Privacy Notice

INTRODUCTION

This Privacy Notice (“Notice”) applies to personal information collected by Northwest Clear (“Northwest Clear,” “we,” “us,” or “our”), in connection with your use of our website located at northwest-clear.com (“Website”) and our customer and vendor portal (“Platform”) (collectively, the “Services”). The Services are intended for use by property owners and property managers who access the Services to find, schedule, and engage service providers to perform backflow assembly testing services (“Customers”) and by independent, Washington State-certified backflow assembly testers who use our vendor portal to accept and complete jobs (“Vendors”). In this Notice, “you” and “your” refer to any individual who accesses, uses, or interacts with the Services. We are committed to protecting your privacy in compliance with all applicable laws and regulations.

This Notice is incorporated into and made part of the Northwest Clear Terms of Service and any other agreements between you and Northwest Clear which may be applicable to your use of the Services (collectively, “Agreements”). Please read the Agreements and this Notice carefully. It is your choice whether to provide personal information to us. If you choose to do so, you confirm your acceptance of this Notice and you give us your express consent to use, process, and disclose your personal information as set forth in this Notice through your use of our Services. If you choose not to provide your personal information to us, you may not be able to use or access our Services.

SCOPE OF THIS NOTICE

This Notice describes, generally, how we handle and process personal information relating to:

• your use of our Services; and
• individuals whose personal information we receive in providing or administering the Services.

This Notice does not cover personal information collected by third parties acting independently, such as a Vendor's own data practices or a water utility's own data collection.

Our collection, use and disclosure, and processing of personal information about individuals will vary depending upon the circumstances.

In the event of a conflict between this Notice and the Agreements, the terms of this Notice shall prevail.

CATEGORIES OF PERSONAL INFORMATION WE COLLECT

When you use the Services, we may collect the following categories of personal information from or about you to provide better services in connection with your use of the Services:

• Identifiers, such as your name, email address, phone number, postal or service property address, account name or username, internet protocol (“IP”) address, unique personal identifiers (such as a Stripe customer ID and internally generated account IDs), online identifiers , and Washington State Backflow Assembly Tester (“BAT”) certification number (Vendors only);
• Commercial information, such as booking history, test reports and compliance records associated with a property, annual testing due dates, rebooking history, and Vendor invoicing records;
• Internet or other electronic network activity information, such as pages visited, timestamps, referrer URLs, browser type, and device type collected through server logs, and — only where you provide consent — website interaction data collected through Google Analytics 4 (such as page views, session duration, and traffic source). We do not track your browsing activity on other websites or your interaction with advertisements;
• Geolocation data, limited to the property and business addresses you provide, which we convert (geocode) into approximate geographic coordinates in order to match Customers with nearby Vendors. We do not access device GPS, browser geolocation, or precise real-time location;
• Professional or employment-related information from Vendors, such as BAT certification number and expiration date, business name, service area and capacity, and job-completion history on the Platform; and
• Communications data, such as whether you opened an email we sent you or clicked a link within it, collected through our email delivery provider.

Payment card information is collected and processed exclusively by our payment processor, Stripe, Inc. We never receive, process, transmit, or store raw payment card data.

CATEGORIES OF SOURCES OF PERSONAL INFORMATION WE MAY COLLECT

We collect personal information from the following categories of sources:

• You, the individual to whom the personal information relates. Most personal information is provided directly by you.
• Service providers acting on our behalf, such as our payment processor (Stripe), our website analytics provider (Google Analytics 4, only with your consent), our email delivery provider (Twilio SendGrid), and our geocoding provider, which generate or return information such as a Stripe customer ID, analytics data, email delivery and engagement data, and geographic coordinates derived from addresses you provide.
• Government entities and public records, such as Washington State BAT certification records used to verify Vendor certification status, and publicly available business and utility directories used for outbound business development.
• Your device, browser, and operating system, which automatically transmit technical information (such as IP address, browser type, device type, operating system, and referrer URL) when you visit the Website.

