Privacy Notice

1. Who we are

ChangeSnap is operated by LVLUP CONSULTING LLC ("LVLUP", "we", "us"). LVLUP is the data controller for personal data collected through the Service, and is responsible for deciding how that data is processed.

2. Personal data we collect

• Account data: name, email address, hashed password or OAuth identifier.
• Company profile: business name, license number, address, phone, logo.
• Project and client data you enter: client name, client email, job address, change-order descriptions, photos, signatures, approval records.
• Usage data: pages viewed, features used, timestamps, basic device/browser information.
• Log data: IP address, user agent, error logs, security events.
• Support correspondence: messages you send us.

Payment information (card details, billing address for tax purposes) is collected and stored directly by our payment provider, Paddle, and is not stored on our servers.

3. Purposes and legal bases

• Provide the Service (contract): authentication, creating projects, generating change orders, sending approval links, storing photos and signatures.
• Customer support (legitimate interests / contract): responding to your requests.
• Security and fraud prevention (legitimate interests / legal obligation): detecting abuse, securing accounts, audit logs.
• Product improvement (legitimate interests): aggregated usage analytics.
• Billing and tax compliance (contract / legal obligation): performed by Paddle as Merchant of Record.
• Marketing communications (consent): only if you opt in; you can opt out at any time.

4. How we share data

We share personal data only with the following categories of recipients:

• Subprocessors and service providers who host and operate the Service (cloud hosting, database, email delivery, error monitoring, customer support tooling).
• Paddle, our Merchant of Record, for sale of the Service, subscription management, payments, tax compliance, and invoicing.
• Professional advisers (legal, accounting) where reasonably required.
• Authorities where required by law, regulation, court order, or to protect our rights.
• Successors in connection with a merger, acquisition, or sale of assets, with reasonable safeguards.

We do not sell personal data.

5. Clients you invite to approve change orders

When you generate an approval link and send it to your client, ChangeSnap collects the client's name, typed signature, IP address, and approval/rejection decision in order to create a tamper-evident record of approval. You are responsible for ensuring you have a lawful basis to share your clients' information with us.

6. International transfers

Personal data may be processed in countries outside your country of residence, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Retention

We retain personal data for as long as your account is active and for a reasonable period afterward to satisfy our legal, accounting, or reporting obligations. Project and approval records are retained for the life of your account so that signed approvals remain available as evidence. You may request deletion at any time (see "Your rights" below).

8. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), encrypted storage, access controls, and audit logging. No system is perfectly secure; please use a strong, unique password.

9. Your rights

Depending on where you live, you may have the right to access, rectify, delete, restrict processing of, or port your personal data, and to object to certain processing or withdraw consent. To exercise any of these rights, contact us through your account. We will respond within the timeframe required by applicable law (typically within one month).

EU/UK users have the right to lodge a complaint with their local supervisory authority.

10. Cookies

We use essential cookies to keep you signed in and to operate the Service. We may also use limited analytics cookies to understand product usage. You can control cookies through your browser settings.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children.

12. Changes

We may update this Privacy Notice from time to time. Material changes will be announced by email or in-app notice.

13. Contact

For privacy questions or to exercise your rights, contact LVLUP CONSULTING LLC through your account support contact. For payment- and invoice-related questions, visit paddle.net.