Privacy Policy

This Privacy Policy describes how Hypha Dynamics Inc. (“Company,” “we,” “us,” or “our”) collects, uses, and shares information in connection with the SiteDNA website and software platform (the “Service”).

1. Scope and Application

This Privacy Policy applies when you:

• Visit our website
• Create an account or use the Service
• Communicate with us (for example, by email or through online chat)

The Service is intended for business use and is not directed to children. You must be at least 18 years old to create an account and use the Service. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a user under 18, we will take steps to delete that information promptly.

A note on business use. The Service is sold to businesses, but privacy laws in the United States generally protect individuals regardless of whether their information was collected in a business or personal context. Where those laws apply to information we hold about you — including your work email address, work phone number, or job title — we honor the rights described in Section 11.

2. Our Role: When We Are a Controller and When We Are a Processor

Our responsibilities under privacy law depend on whose information is involved and why we hold it. This distinction determines who you should contact to exercise your rights.

2.1 Where We Act as a Controller

We decide how and why information is processed — and are directly responsible for it — in relation to:

• Information about our own customers and prospects: account holders, administrators, billing contacts, and people who contact us or visit our website
• Website analytics, marketing, and support communications
• Account, authentication, billing, and security data

For this information, contact us directly using Section 11.

2.2 Where We Act as a Processor

We process information on behalf of and under the instructions of our customers — the businesses that subscribe to SiteDNA — in relation to Customer Content. This includes property photographs and video, inspection notes, reports, GPS metadata, and any third-party contact information (such as property owners, tenants, vendors, or the customer’s own employees) that a customer enters into the Service.

We do not decide what our customers collect, why they collect it, or how long they keep it. Where the Company processes personal data on a customer’s behalf, the SiteDNA Data Processing Addendum (DPA) governs that processing and forms part of our Terms of Use.

If you are a property owner, tenant, employee, or other individual whose information appears in a SiteDNA account you do not control, the business operating that account is responsible for it. Please direct requests to that business. If you contact us, we will refer you to the relevant customer where we can identify them, and we will assist that customer in responding — but we cannot access, correct, or delete their data on our own initiative except as their contract permits or the law requires.

3. Information We Collect

3.1 Information You Provide to Us

• Name
• Email address
• Phone number
• Company name and company address
• Communications you send to us (for example, support requests)
• Authentication credentials (managed via third-party providers)
• Other information you choose to provide in connection with your account, including account preferences, settings, and role-based access information

3.2 Information We Collect Through Your Use of the Service

When you use the Service, we collect and store data submitted to or generated within SiteDNA, which may include:

• Property addresses or locations
• Photos, videos, and other media uploaded by users, and their associated metadata
• Documents and file attachments
• Notes, inspections, reports, and audit data
• Third-party contact information entered by users (such as property owners, tenants, or vendors)
• GPS or geolocation data, where enabled — see Section 4
• Scheduling and assignment data
• Time stamps, device information, and activity logs
• Search queries and in-app activity
• Storage volume and other operational metadata related to use of the Service

Most of this is Customer Content, for which we act as a processor (Section 2.2).

3.3 Billing and Subscription Information

When you purchase a subscription, we collect:

• Billing contact name and email address
• Billing address, which we use to determine applicable sales tax
• Subscription plan, Seat count, billing cycle, renewal dates, and payment history
• A payment card brand, expiration date, and last four digits, returned to us by our payment processor for display and support purposes

We do not collect, store, or have access to full payment card numbers or security codes. Payments are processed by Stripe, Inc. Card details are transmitted directly to Stripe and are handled under Stripe’s own terms and privacy policy. Stripe also processes certain information as an independent controller for fraud prevention and regulatory compliance; that processing is governed by Stripe’s privacy policy.

3.4 Information We Receive From Others

An organization administrator or another user may provide your information to create your account or invite you to the Service. We may also receive business contact information from marketing and lead-generation sources where permitted by law.

4. Sensitive Information

Some categories of information receive heightened protection under state law. This section explains how we handle them.

4.1 Precise Geolocation

Where geolocation is enabled, the Service may record the location at which a photo was taken or an inspection was performed. Several state privacy laws — including the Texas Data Privacy and Security Act — treat precise geolocation as sensitive personal data requiring consent.

We use geolocation data solely to associate captured content with the correct property and to support inspection and dispatch workflows. We do not use it to track individual users’ movements outside of work performed in the Service, we do not use it for advertising, and we do not sell or share it.

Location capture can be disabled at the device level, and administrators can configure its use within the Service. Disabling it may affect features that depend on associating content with a property.

4.2 Photographs of People and Biometric Information

Photos and video captured on job sites may incidentally include images of people, including crew members, tenants, or members of the public.

We do not use facial recognition. We do not create, generate, derive, or store faceprints, voiceprints, scans of facial or hand geometry, or any other biometric identifier from photos, video, or audio in the Service, and we do not use such content to identify individuals.