We do not obtain personal information from affiliates, advertising networks, internet service providers, third-party data analytics providers (other than Google Analytics as described above), social media networks, or data brokers.

Information Collected by Cookies and Other Tracking Technologies: When you visit the Website, we and our service providers use the following technologies to automatically collect information:

• Essential cookies: We set cookies necessary for the Website to function, including cookies for session management, authentication state, security (CSRF protection), and storing your cookie-consent preference. If you decline these, you may not be able to sign in or use some interactive features of the Services.
• Google Analytics 4: If you select “Allow analytics” on our cookie-consent banner, we load Google Analytics 4 (via the gtag.js library), which collects your IP address, browser type, device type, operating system, pages visited, session duration, referrer URL, and traffic source.
• Server logs: We collect log information such as your IP address, pages visited, timestamps, and browser type for security, debugging, and operational purposes.

A cookie is a small text file that is stored on a user’s computer for record keeping purposes. Cookies can be either session cookies or persistent cookies. A session cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time.

HOW WE USE INFORMATION WE COLLECT

While the purposes for which we may process your personal information will vary depending upon the circumstances, in general, we use personal information for the non-exhaustive purposes set forth below:

• To respond to and support your use of the Services and to improve the functionality, performance, and user experience;
• To help ensure the security and integrity of the Services, including protecting against unauthorized access, detecting and preventing abuse and fraud, and enforcing rate limits;
• To debug, identify, and repair errors that impair the intended functionality of the Services;
• To verify and maintain the quality and safety of the Services, including monitoring service quality, tracking completion rates, and investigating and resolving complaints and disputes;
• To generate and process Vendor invoices for monthly processing fees through our payment processor;
• To verify that Vendors hold current Washington State BAT certification and to display certification credentials on Vendor profiles;
• To send you marketing and promotional communications about our own Services, subject to your right to opt out;
• To conduct internal research and analytics using aggregated and de-identified data to understand usage patterns and to plan improvements and expansion of our Vendor network and Services;
• To comply with applicable legal requirements, including responding to lawful requests by public authorities and meeting law enforcement requirements; and
• To enforce the Agreements and to investigate possible violations of applicable law.

HOW WE DISCLOSE PERSONAL INFORMATION

The specific circumstances under which we disclose your personal information will vary based on the information you provide and your use of the Services. We do not “sell” your personal information, and we do not “share” your personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable United States privacy laws. We do not engage in profiling. We disclose or make available personal information to third parties only as necessary to provide, operate, and support our Services, as described below.

We disclose personal information to the following categories of recipients:

Certified Testers (independent contractors): When a Vendor accepts a booking, we share the Customer's name, email address, phone number, service property address, and booking details with that Vendor so the Vendor can contact the Customer, locate the property, and complete the test. Vendors receive information only for bookings they have accepted.

Payment Processors: We share a Vendor's name, email address, user ID, and monthly transaction amounts to create billing accounts and process payments. We do not transmit or store raw payment card data.

Email Delivery Providers: We share recipient names and email addresses to deliver transactional and operational emails, such as booking confirmations, job notifications, compliance reminders, and authentication links.

Analytics Providers: With your consent, Google Analytics 4 receives website usage data as described in this Notice. We also use Google Workspace to process business email correspondence. We have not enabled Google advertising features or data sharing for advertising purposes.

Render (hosting and database) and Cloudflare (DNS, content delivery, and security): Our application, database, and network traffic are hosted and routed through these infrastructure providers, which process data solely to provide hosting, security, and related infrastructure services.

Mailmeteor (outbound email campaigns): We process the names and email addresses of prospective Customers and Vendors, sourced from publicly available directories, to send business-development and recruitment emails.

Our geocoding provider: We transmit street addresses you provide in order to convert them into geographic coordinates for dispatch matching.

Legal and regulatory authorities: We may disclose any category of personal information as required by subpoena, court order, or regulatory inquiry, or to protect the rights, property, or safety of Northwest Clear, our users, or the public.

