Privacy Policy

1. Introduction and Overview

HomeInspectionX ("Company", "we", "us", or "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you access or use our software-as-a-service platform, website, mobile applications, and related services (collectively, the "Services").

This Privacy Policy applies to all users of our Services, including home inspectors, inspection firms, their staff and team members, and any individual whose personal information we process in connection with our Services. We process personal data in compliance with applicable data protection laws, including:

The General Data Protection Regulation (GDPR) and UK GDPR for users in the European Union and United Kingdom
The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents
The Personal Information Protection and Electronic Documents Act (PIPEDA) for users in Canada
Other applicable provincial, state, and national privacy legislation

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices as described herein, please do not use the Services.

We reserve the right to update this Privacy Policy periodically. Material changes will be communicated through the Services, via email, or by posting a prominent notice on our website. The "Last Updated" date at the top of this policy indicates when the most recent changes were made.

2. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set forth below:

"Personal Data" or "Personal Information" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, email address, phone number, location data, or online identifier.
"User" or "you" means any individual who accesses or uses our Services, including registered home inspectors, firm administrators, team members, and other authorized personnel.
"Client Data" means personal information about homeowners, property buyers, real estate agents, or other individuals that Users collect, process, and store using our Services in connection with home inspection activities.
"Data Controller" means the entity that determines the purposes and means of processing personal data. HomeInspectionX acts as a Data Controller for data we collect directly. Users act as Data Controllers for Client Data they process through our platform.
"Data Processor" means the entity that processes personal data on behalf of a Data Controller. HomeInspectionX acts as a Data Processor for Client Data that Users process through our Services.
"Cookies" means small text files placed on your device when you visit our website or use our Services.
"IP Address" means a unique numerical address assigned to your device when connected to the internet.

3. Information We Collect

3.1 Information You Provide Directly

When you register for and use our Services, we collect personal information that you voluntarily provide, including:

Category	Examples	Purpose
Account Information	Full name, email address, phone number, username, password	Account creation, authentication, and communication
Business Information	Company/firm name, business address, license numbers, certifications, EIN/tax ID	Service provision, verification, and compliance
Billing Information	Credit/debit card details, billing address, bank account information, VAT/tax numbers	Payment processing and invoicing
Profile Information	Professional photo, bio, areas of expertise, service regions, languages spoken	Profile creation and client-facing features
Communication Data	Emails, chat messages, support tickets, feedback, survey responses	Customer support and service improvement
User-Generated Content	Inspection reports, photos, videos, notes, comments uploaded to the platform	Service functionality and data storage

3.2 Information Collected Automatically

When you access and use our Services, we automatically collect certain information about your device and usage patterns through cookies, log files, and similar technologies:

Category	Examples	Purpose
Device Information	Device type, operating system, browser type and version, unique device identifiers	Compatibility, security, and troubleshooting
Log Data	IP address, access times, pages viewed, features used, clicks, session duration	Analytics, security monitoring, and service improvement
Location Data	Approximate geographic location derived from IP address	Regional service configuration and compliance
Usage Data	Feature utilization, report generation metrics, storage consumption, API calls	Service optimization, billing, and capacity planning
Error Reports	Crash logs, error messages, performance diagnostics	Bug fixing and platform stability

3.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Payment processors (Paddle) regarding transaction status, subscription state, and payment history
Publicly available sources such as professional licensing databases and business registries

We combine this information with data we collect directly to provide, maintain, and improve our Services.

3.4 Client Data Processed on Your Behalf

When you use our Services to conduct home inspections, you may upload, store, and process personal information about your clients (homeowners, buyers, real estate agents, etc.). This Client Data may include:

Names, addresses, phone numbers, and email addresses of property owners and occupants
Property addresses and characteristics
Photos and videos of properties that may contain personal belongings or identifying features
Real estate agent contact information
Transaction-related information

Important: For this Client Data, HomeInspectionX acts as a Data Processor and you (the inspector or inspection firm) act as the Data Controller. You are responsible for ensuring that you have obtained all necessary consents and have a lawful basis for processing this Client Data, as required by applicable data protection laws.

4. How We Use Your Information

We process your personal data for the following lawful purposes and bases:

4.1 To Provide and Maintain Our Services

We use your information to deliver the core functionality of our platform, including:

Creating and managing your account
Authenticating your identity and securing your access
Enabling report creation, storage, and delivery features
Processing payments and managing subscriptions
Providing customer and technical support
Sending service-related notifications (security alerts, billing reminders, system updates)

Lawful Basis: Performance of a contract (Article 6(1)(b) GDPR) / Legitimate interests (Article 6(1)(f) GDPR)

4.2 To Improve and Develop Our Services

We use aggregated and anonymized data to:

Analyze usage patterns and feature adoption
Identify bugs, errors, and performance issues
Develop new features, products, and integrations
Conduct research and analytics to improve user experience
Train and improve our machine learning models (using only anonymized data)