Customers are responsible for their own compliance obligations when capturing images of people at properties they service, including any notice or consent required by law or by their contracts with property owners.

4.3 Audio

The Service does not record audio. If we introduce audio capture in future, we will update this Privacy Policy before that feature becomes available and will describe how audio is recorded, used, and retained.

5. Cookies, Analytics, and Tracking

We use cookies and similar technologies to operate, secure, and improve the Service and our website.

5.1 Analytics and Engagement Tools

We use third-party tools including:

Provider	Purpose
Mixpanel	Product analytics and feature usage
HubSpot	Customer relationship management and marketing communications
Intercom	In-product messaging and customer support
Google Analytics	Website analytics

These tools may collect information about how you use the Service — for example, pages viewed, clicks, feature usage, IP address, device and browser information, and approximate location derived from IP address. We use them for our own product and website analytics, not to build advertising audiences. Google Signals and ad personalization features are disabled on our Google Analytics property, and we do not operate advertising pixels on our website.

5.2 Targeted Advertising and "Sale" or "Sharing" of Personal Information

We do not sell personal information for money.

We do not engage in targeted advertising or cross-context behavioral advertising, and we do not share personal information with third parties for those purposes. The analytics tools listed above are used for our own product and website analytics only.

If this changes, we will update this Privacy Policy, provide the opt-out mechanisms required by law, and honor universal opt-out signals as described in Section 5.3 before beginning any such activity.

5.3 Universal Opt-Out Signals

A number of state privacy laws require businesses to honor universal opt-out preference signals, such as Global Privacy Control (GPC), as a request to opt out of the sale or sharing of personal information and of targeted advertising.

Because we do not sell or share personal information and do not engage in targeted advertising, there is currently no such processing for these signals to apply to.

If we begin any activity that constitutes a sale, sharing, or targeted advertising under applicable law, we will implement recognition of GPC and other recognized opt-out signals, provide a clearly labeled opt-out mechanism, and update this Privacy Policy before doing so.

5.4 Your Cookie Choices

You can control cookie preferences through your browser settings. Disabling cookies may affect certain features of the Service. Google Analytics also offers a browser opt-out add-on.

6. Online Chat and Customer Support Tools

We may offer online chat or messaging support through third-party providers, including Intercom (the “Chat Feature”).

If you use the Chat Feature:

• Chat communications are processed and stored by Intercom on our behalf
• Chat communications may be reviewed by Company personnel
• We may use automated or AI-assisted features provided by our service providers to help respond to inquiries and improve support
• Chat communications are retained in accordance with Intercom’s data retention practices, which may result in extended storage unless deletion is requested

Do not submit sensitive personal information through the Chat Feature unless expressly requested or required.

7. How We Use Information

We use information we collect to:

• Provide, operate, maintain, and secure the Service
• Authenticate users and manage accounts
• Provide customer support and respond to inquiries
• Process payments, subscriptions, renewals, and refunds
• Calculate applicable taxes and maintain financial records
• Monitor storage volume and account usage in connection with our fair use allowance
• Improve and develop SiteDNA features, including product analytics
• Monitor usage and performance, and prevent fraud or abuse
• Send service, billing, and renewal notices, including subscription renewal reminders
• Send marketing communications, where permitted, subject to your right to unsubscribe
• Comply with legal obligations

8. Artificial Intelligence and Automated Processing

8.1 We Do Not Currently Use AI to Process Customer Content

We do not use artificial intelligence or machine learning to analyze, interpret, classify, or generate content from photographs, video, inspection notes, or other Customer Content in your account.

Certain customer support tools we use offer AI-assisted features, as described in Section 6. Those features apply to support conversations with us, not to Customer Content.

8.2 If This Changes

We may introduce AI-assisted features in future — for example, to help identify issues in photographs or draft report content. Before any such feature becomes available, we will update this Privacy Policy to describe what it does, what information it processes, and which providers are involved.

If we introduce such features, we will not use Customer Content to train, fine-tune, or improve general-purpose or foundation AI models, and we will not permit our providers to do so.

8.3 No Automated Decisions With Legal Effects

We do not use automated processing or profiling to make decisions that produce legal or similarly significant effects concerning any individual.

9. Data Ownership and Use of Customer Content

Customers retain ownership of all data they upload or generate in the Service.

By using the Service, you grant the Company a limited, non-exclusive license to host, process, transmit, and display Customer Content solely as necessary to operate, support, secure, and improve the Service.

We may create and use aggregated and de-identified data for analytics, benchmarking, and product improvement. We maintain such data in de-identified form, will not attempt to re-identify it, and will not publish or disclose it in any form that identifies an individual customer, property, or person.

10. How We Share Information

We do not sell personal data.