We do not disclose personal information to advertising networks, data brokers, social media networks, or affiliates.

We may also disclose any of your personal information for the following legitimate business circumstances:

• for legal reasons (e.g., to prevent crime or fraud, or to comply with a court order or legislation);
• to enforce our Agreements;
• when you provide us with your consent to share your information with third parties; and
• in connection with, or during negotiations of, a substantial corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

We attempt to notify our users about legal demands for their personal information when appropriate in our judgment unless prohibited by law or court order or when the request requires expedited attention. We may dispute such demands when we believe, at our discretion, that the requests are overbroad, vague or lack proper authority.

AGGREGATE AND DE-IDENTIFIED DATA

We may deidentify personal information and create anonymous and aggregated data sets and reports in order to monitor, secure, assess, improve, and develop our Services and our business. When we deidentify personal information, we implement reasonable measures as required by law to ensure that the deidentified data cannot be associated with any individual. We maintain and use such data only in a deidentified manner and do not attempt to reidentify it, except as permitted by law. We do not sell, share, or disclose de-identified or aggregated data to third parties.

To the extent required by law, if we disclose deidentified data to any other party, we will require them to: (a) take reasonable measures to ensure that the deidentified data cannot be associated with any individual, (b) publicly commit to maintain and use the deidentified data only in a deidentified form, and not attempt to reidentify the data; and (c) contractually obligate any further recipients of the deidentified data to comply with these same requirements.

OUR RETENTION OF YOUR PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected. Retention periods vary depending on the category of data and the category of individual, as described below.

Customers:

Account and contact information (name, email, phone, address) is retained for the duration of the service relationship plus three (3) years following the last completed booking or platform interaction; test reports and compliance records are retained for seven (7) years from the date of the test to support ongoing compliance recordkeeping and potential verification by water utilities; and booking and scheduling history is retained for three (3) years following the conclusion of the service relationship.

Vendors:

Account and profile information (name, business name, contact details, BAT certification number, service area) is retained for the duration of the active vendor relationship and is removed from the active Platform within thirty (30) days following account closure; transaction, invoicing, and uploaded test-report records are retained for seven (7) years for tax and accounting purposes.

Website visitors (non-account holders):

Server logs are retained for approximately 30–90 days; Google Analytics data is retained according to Google's default GA4 retention setting; and cookie-consent preferences are retained until you clear your browser data.

When personal information is no longer needed for any business, legal, or regulatory purpose, we securely delete or anonymize it. We may retain certain records longer where needed to meet regulatory requirements, conduct audits, comply with our legal obligations (including law enforcement requests), resolve disputes, maintain security, prevent fraud and abuse, or enforce our Agreements.

We periodically review retained information and remove or securely archive information that is no longer necessary.

You may request deletion of your data from the Service at any time. The specific manner and channels for submitting these deletion requests are detailed in the “CONTACT US” and “RESPONSE TIMING AND FORMAT” sections below. Following deletion, only a minimal record necessary to document that the account existed and was active may be retained.

YOUR PRIVACY RIGHTS

Northwest Clear is committed to your right to privacy and you have certain rights concerning your personal information. If you wish to exercise any of the rights listed below, please do so by following the instructions in the “CONTACT US” and “RESPONSE TIMING AND FORMAT” sections below. Only you, or a person registered or authorized to act on your behalf, may make a verifiable request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

