Privacy Policy

At Varden Homes ("Varden," "we," "us," or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Varden Dispatch contractor marketplace, our mobile applications, and related services (collectively, the "Service"). Varden Dispatch connects independent service contractors ("Contractors") with property managers, landlords, and homeowners ("Clients") who need maintenance, repair, and improvement work performed.

By accessing or using our Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide when using our Service:

• Account Information: Name, email address, phone number, password, profile photo, business name, trade(s) offered, service area, and account preferences
• Contractor Verification: Government-issued identification (driver's license, passport, state ID), tax identifier (SSN, ITIN, or EIN) for payouts and 1099 reporting, date of birth, trade and contractor license numbers, certificates of insurance, and photographs for identity verification (collected primarily through Stripe Connect)
• Financial Information: Bank account details for payouts (account and routing number), payment card information (for Clients), invoices, quotes, payout history, and billing address
• Job Information: Service address, scope of work, photos, attached documents, quote and invoice details, communications, scheduling windows, and completion status
• Client Information (for Clients): Billing and property address, payment method, phone number, and any messages, photos, or files shared while booking or coordinating a Job
• Communications: Messages between Clients and Contractors, support requests, feedback, disputes, and survey responses
• Document Uploads: Licenses, insurance certificates, W-9 forms, before/after job photos, permits, receipts, and other documents you upload

1.2 Information Collected Automatically

When you access our Service, we automatically collect certain information:

• Device Information: IP address, browser type and version, operating system, device identifiers (IDFA, GAID), device model, screen resolution, and language settings
• Usage Data: Pages visited, features used, time spent on the platform, click patterns, navigation paths, search queries, Job response times, and interaction with notifications
• Location Data: General location based on IP address; precise location for Contractors when en route to or on a Job (if enabled) to support routing, ETA sharing, and match quality
• Sign-in and Session Data: Each successful sign-in is recorded with the time, IP address, country, browser, and operating system. We use a derived "device fingerprint" to recognize previously-used devices and alert you when you sign in from a new one.
• Authentication Failures: We log failed sign-in attempts (without the password or one-time code itself) for the purposes of detecting credential-stuffing attacks, applying short-term account lockouts after repeated failures, and notifying you of suspicious activity.
• Two-Factor Authentication Secrets: If you enable TOTP-based two-factor authentication, we store your authenticator secret encrypted at rest using AES-256-GCM. We do not store your one-time codes; we only check that the code you provide matches the expected value for the current time window and that it has not already been used.
• Log Data: Access times, error logs, referring URLs, and pages viewed before and after using our Service
• Cookies and Similar Technologies: We use cookies, web beacons, pixel tags, and similar technologies. See our Cookie Policy for details

1.3 Information from Third Parties

We receive information from third-party services to provide and improve our Service:

• Stripe: Connected Account status, identity and tax-ID verification, KYC review outcomes, payout status, dispute and chargeback information, 1099 information reporting
• Identity and License Verification Providers: Document verification results, license validity lookups, and insurance verification
• Background Check Providers (optional): Criminal history and sex-offender registry results when an optional enhanced Contractor background check is performed with the Contractor's consent
• Property and Public-Record Providers: Service-address normalization, ownership lookups, and permit-record checks
• Social Media Platforms: If you choose to connect social media accounts, we may receive profile information you authorize

1.4 Sensitive Personal Information

We collect certain categories of sensitive personal information necessary for our Service:

• Tax identifiers (SSN, ITIN, or EIN) for Connect onboarding, payouts, and 1099 reporting (handled primarily by Stripe)
• Government identification numbers
• Financial account information
• Precise geolocation (when enabled)

We only use sensitive personal information for purposes permitted by law and as disclosed in this Privacy Policy. We do not use or disclose sensitive personal information for purposes other than those for which it was collected.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Improving Our Service

• Create and manage your account
• Match Contractors to Jobs based on trade, location, availability, and ratings
• Process Client payments, Contractor payouts, refunds, and platform fees via Stripe Connect
• Facilitate communication between Clients and Contractors (including masked phone numbers)
• Generate quotes, invoices, and receipts
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve user experience, match quality, and pricing guidance
• Develop new features and services

2.2 Contractor Verification and Marketplace Integrity

• Verify Contractor identity, trade license, and insurance during onboarding and on an ongoing basis
• Run optional enhanced background checks with Contractor consent
• Maintain a history of Contractor performance, Client ratings, and dispute outcomes

2.3 Identity Verification and Fraud Prevention

• Verify your identity when you create an account or request payouts
• Detect, prevent, and investigate fraud, unauthorized access, off-platform circumvention, and other illegal activities
• Comply with anti-money laundering (AML) and know-your-customer (KYC) requirements
• Protect the security of our Service and users

2.4 Legal and Compliance

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities and licensing boards
• Enforce our Terms of Service and other agreements
• Protect our rights, privacy, safety, or property
• Support information reporting to the IRS (1099-K, 1099-NEC) as applicable

2.5 Communications

• Send transactional notifications (Job alerts, quote responses, payout confirmations, dispute updates)
• Provide customer support communications
• Send service announcements and updates
• With your consent, send marketing communications about our products and services

3. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service, including account creation, Job matching, and payment processing
• Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, service improvement, and marketing (where not overridden by your rights)
• Legal Obligations: Processing required to comply with applicable laws, such as tax reporting and anti-money laundering requirements
• Consent: Processing based on your specific consent, such as for marketing communications, optional background checks, or optional features

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 With Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Stripe (payments and identity): Processing payments, ACH bank transfers, Connect Account onboarding, identity and tax-ID verification, fraud detection, disputes, and 1099 reporting
• Identity, license, and background check providers: For Contractor verification and optional enhanced background checks
• Cloud hosting and database infrastructure: Firebase (Google Cloud) for hosting, authentication, real-time database, file storage, and computing infrastructure
• Communication services: Transactional email delivery, SMS notifications, phone verification, and masked-number calling between Clients and Contractors
• Mapping and location services: Job-address geocoding, mapping visualizations, and routing
• AI-powered analysis tools: Document analysis, intake summarization, semantic search, and matching
• Error monitoring and performance tracking: Application error monitoring, crash reporting, and performance analytics to maintain service reliability
• Mobile notification services: Push notification delivery infrastructure for real-time alerts
• Accounting integrations: Financial management and accounting integrations (e.g., QuickBooks)

All service providers are contractually obligated to protect your information and may only use it for the purposes for which it was disclosed.

4.2 With Other Users

Our Service facilitates communication and transactions between Clients and Contractors:

• Clients can view a Contractor's public profile, trade, service area, ratings, reviews, and portfolio photos
• Once a Job is accepted, Client and Contractor share limited contact details (masked phone, first name, service address) required to perform the Job
• Clients and Contractors can view messages, photos, and files shared within a Job thread
• Contractors and Clients can leave ratings and reviews visible to the other user and other prospective matches

4.3 For Legal Reasons

We may disclose information:

• To comply with laws, regulations, legal processes, or governmental requests
• To respond to subpoenas or inquiries from state licensing boards or consumer-protection agencies
• To enforce our Terms of Service and other agreements
• To protect the rights, property, or safety of Varden, our users, or others
• To detect, prevent, or address fraud, security, or technical issues
• In response to lawful requests from law enforcement or other government authorities

4.4 Business Transfers

If Varden is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Background Checks and FCRA Considerations

Varden Dispatch may facilitate optional enhanced background checks on Contractors as part of marketplace integrity. When these reports are consumer reports under the Fair Credit Reporting Act (FCRA), the following apply:

5.1 Consent

Before obtaining a consumer report on you, we will obtain your written authorization and provide required disclosures.

5.2 Adverse Action

If we take adverse action (such as declining to approve or continue a Contractor account) based in whole or in part on information in a consumer report, we will provide the required adverse-action notice, a copy of the report (or the reporting agency's contact information), and a summary of your rights under the FCRA.

5.3 Dispute Rights

If you believe information in your consumer report is inaccurate or incomplete, you have the right to dispute it directly with the consumer reporting agency. The adverse-action notice will include the reporting agency's contact information.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide our Service. Specific retention periods include:

• Account Information: Duration of account plus 30 days after closure
• Financial Records: 7 years (tax and accounting purposes)
• Job Records and Communications: Duration of the Job plus 3 years
• Background Check Reports: 2 years or as required by FCRA
• Payment Records: 7 years
• Support Communications: 1 year
• Marketing Data: Until consent is withdrawn

When you initiate account deletion, we apply a 30-day cooldown period before permanently removing your personal data. During the cooldown your account is disabled (you cannot sign in), but you can restore the account at any time. After 30 days, your account, sign-in history, messages, and profile are hard-deleted. Job, invoice, and payout records are retained per the financial-records schedule above for legal and tax-compliance reasons. Anonymized financial summaries may be retained for platform analytics. If you believe any data remains after the cooldown elapses, contact us at privacy@vardenhomes.com.

7. Your Privacy Rights

7.1 All Users

Regardless of location, all users have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information through your account settings, subject to the 30-day cooldown described in Section 6 and the legal retention requirements that apply to payment and Job records
• Data Portability: Request your data in a structured, machine-readable format
• Opt-Out of Marketing: Unsubscribe from marketing communications at any time
• Account Closure: Close your account and request deletion of associated data

7.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information (with certain exceptions)
• Right to correct inaccurate personal information
• Right to opt-out of the sale or sharing of personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information as defined by the CCPA. For more details, see our CCPA Notice.

7.3 EEA, UK, and Swiss Residents (GDPR)

Residents of the European Economic Area, United Kingdom, and Switzerland have additional rights:

• Right to object to processing based on legitimate interests
• Right to restrict processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority
• Right not to be subject to automated decision-making, including profiling

7.4 Other State Privacy Laws

We comply with privacy laws in other states including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA). Residents of these states may have additional rights similar to those described above.

7.5 Exercising Your Rights

To exercise any of these rights, you may:

• Email us at privacy@vardenhomes.com
• Use the privacy controls in your account settings
• Submit a request through our online privacy request form

We will respond to verifiable requests within 45 days (or as required by applicable law). We may request additional information to verify your identity before processing your request.

8. Security

We implement industry-standard security measures to protect your information. Our security program includes:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication, and least-privilege principles
• Infrastructure: SOC 2 Type II compliant hosting with geographic redundancy
• Monitoring: 24/7 security monitoring, intrusion detection, and automated threat response
• Testing: Regular penetration testing, vulnerability assessments, and security audits
• Employee Training: Security awareness training and background checks for employees with data access
• Incident Response: Documented procedures for detecting, responding to, and recovering from security incidents

While we take extensive measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. For more details, see our Security page.

9. International Data Transfers

Varden is headquartered in the United States. Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to countries without adequate data protection laws, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Supplementary security measures where required

10. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@vardenhomes.com, and we will take steps to delete such information.

11. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites requesting that your browsing activity not be tracked. Our Service does not currently respond to DNT signals. However, you can manage your cookie preferences through our cookie preference center.

12. Third-Party Links and Services

Our Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you by email or through a prominent notice on our Service
• For material changes, provide at least 30 days' notice before the changes take effect

Your continued use of our Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For EEA residents, you may also contact our EU representative at: eu-rep@vardenhomes.com

If you are not satisfied with our response, you have the right to lodge a complaint with a data protection authority in your jurisdiction.