We may share information with:

• Service providers and sub-processors that support hosting, analytics, payments, email delivery, and customer support, under contracts requiring them to process information only on our instructions
• Professional advisors, such as legal, accounting, or insurance advisors
• Authorities or third parties where required by law, regulation, or legal process
• Parties involved in a merger, acquisition, financing, or sale of assets

10.1 Sub-processors

Our principal sub-processors are:

Sub-processor	Function	Data location
Amazon Web Services (S3, compute)	Hosting and storage	United States
Amazon Web Services (SES)	Transactional and service email delivery	United States
Stripe, Inc.	Payment processing	United States
Intercom	In-product messaging and support	United States
Mixpanel	Product analytics	United States
HubSpot	CRM and marketing	United States
Google Analytics	Website analytics	United States

We will provide notice of material changes to this list to customers who have subscribed to receive it.

11. Your Privacy Rights and Choices

11.1 Rights

Depending on where you live, you may have rights to:

• Access your personal information
• Correct inaccurate personal information
• Request deletion, subject to legal and contractual obligations
• Request a copy of your information (data portability)
• Opt out of targeted advertising, or the sale or sharing of personal information
• Limit our use of sensitive personal information
• Not be discriminated against for exercising a privacy right

11.2 Where to Direct Your Request

If we are the controller — you are a SiteDNA account holder, administrator, billing contact, or website visitor — submit your request to privacy@sitedna.ai.

If your information is in a customer’s SiteDNA account and you are not that customer — for example, you are a tenant, property owner, or an employee of one of our customers — the business operating that account controls that information. Please contact them directly. If you contact us, we will forward your request to the relevant customer where we can identify them, and support them in responding.

11.3 How We Handle Requests

We respond to verifiable requests within 45 days of receipt. If we need additional time, we will notify you within that period of the extension and the reason, and will respond within a further 45 days.

To protect your privacy, we may need to verify your identity before fulfilling a request. Verification may include confirming information associated with your account or requesting additional documentation.

You may designate an authorized agent to submit a request on your behalf. Authorized agents must provide written authorization and may be required to verify their own identity.

If we deny your request, you may appeal by emailing privacy@sitedna.ai with the subject line “Privacy Request Appeal.” We will respond to appeals within 45 days. If we deny your appeal, we will provide information about how to contact your state attorney general to submit a complaint.

12. State-Specific Disclosures (United States)

If you are a resident of a state with a comprehensive privacy law — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — you may have the rights described in Section 11.

Sale and sharing. We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not engage in targeted advertising.

Sensitive personal information. We collect precise geolocation as described in Section 4.1. We use it only for the purposes described there, and we do not use or disclose it for purposes other than those permitted under applicable law.

We do not sell sensitive personal data or biometric personal data.

Financial incentives. We do not offer financial incentives in exchange for personal information.

13. Canada

For users in Canada, we process personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation.

Our privacy contact for Canadian purposes is privacy@sitedna.ai.

14. International Data Transfers

The Service is designed for users in the United States and Canada. Data is stored and processed in the United States using Amazon Web Services (AWS).

If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

15. Data Retention

We retain information as follows:

Category	Retention period
Account information	Duration of your account, plus 3 years after closure for legal, tax, and compliance purposes
Customer Content (photos, video, reports, inspection data)	Duration of your account, plus 1 year thereafter, unless earlier deletion is requested
Usage and analytics data	Up to 3 years
Payment and billing records	As required by applicable tax and financial regulations, typically 7 years
Records of consent and privacy requests	As required by applicable law, typically 3 years

Relationship to your export window. Our Terms of Use give you 30 days after your subscription ends to export Customer Content. The 1-year retention period above is a backstop, not a commitment to keep your data accessible — after the 30-day export window closes, Customer Content may be deleted at any time and access to the Service will have ended. Do not rely on the retention period as a way to recover data later.

We may retain certain data longer if required by law or to resolve disputes and enforce agreements.

16. Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not a backup or archival service. See our Terms of Use.

In the event of a data breach affecting personal information, we will notify affected individuals and, where we act as a processor, the affected customer, as required by applicable law and by our Data Processing Addendum.

17. Data Processing Addendum

If you are using the Service as an organization and the Company processes personal data on your behalf, the SiteDNA Data Processing Addendum is incorporated into and forms part of our Terms of Use, and governs that processing. Where the DPA conflicts with this Privacy Policy in relation to Customer Content, the DPA controls.

18. Updates to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address associated with your account and by posting the updated policy on our website with a revised effective date.

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you should discontinue use of the Service.

19. Contact Information

{/* Raw HTML block: markdown syntax is NOT processed inside it, so bold and links must be real tags. Keep this block free of blank lines, or the remainder gets parsed as markdown and wrapped in a stray

. */}

Hypha Dynamics Inc. 5900 Balcones Drive # 30345 Austin, Texas 78731 United States
Privacy requests and questions: privacy@sitedna.ai Legal: legal@sitedna.ai Billing: finance@sitedna.ai