• The right to confirm whether we are processing your personal information and to access your personal information.
• The right to request that we provide you with the personal information we have collected about you in the last twelve (12) months in a portable, machine-readable format, to the extent technically feasible.
• The right to know:
  • The categories of personal information we collected about you and the categories of sources from which we collected such personal information;
  • The specific pieces of personal information we collected about you;
  • The categories of personal information about you that we shared (if applicable) and the categories of third parties with whom we shared such personal information;
  • The business or commercial purpose for collecting or sharing (if applicable) personal information about you; and
  • The categories of personal information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such personal information (if applicable);
• The right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of your personal information.
• The right to delete personal information provided by, or obtained about, you.
• If the personal information is available in a digital format, the right to obtain a copy of your personal information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another controller without hindrance.
• The right to opt-out of the processing of your personal information for purposes of:
  • targeted advertising;
  • the sharing or selling of your personal information; and
  • profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you; or
• The right to opt-in or opt-out of the processing of your sensitive personal information as that term is defined by applicable privacy laws.
• The right to limit certain uses and disclosures of your sensitive personal information. You may have the right to request that we limit certain uses and disclosures of sensitive personal information, to the extent we collect it or use it in ways that reasonable consumers would not expect;
• The right to non-discrimination for exercising your privacy rights.
• The right to appeal a refusal to take action on a request within a reasonable period of time after your receipt of our decision on any right you’ve exercised herein.

Because Northwest Clear does not sell or share personal information, does not engage in targeted advertising or cross-context behavioral advertising, and does not use personal information for profiling, certain of the opt-out rights described above may not apply to our current processing activities. The specific rights available to you, and whether they apply, depend on the laws of the state or jurisdiction in which you reside.

THIRD PARTY LINKS

The Services may contain links to web pages operated by parties other than Northwest Clear, including water utility websites, utility backflow-program pages, test-report submission portals, and our payment processor's privacy policy. We do not control such websites and are not responsible for their contents or the privacy policies or other practices of such websites. Our inclusion of links to such websites does not imply any endorsement of the material on such websites or any association with their operators. Further, it is up to you to take precautions to ensure that whatever links you select or software you download (whether from the Northwest Clear website or other websites) is free of such items as viruses, worms, trojan horses, defects, and other items of a destructive nature. These websites and services may have their own privacy policies, which you will be subject to upon linking to the third party’s website. Northwest Clear strongly recommends that you review the third party’s terms and policies.

INTERNATIONAL TRANSFERS

We are based in the United States and store personal information on servers located in the United States, including with our hosting provider, Render. Our Services are intended for users located in the United States, and we do not intentionally transfer personal information across national borders. Some of our service providers (such as Cloudflare and Google) operate global networks that may route or process limited technical data through servers outside the United States for load-balancing, content-delivery, redundancy, or security purposes, although our primary data storage remains in the United States.

To the extent personal information is transferred from the United States, we will implement appropriate safeguards as required by applicable law.

HOW WE PROTECT PERSONAL INFORMATION

Northwest Clear maintains administrative, technical, and physical safeguards designed to protect your personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account technological reality, cost, the scope, context and purposes of processing weighted against the severity and likelihood that the processing could threaten individual rights and freedoms. For example, we use commercially reasonable security measures such as encryption of data in transit and at rest; role-based access control; logging, alerting, and audit trails; multi-factor authentication (MFA) for all Service access; and regular internal security reviews. However, Northwest Clear cannot guarantee the security of user account or other personal information. Unauthorized entry or use, hardware or software failure, and other factors, could compromise the security of user information at any time.

CHILDREN’S PRIVACY

We do not knowingly collect personal information from children under the age of 18. If you become aware that a child has provided us with personal information, please contact us using the contact details provided at the end of this Notice. If we become aware that a child under the age of 18 has provided us with personal information, we will take steps to delete such information.

RESPONSE TIMING AND FORMAT

We will acknowledge receipt of a verifiable deletion or other similar request within 30 days, authenticate it using processes required by law, then process and respond to your request as required by law. If we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response electronically. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

CHANGES TO OUR PRIVACY NOTICE

We reserve the right to amend or change this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on our website, inform you of the change by email, and update the Notice’s effective date. Your continued use of the Services following the posting of changes constitutes your consent to and acceptance of such changes.

CONTACT US

If you have any specific questions about this Notice or any privacy-related concerns, you can contact us by email at:

That's The All, LLC d/b/a Northwest Clear

privacy@northwest-clear.com