This policy explains what personal information SprinklerBook (operated by Harper AI, Inc.) collects, why, and the choices you have. It is written to meet California’s privacy laws (CCPA/CPRA and CalOPPA); if you are a California resident you have specific rights described below.
Information we collect
- Account information: the email addresses of the account owner and technicians on the account, and the license numbers you attach to inspectors so generated reports can carry them.
- Payment information: handled by Stripe. We receive transaction records (plan, dates, amounts) but never your card number.
- Your account book: the records you keep in the product about your own commercial customers — business names, site addresses, business contact details, and fire protection system inventory. This is business data you enter about your customers; we hold it solely to run the product for you.
- Inspection records and photos: the findings, reports, forms, tags, and photos your team creates in the product, stored per customer account.
- Analytics & cookies: usage data collected with PostHog (pages viewed, device and browser info, and interaction events). We use first-party cookies for sign-in sessions and analytics. We do not run third-party advertising trackers. Session recording is disabled inside the product application — your account book and inspection findings are never captured by session replay. On public marketing pages, session replay runs only if you accept it in the consent banner, and everything typed is masked before it leaves the browser; declining opts you out of analytics capture entirely. A Global Privacy Control (GPC) signal from your browser is honored as an automatic decline and overrides any earlier acceptance while it is present.
Your account book and findings are never sold, shared, or mined
The customer list, site records, and inspection findings you keep in SprinklerBook are your competitive business data. We do not sell them, we do not share them with anyone other than the service providers who host and operate the product for us (listed below), and we do not mine them — not to solicit your customers, not to build datasets, not to market to building owners, not for any purpose other than running the product for you. We do not sell or share any personal information, yours or your customers’, within the meaning of the CCPA/CPRA.
How we use information
- To provide the service: sign-in, report generation, the inspection calendar, support.
- To operate and improve the product (analytics, debugging, abuse prevention).
- To send transactional email (sign-in links, receipts, service notices). We do not send cold marketing email, and we never use the contact data in your account book to email anyone.
- To bill you, through Stripe.
Who we share it with
Service providers acting for us, under contract:
- Stripe — payment processing.
- Resend — transactional email delivery.
- PostHog — product analytics. No session recording inside the product application.
- Google Cloud — hosting, database, and file storage infrastructure.
We may also disclose information if required by law, or as part of a corporate transaction (with this policy continuing to apply, including the commitment above).
Retention, deletion & export
We keep your account data — account book, inspection records, and photos — for the life of your account and for 90 days after it closes, then delete it. Deletion is export-first: before the purge, and at any time while your data exists, you can export everything, regardless of whether your subscription is active. Your own record-retention duties under your state’s rules are yours; the export exists so you can meet them. Transaction records are retained as required for tax and accounting.
Your California privacy rights
You have the right to:
- Know what personal information we collect and how we use it.
- Delete the personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of.
- Not be discriminated against for exercising any of these rights.
To exercise any right, email privacy@sprinklerbook.com. We will verify the request against the email or records involved and respond within the statutory window. Residents of other states with comparable privacy laws may use the same channel.
Global Privacy Control & “Do Not Track”
Because we do not sell or share personal information, a Global Privacy Control (GPC) signal has no sale or sharing to opt out of — but we recognize the signal, and if our practices ever changed, we would honor it as a valid opt-out. There is no common standard for browser “Do Not Track” signals, so we do not respond to DNT.
Contact
Privacy questions: privacy@sprinklerbook.com. SprinklerBook is a product of Harper AI, Inc. · Not affiliated with any AHJ, state fire marshal, the NFPA, or Brycer/TCE.