Privacy Policy | Joiner Labs

Toolbelt, LLC, doing business as Joiner Labs, operates joinerlabs.com and is responsible for the personal information described in this policy. In this policy, “Joiner,” “we” and “us” mean Toolbelt, LLC d/b/a Joiner Labs.

This policy covers personal information we collect on joinerlabs.com, in the forms and messages you send us, and when you buy from us. Section 7 explains a separate case: the data inside the apps we build and run for business customers.

1. What we collect

Contact and request forms. Your name, email address, business name, trade, towns served, website, and what you want built. This covers the Personal request form, the Enterprise form, Connect applications and the contact form. It also includes anything else you type.

The free Otis audit. When you ask for the free audit, you give us your email address and your business name, and if you choose, your website or Google listing. We use them to look at your business and its public presence online, such as your website, your Google listing and your reviews, and to email you the report. We look only at what anyone can see in public. We do not ask for passwords or access to your accounts for the audit.

Account and billing data. When you buy, Stripe collects your name, email, billing details and payment card details. We never see or store your full card number. We receive from Stripe your name, email, card brand and last 4 digits, the plan or add-on you bought, and your payment status.

Usage data. We use Google Analytics 4 to see how people use the site: pages viewed, links clicked, the page that sent you, and your approximate location. We turned off Google signals and ad personalization, so we do not use this data for ads or remarketing.

Site tests and return visits. We use PostHog to see how people use the site and to test versions of some pages. You may see 1 of a few versions of a page; the site remembers which one in your browser, so it stays the same when you come back, and it may show the version that fits the pages you looked at before. PostHog records the pages you view, what you click, that you sent a form and the version you saw. It masks what you type into forms.

Device data. Your IP address, browser, device type, operating system, language and the time of your visit. Our hosting providers record this in server logs. We use it to run and protect the site.

Files you send us. Logos, photos, documents and intake answers you share so we can build and run your services.

Messages. The emails and form messages you send us, your support requests, and texts if you agree to text with us.

Cookies and similar tools. The site remembers your choice of the Business or Personal view in your browser. That choice does not identify you. Google Analytics sets cookies to tell visits apart. You can block or delete cookies in your browser settings. The site still works without them. PostHog sets a cookie and uses your browser’s storage to tell visits apart and to keep the version of a page you saw. A short notice on your first visit says so; you can close it.

We do not ask for sensitive personal information on the site. Please do not send us government ID numbers, card numbers, passwords or health information.

2. Where it comes from

From you. When you fill in a form, buy, email us or send us files.
From your device. Automatically, when you visit the site.
From Stripe and our other providers. For example, whether a payment went through.
From accounts you connect. If you ask us to run your ads or your Google Business Profile, we get access to those accounts with your permission.

3. Why we use it

To answer your request or application.
To run the free Otis audit you ask for and email you its report.
To sell, set up, build, host, run and support your services.
To bill you, collect payment and keep records.
To send service messages, such as receipts, security notices and changes to our terms.
To send marketing email or texts, only if you asked for them or the law allows. Every marketing email has an unsubscribe link.
To understand and improve the site and our services.
To protect the site, our customers and us from fraud and abuse.
To follow the law and enforce our Terms.

We do not use automated tools to make decisions about you that have legal or similarly significant effects. A person reads every Connect application and every Enterprise request.

4. Who receives it

We share personal information with companies that help us run Joiner. They may use it only to do that work for us, except where noted.

Stripe processes payments, prevents fraud and sends receipts. Stripe also has its own privacy policy for the information it handles.
Google provides Google Analytics 4 for site usage. For customers who buy a Google add-on, Google also receives the information needed to run that account.
PostHog provides site analytics and the page tests.
Our hosting providers serve joinerlabs.com and keep server logs.
Our email provider sends, receives and stores our email, including the shared inboxes.
Our app infrastructure providers run the apps we build: databases, sign-in, file storage, email and text delivery, and the AI model providers that power the AI features. When you use an AI feature, the content that feature needs goes to an AI model provider that processes it for us.
Meta and other ad platforms. If we run ads for you, we share your business details and campaign information with them as part of your ad account. They have their own privacy policies.
Our advisers, such as lawyers, accountants and insurers, when they need it to advise us.
Authorities, when the law requires it or to protect people or our rights.
A buyer. If we sell or merge our business or its assets, personal information may go to the buyer. The buyer must honor this policy.
Anyone you tell us to. For example, a tool you ask us to connect.

We do not sell personal information. We do not share it for cross-context behavioral advertising, which means targeting ads using your activity on other sites. In the 12 months before the effective date, we did neither.

The site runs no advertising pixels at launch. If that changes, we will update this policy first.

Global Privacy Control. We honor it. If your browser sends a Global Privacy Control signal, the site does not run Google Analytics or PostHog for your visit, and you see the site’s standard pages.

Do Not Track. There is no common standard for Do Not Track signals, so the site does not change how it works when it sees such a signal. It does honor Global Privacy Control.

