in records collected for these messages are used only to send the messages described here, and are never sold or rented. Sharing with subcontractors is limited to delivering the message itself: our messaging provider (Twilio) transmits the messages under contract as a subprocessor (https://app.terravexos.com/legal/subprocessors) and may not use the numbers for any purpose of its own.

7. Where data is processed

We and our subprocessors process data in the United States, except as noted on the Subprocessors list: a geocoding service operated in the United Kingdom (OpenStreetMap) receives property addresses when Google's geocoding is not used or is unavailable; and the job map loads its map images from OpenStreetMap's servers in the United Kingdom, which receive the viewer's IP address and the map area shown. The Service is offered to businesses in the United States; we do not offer it to individuals in the European Economic Area or the United Kingdom. Contact privacy@terravexos.com with questions about data location.

8. Retention & deletion

We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes (for example billing, tax, audit, and dispute resolution).

• Deleting your own account. Every account holder, including customers who use a company's client portal, can delete their login from inside the app or website (user menu > Delete my account). A team member's or portal customer's deletion removes their login and profile; the employer's or pest control company's own records about them stay with that business.
• When the only owner deletes their account, the whole company workspace is deleted immediately and permanently: every record (including application records and inspection reports), every uploaded file, and every other user's access to it. The subscription is cancelled at the same time. There is no export window, so export anything you need first, including records pesticide laws require you to keep. A single audit entry recording that the account and company were deleted, with the owner's email, is kept for our records. If you signed in with Apple, we also revoke TerraVex's access to your Apple sign-in.
• When a subscription ends any other way, Customer Data remains available for export for 30 days and is then deleted or returned as described in Section 10 of the DPA, except where longer retention is required by law.
• Records the law requires the Customer to keep. pesticide laws may require a Customer to keep application records, inspection reports and similar records for several years. The Customer decides how long to keep them in the Service and is responsible for keeping its own copies after its subscription ends.
• Team and onboarding records. Team member records, uploaded documents, signed documents and acknowledgement records stay in the Customer's workspace until the Customer deletes them or the workspace is deleted. The Customer decides how long to keep them. An onboarding link stops working when it expires or the Customer cancels it. Deleting a team member's login does not delete the Customer's records about them.
• Other deletion. Customers control much of their data lifecycle within the Service; deleting a client through the Service removes that client's associated records from that Customer's workspace. You can also ask us to delete data we control by emailing privacy@terravexos.com.
• Copies elsewhere. Routine database backups kept by our hosting provider roll off on its backup schedule. Error reports are kept by Sentry for up to 90 days. Inputs sent to OpenAI are kept by OpenAI for up to 30 days (Section 4).
• De-identified data may be retained: we will not attempt to re-identify such data, will maintain it in de-identified form, and will contractually obligate any recipient to the same.

9. Security

We use administrative, technical, and organizational measures designed to protect personal data, including role-based access control, database row-level security enforcing tenant isolation, field-level restrictions on sensitive fields (for example access codes and secrets), encryption of data at rest and in transit, authenticated APIs, and audit logging (including a log entry, visible to the Customer's administrators, whenever TerraVex personnel access a Customer's workspace for support). Most uploaded files, including inspection photos and signed documents, are stored at long, random web addresses that cannot be guessed; anyone who is given a file's address can open it, so share file links only with people who should see them. Team member documents uploaded through an onboarding link are kept in separate private storage with no permanent address; they open only through a link that expires after one minute, which only the Customer's owner and office roles (and TerraVex personnel under Support Access) can request. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. Report concerns to security@terravexos.com.

10. Children

The Service is for businesses and is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child's data has been provided, contact privacy@terravexos.com and we will take appropriate action.

11. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, to withdraw consent, and to lodge a complaint with a regulator.

• Withdrawing consent: AI permission under user menu > Privacy & AI; device permissions (location, camera, microphone) in your device's settings; text messages by replying STOP.
• Deleting your data: user menu > Delete my account, or email privacy@terravexos.com.
• New hires without a login: ask the company that sent you the link to correct or delete your information, or email privacy@terravexos.com and we will pass the request to that company.
• California (CCPA/CPRA): you may request to know, delete, and correct personal information, and to opt out of sale/sharing (we do not sell or share as defined). We will not discriminate for exercising rights.
• Other U.S. states: similar rights may apply under your state's privacy law.
• EEA/UK: we do not have an EU or UK establishment and do not offer the Service to data subjects in the EEA or UK, so no Article 27 representative is appointed.

To exercise rights over data we control, contact privacy@terravexos.com; we will verify your request. For Customer Personal Data, contact the relevant Customer (controller); we will assist them. Authorized agents may submit requests where the law allows.

12. Third-party links & services

The Service may link to or integrate third-party services with their own privacy practices. We are not responsible for them; review their policies.

13. Changes to this Policy

We may update this Policy. The "Last updated" date reflects the latest version, and for a material change we will email Customers' admin addresses at least 30 days before the change takes effect; the updated Policy is also shown in the app.

14. Contact

Privacy: privacy@terravexos.com · Security: security@terravexos.com · Support: support@terravexos.com · Mail: TerraVex LLC, 5964 King George Parkway, Pace, FL 32571 · https://terravexos.com