Lawful Basis: Legitimate interests (Article 6(1)(f) GDPR)

4.3 To Communicate with You

We may use your contact information to:

Respond to your inquiries and support requests
Send administrative messages about your account
Deliver marketing communications, newsletters, and promotional offers (with your consent, where required)
Conduct surveys and request feedback
Notify you of changes to our Services or policies

Lawful Basis: Performance of a contract / Legitimate interests / Consent (for marketing communications where required by law)

4.4 To Ensure Security and Prevent Fraud

We process your information to:

Monitor for suspicious activity and unauthorized access
Verify your identity and professional credentials
Detect, prevent, and address fraud, abuse, and security incidents
Enforce our Terms of Service and Acceptable Use Policy
Comply with legal obligations related to cybersecurity

Lawful Basis: Legitimate interests / Legal obligation (Article 6(1)(c) GDPR)

4.5 To Comply with Legal Obligations

We may process your personal data as necessary to:

Comply with applicable laws, regulations, and court orders
Respond to lawful requests from public authorities
Establish, exercise, or defend legal claims
Maintain records for tax, accounting, and audit purposes
Cooperate with law enforcement investigations

Lawful Basis: Legal obligation (Article 6(1)(c) GDPR)

5. Cookies and Similar Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website or use our Services. They help us recognize your device, remember your preferences, and understand how you interact with our platform. We also use similar technologies such as web beacons, pixel tags, and local storage.

5.2 Types of Cookies We Use

Category	Purpose	Duration
Strictly Necessary	Essential for the operation of the Services; enable core functionality such as authentication, security, and session management	Session / Persistent
Functional	Remember your preferences and settings (language, region, display options) to enhance your experience	Persistent (up to 1 year)
Analytics	Help us understand how visitors interact with our Services by collecting and reporting information anonymously	Persistent (up to 2 years)
Performance	Monitor and improve the performance and speed of our Services	Session / Persistent
Marketing	Track visitors across websites to deliver relevant advertisements and measure campaign effectiveness	Persistent (up to 1 year)

5.3 Third-Party Cookies

We do not currently use third-party analytics, advertising, or tracking cookies. Our payment processor (Paddle) and email provider (Resend) may set strictly necessary cookies on their own domains when handling checkout or transactional email flows; these are governed by their respective privacy policies.

If we introduce additional third-party cookies in the future, we will update this section, display a consent banner where required by applicable law, and provide a way to manage your preferences.

We do not use a cookie consent banner because we do not set analytics, marketing, or other non-essential cookies on our domain. The only cookies we use are strictly necessary for the operation of the Services (for example, the session cookie that keeps you signed in).

If you still wish to inspect or remove cookies, your browser's settings allow you to view, block, or delete them. Removing the strictly necessary session cookie will sign you out of the Services.

We do not sell your personal data to third parties. We may share your information in the following circumstances:

6.1 Service Providers and Processors

We engage trusted third-party companies and individuals to perform functions on our behalf, including:

Service Provider Category	Examples	Purpose
Cloud Infrastructure	Google Cloud, IONOS	Data hosting, computing, and platform services
File Storage	Cloudflare R2	Storage of uploaded photos, inspection reports, and generated documents
Error Monitoring	Sentry	Crash reports, error diagnostics, and performance monitoring (anonymized where possible)
Payment Processing	Paddle	Subscription billing, checkout, and payment handling
Email Delivery	Resend	Transactional emails (receipts, report delivery, account notifications)

All service providers are contractually obligated to process personal data only for specified purposes, maintain appropriate security measures, and comply with applicable data protection laws. We do not authorize them to use or disclose your personal data for their own purposes.

6.2 Business Transfers

If HomeInspectionX is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal data, and any choices you may have regarding your information.

6.3 Legal Requirements and Protection

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government request). We may also disclose your information to:

Protect our rights, property, or safety, or the rights, property, or safety of our users or others
Detect, prevent, or address fraud, security, or technical issues
Enforce our Terms of Service and other contractual rights
Comply with legal obligations or respond to legal process

We may share your personal data with third parties when you have given us your explicit consent to do so. You may withdraw your consent at any time.

6.5 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data with third parties for research, analytics, marketing, or other purposes. This data cannot reasonably be used to identify you.

7. Data Security

7.1 Security Measures

We implement and maintain appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (or higher)
Encryption at rest: Sensitive data stored in our databases is encrypted using industry-standard AES-256 encryption
Access controls: Role-based access controls (RBAC) restrict data access to authorized personnel only
Authentication: Secure password storage using modern hashing algorithms
Network security: Firewalls, intrusion detection systems, and regular vulnerability scanning
Secure development: Regular code reviews, security testing, and dependency monitoring
Employee training: Regular privacy and security awareness training for all staff

7.2 Security Incident Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law
Notify affected users without undue delay when required by applicable law
Take immediate steps to contain the breach, assess its impact, and prevent further unauthorized access
Document the breach and our response measures

7.3 No Guarantee of Absolute Security

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to take steps to protect your account, including using strong, unique passwords.