6. California categories

If you live in California, this table shows the categories of personal information we collected in the last 12 months, in the terms California law uses. We disclosed each category only to the providers listed, for the business purposes in section 3.

Category	What we collect	Who received it
Identifiers	Name, email, IP address, cookie IDs	Stripe, Google, PostHog, hosting, email and app providers
Customer records	Name, email, billing details	Stripe
Commercial information	Plans and add-ons bought, payment status	Stripe
Internet or network activity	Pages viewed, clicks, device and browser data	Google, PostHog, hosting
Approximate location	Region or city, from your IP address	Google, PostHog, hosting
Professional information	Business name, trade, towns served, website	Email and app providers
Photos and files	Logos, photos and documents you send	Hosting and app providers

We do not collect sensitive personal information on the site as California law defines it.

7. Data inside the apps we build for business customers

When a business uses an app we built and run for it, the business decides what personal information goes into the app, such as its customers, leads and staff. For that information, the business is in charge, and we are its service provider.

We process that information only to run the app and the services the business asked for. We do not use it for our own purposes. We do not sell it, and we do not share it for advertising.

If you are a customer of a business that uses an app we run, and you want to see, correct or delete your information, ask that business. If you email us instead, we pass your request to the business and help it respond.

If you have a Personal app, you control the data in it. You can export it any time.

8. How long we keep it

What	How long
Contact and request forms	Up to 2 years after our last contact with you
Account and billing records	7 years after your last payment
Records of your consent and your agreement to our terms	3 years, or 1 year after your service ends if that is longer
Google Analytics usage data	Up to 14 months
PostHog usage data	Up to 12 months
Server logs at our hosting providers	Usually 30 days or less
Files you send us	While we build and run your services, then deleted within 30 days after service ends
Data inside your app	While your plan is active and for 30 days after it ends, then deleted. Backups are overwritten on their normal schedule
Messages and support records	Up to 3 years after the last message
Texts and text consent records	4 years after your last text or opt-out

We keep information longer if the law requires it or if a dispute is open.

9. Your rights and how to use them

You can ask us to:

Tell you what personal information we hold about you, where it came from, why we use it and who receives it, and give you a copy.
Delete the personal information we hold about you.
Correct information that is wrong.
Opt out of the sale or sharing of your information, or of targeted advertising. We do neither, so there is nothing to opt out of.
Limit how we use sensitive personal information. We do not use it beyond what the law allows.

These rights come from California law and from the privacy laws of many other states. Your state may give you more rights, such as the right to appeal. We treat every request the same way, wherever you live. We do not treat you worse for using your rights.

How to ask. Email support@joinerlabs.com with “Privacy request” in the subject. Tell us what you want. We may ask you for details that match what we already hold, so we know it is you.

How fast. We answer within 45 days. If we need more time, we tell you why and take up to 45 more days.

An agent. You can ask someone to make a request for you. We may ask for proof that you allowed it.

If we say no. Reply to our email with “Appeal” in the subject. We answer within 45 days. If you still disagree, you can contact your state attorney general.

We do not share personal information with third parties for their own direct marketing.

10. Children

joinerlabs.com is not for children under 13, and we do not knowingly collect personal information directly from them. If you think a child sent us information, email support@joinerlabs.com and we will delete it. You must be at least 18 to buy.

Family HQ, our app for households, is set up and owned by a parent or guardian, who decides who in the household uses it. What the parent or guardian enters about the household, children’s chores, allowances and pickups included, belongs to that family. We process it only to run the family’s app, never use it for ads, and delete it whenever the parent or guardian asks.

11. Security

We protect personal information with reasonable safeguards. The site uses HTTPS. Stripe handles card details. We limit who can see customer information. No system is perfectly secure. If you think something is wrong with your account, email support@joinerlabs.com. If a breach affects you, we notify you as the law requires.

12. Text messages

We text you only if you agree to it. If you give us your mobile number and agree, Joiner Labs texts you about your project, billing and support. If you also agreed to offers, we send those too. The number of messages varies.

Message and data rates may apply.
Reply STOP to stop. Other plain words, such as QUIT, END or UNSUBSCRIBE, work too.
Reply HELP for help, or email support@joinerlabs.com.
Agreeing to texts is not a condition of buying anything.

Your mobile number and your text consent are never shared with or sold to anyone for their marketing. We pass them only to the providers that deliver our texts.

13. Email

We send marketing email only to people who asked for it or where the law allows. Every marketing email has an unsubscribe link, and we honor it within 10 business days. We still send service emails, such as receipts and notices about your account.

14. Where we process it

We are in the United States. Our providers may process information in the United States and in other countries. We offer our services to customers in the United States.

15. Other sites

Our site may link to other sites, such as Meta, Google and Stripe. Their privacy policies apply to them.

16. Changes to this policy

We post changes here with a new effective date. If a change is material, we email our customers before it takes effect.

17. Contact

Toolbelt, LLC d/b/a Joiner Labs

Privacy requests and customer service: support@joinerlabs.com
New projects: hello@joinerlabs.com