8. Data Retention

8.1 Retention Principles

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Providing our Services to you
Complying with legal, tax, and accounting obligations
Resolving disputes and enforcing our agreements
Maintaining business records

8.2 Retention Periods

Data Category	Retention Period	Rationale
Account information	Duration of account + 3 years after closure	Contract performance, legal obligations, dispute resolution
Billing and payment records	7 years after transaction	Tax and accounting compliance
Usage and log data	12 months	Security, troubleshooting, and analytics
Communication records	3 years	Customer support and legal compliance
User-generated content (inspection reports)	As specified by your account settings or until account closure + 30 days	Service functionality; users may export data before closure
Marketing preferences and consents	Until withdrawal of consent + 3 years	Proof of consent and regulatory compliance
Deleted account data	Up to 90 days after deletion (in secure backups)	Backup retention and disaster recovery

After the applicable retention period expires, we will securely delete or anonymize your personal data in accordance with our data retention policies.

8.3 Early Deletion Requests

You may request earlier deletion of your personal data in accordance with your rights under Section 10. We will comply with such requests unless we are required or permitted by law to retain the data.

9. International Data Transfers

9.1 Global Operations

HomeInspectionX operates globally, with servers and personnel located in the United States, Canada, the United Kingdom, and the European Union. Your personal data may be transferred to, stored at, or processed in countries other than the country in which you reside.

9.2 Transfer Safeguards

When we transfer personal data outside of the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data protection laws, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs): We use EU Commission-approved Standard Contractual Clauses for transfers of personal data to countries not deemed adequate by the European Commission.
UK Addendum: For transfers from the UK, we implement the UK Addendum to the EU Standard Contractual Clauses.
Adequacy Decisions: We rely on adequacy decisions adopted by the European Commission and UK government where applicable (e.g., transfers to Canada under PIPEDA for certain organizations).
Binding Corporate Rules: Where applicable, we implement Binding Corporate Rules for intra-group transfers.

9.3 Transfers to the United States

For personal data transferred to the United States, we comply with applicable legal frameworks. We monitor regulatory developments regarding international data transfers, including adequacy decisions and cross-border transfer mechanisms, and will update our practices accordingly.

10. Your Data Protection Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

If you are located in the European Union or United Kingdom, you have the following rights:

Right	Description	How to Exercise
Right of Access	Request a copy of the personal data we hold about you	Email [email protected]
Right to Rectification	Request correction of inaccurate or incomplete data	Update via account settings or email us
Right to Erasure ("Right to be Forgotten")	Request deletion of your personal data	Email [email protected]
Right to Restrict Processing	Request limitation on how we process your data	Email [email protected]
Right to Data Portability	Request your data in a structured, machine-readable format	Email [email protected]
Right to Object	Object to processing based on legitimate interests or direct marketing	Email [email protected] or use unsubscribe links
Right to Withdraw Consent	Withdraw consent at any time where processing is based on consent	Email [email protected]
Right to Lodge a Complaint	File a complaint with a supervisory authority	Contact your local data protection authority

10.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights:

Right	Description
Right to Know	Request disclosure of the categories and specific pieces of personal information we have collected about you
Right to Delete	Request deletion of your personal information, subject to certain exceptions
Right to Correct	Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing	Opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising
Right to Limit Use of Sensitive Personal Information	Limit the use and disclosure of sensitive personal information
Right to Non-Discrimination	Exercise your privacy rights without fear of discriminatory treatment

10.3 Rights Under PIPEDA (Canadian Users)

If you are in Canada, you have the right to:

Access your personal information held by us
Challenge the accuracy and completeness of your information
Have inaccurate information amended
File a complaint with the Office of the Privacy Commissioner of Canada

10.4 How to Exercise Your Rights

To exercise any of your data protection rights, please contact us at:

HomeInspectionX

Email: [email protected]

Support: [email protected]

Website: https://www.homeinspectionx.com

We will respond to your request within the timeframe required by applicable law (generally within 30 days for GDPR requests and 45 days for CCPA requests). We may need to verify your identity before processing your request to protect your privacy and security.

10.5 Authorized Agents

You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly with you.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18, and we do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected], and we will take steps to delete such information.

If we become aware that we have inadvertently collected personal data from a child under 18, we will delete that information as quickly as possible.

12. Data Protection Officer and Contact Information

12.1 Data Protection Officer (DPO)

HomeInspectionX has appointed a Data Protection Officer responsible for overseeing our data protection strategy and ensuring compliance with applicable privacy laws.

DPO: Angel Luis Barros Pazos
Email: [email protected]

12.2 EU Representative

For users in the European Union, we have appointed an EU representative to ensure compliance with GDPR:

[EU Representative Name and Address]

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or our Services. When we make material changes, we will:

Post the updated policy on our website with a revised "Last Updated" date
Notify you via email or through the Services
Obtain renewed consent where required by applicable law

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: