Privacy Policy

Suds (“Suds,” “we,” “us”), operated by Suds Software LLC, provides booking and customer-management software for auto-service businesses at getsuds.com and app.getsuds.com. This policy explains what information we collect, how we use it, and the choices you have.

Two kinds of people use Suds, and this policy covers both:

• Business users (subscribers): owners and workers of the businesses that run on Suds. For their information, Suds decides how data is used as described here.
• Customers of those businesses: people who book, text, call, or pay a business that uses Suds. We process this information on behalf of that business, which is responsible for its own customer relationships and its own privacy notices. If you are a customer, your first stop for privacy requests is the business you booked with, but you can always contact us directly (see Your privacy rights below) and we will help.

• Contact details: name, phone number, email address, and service address you provide when booking, signing up, or communicating with a business that uses Suds.
• Appointment & service information: vehicles, services requested, quotes, scheduling, job photos, signatures on service documents, notes, and history.
• Payment information: processed by our payment provider (Whop); we receive transaction details (amount, status, last four digits) but never store full card numbers.
• Communications: text messages, chat messages, emails, and phone calls (including recordings and AI-generated transcripts and summaries; see the calls section below) between customers and businesses on Suds.
• Usage & device data: pages visited, referring URLs and ad-click identifiers, IP address, browser and device type, and the cookies described below.
• Location information: service addresses, and a worker’s live location while en route to a job when they choose to share it (see Location information below).
• Voice samples: if a business owner records a voice sample to enable Suds Voice, we use it to create a synthetic voice with their consent (see AI features below).
• Connected-service data: if a business links Ring cameras, Google Business Profile, bank accounts via Plaid, payroll, accounting, or ad accounts, we receive the data described in the dedicated sections below.

Suds uses AI to help businesses respond faster and stay organized. We believe you have a right to know where AI is involved:

• AI-assisted text replies. When you text a business that uses Suds, some replies may be generated by an automated AI assistant acting on that business’s behalf (for example, answering pricing questions or offering appointment times). The business supervises these conversations, sets the prices and policies the assistant can offer, and can take over at any time. You can always ask for a person and a human will follow up.
• Call transcription & summaries. Recorded calls may be transcribed and summarized by AI so the business can review them (see the calls section below).
• Business assistant. Subscribers can ask an in-app AI assistant questions about their own business data. Actions that change data require explicit human confirmation.
• Document & photo analysis. AI may extract details from receipts, job photos, and similar files a business uploads.
• Generated content. Businesses can create AI-generated marketing images and, with Suds Voice, appointment-reminder voice memos synthesized from a voice sample the business owner recorded and consented to clone. Synthetic voice memos are only used for that business’s own customer reminders.

How AI handles your data. AI processing runs through enterprise APIs of our AI providers (listed in How we share information below) under terms that prohibit them from training their models on your content. We do not use your personal information or message content to train foundation AI models. We do use aggregated, de-identified patterns (for example, which reply styles lead to bookings) to improve how the features work.

AI can be wrong. AI outputs (quotes drafted by the assistant, transcripts, summaries) can contain errors, and businesses are responsible for reviewing them. A confirmed booking, invoice, or payment is always authoritative over anything an AI assistant said.

We keep our own cookie footprint small. On our sites you will encounter:

You can clear or block cookies in your browser settings; essential cookies are required for signing in.

What we do. Suds includes first-party marketing attribution: when you land on a booking page from an ad or link, we record the click identifiers and UTM parameters in the URL against the random sv_id cookie, so the business can see which campaigns actually produce bookings. We also use Vercel Analytics, a privacy-respecting analytics service that does not track you across other sites.

Text-us links. When you tap a business’s “text us” short link, we record the tap with your device and browser type (including in-app browsers like Instagram), coarse location, and the referring page, keyed to an anonymous identifier that rotates daily. We deliberately store no raw IP address. This shows the business which of its links work and is never used for advertising or shared across businesses.

What businesses may add. A business using Suds can place its own advertising and analytics tags (Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel) on its booking pages, and can connect its ad accounts so that conversion events (for example, “a booking happened,” which may include hashed contact details) are reported back to Meta, Google, or TikTok to measure and improve that business’s ads. Under some state privacy laws this counts as “sharing” personal information for cross-context behavioral advertising, and you have the right to opt out.

How to opt out. We honor the Global Privacy Control (GPC) browser signal: when your browser sends it, our pages do not load third-party advertising tags for you. You can also opt out for your account or booking by emailing support@getsuds.com with the subject “Do not share.” We do not sell personal information for money, and we do not use it for advertising unrelated to the business you interacted with.

• Schedule, confirm, and manage appointments and services.
• Send service-related calls and text messages you have consented to.
• Process payments, deposits, invoices, and receipts.
• Power the AI features described above, with the limits described there.
• Measure marketing performance for the business you interacted with.
• Provide support, secure the platform, and prevent fraud and abuse.
• Comply with legal obligations.

When you provide a payment method to a business using Suds, the business’s payment processor collects and securely stores the card credentials. Suds and the business do not receive or store the full card number; we receive limited details such as the card brand, expiration date, last four digits, payment status, and transaction identifiers.

If the business verifies a card, transaction records may show an exact $1 charge and immediate $1 refund. A saved payment method can be used only as described in the Customer cards on file terms. Contact the business you booked with to replace or remove a saved payment method or question a charge.

We share personal information only as described here, with the service providers (sub-processors) that help us run Suds, each limited by contract to using it to provide services for us:

Beyond service providers: we share with the business you booked with (your appointment is their record too); with ad platforms only as described in the advertising section above; and when required by law, in which case we require valid legal process and notify you where permitted. If Suds is ever involved in a merger or acquisition, this policy would continue to apply to your data. We never sell your personal information for money.

When you provide your mobile number and opt in, a business using Suds may text you about appointments and services. Texts may be sent using automated technology, and some replies may be AI-assisted (see AI features above). Message and data rates may apply; frequency varies. Reply STOP to opt out or HELP for help. Consent to receive texts is never a condition of purchasing any service. See our SMS Terms & Conditions.

Two kinds of messages, one opt-out: service messages (confirmations, reminders, updates, review requests about your own appointments) and, only if the business enables them and you’ve opted in, occasional marketing messages (like a re-engagement offer). Replying STOP always stops both.

We do not sell your information. Mobile opt-in data and SMS consent are never shared with third parties or affiliates for their own marketing purposes.

Carrier registration (business users). To register a business’s texting with U.S. carriers (A2P messaging), we submit the business details it provides (legal business name, EIN, address, and a contact) to Twilio and the carrier registration system. This is required by carriers before a business can text its customers, and the information is used for no other purpose.

Calls placed to or received from a business using Suds may be recorded for quality, training, and dispute-resolution purposes. In most cases a brief spoken notice plays at the start of the call; where a business has turned that notice off (as some one-party-consent states allow), this policy and the business’s own privacy policy serve as the disclosure. If you do not wish to be recorded, please tell the business or use text or email instead. Recordings may be transcribed and summarized by AI so the business can review calls and follow up accurately. Recordings, transcripts, and summaries are stored securely, shared only with the service providers that help us operate, and never sold or used for advertising.

If you connect Ring cameras through Suds Live Shop, we access the following from the Ring account you link, solely to power the feature:

• Live video: streamed on demand (when you tap “Watch live”) and shown in your dashboard.
• Device status & details: online/offline state, device name and ID, to list and label your cameras.
• Event history: motion / person / vehicle / doorbell events with timestamps, to build the camera timeline.
• Recorded clips: fetched on demand only when you play a timeline event (recorded clips require a Ring Protect subscription).
• Authorization tokens: stored securely on our servers to call the Ring API on your behalf.

We do not store Ring video recordings: live video and clips are streamed and proxied for viewing only. We do not request or use your Ring devices’ location data. We do not use Ring video or data to train any AI or machine-learning models, and we do not derive biometric (e.g., facial recognition), health, or precise-location insights from it.

Your Ring video and events are visible only to your own authorized users within your Suds account; Suds staff do not view your Ring video. We never sell this data or share it for advertising. To operate the feature we rely on Ring/Amazon’s camera APIs and our hosting/infrastructure provider as sub-processors; see our data-flow overview for how this works.

You stay in control: connect or disconnect at any time from the Live Shop page. Disconnecting immediately deletes the stored authorization tokens and the imported cameras.

Google Calendar (workers). A worker can connect their personal Google Calendar so their busy times block scheduling. We request only free/busy visibility (we see when a worker is busy, never event titles, details, attendees, or locations), plus the authorization tokens needed to check it. Disconnecting from the worker’s profile deletes the stored tokens immediately.

Google Business Profile. If you connect your Google Business Profile through Suds (Reviews → Settings), we access the following from the Google account you authorize, solely to power review routing:

• Your business locations: the accounts and locations on the connected profile (business name and address), so you can choose which location each review request points to.
• Your “write a review” link: each location’s Google review URL, so a happy customer is sent to the right Google listing to leave a review.
• Reviews on your business profiles: the public reviewer name or anonymous status, rating, comment, dates, and your public reply. We use 1–3 star reviews to open a customer-care ticket, suggest a likely completed job, and help managers coordinate follow-up with confirmed assigned workers. Google does not provide the reviewer’s email address or phone number.
• Authorization tokens: stored securely on our servers so we can call the Google Business Profile API on your behalf.

We use this only to manage review routing and private service-quality follow-up. A manager must confirm the matching job before Suds links the customer or shares the allegation-framed ticket with assigned workers. We do not post, edit, or delete anything on your Google Business Profile, we do not read Google Business messages, and we do not use this data to train any AI or machine-learning models. We never sell it or share it for advertising.

Suds’s use and transfer of information received from Google APIs, including Business Profile and Calendar free/busy data) adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use it only to provide the features described here, never for advertising, and never let humans read it except with your permission, for security, or as required by law.

You stay in control and can disconnect at any time: Google Business Profile from Reviews → Settings, Google Calendar from the worker’s profile. Disconnecting immediately deletes the stored authorization tokens and imported data.

Businesses using Suds can connect their bank accounts and cards to track income and expenses. We use Plaid Inc. to link financial accounts. When you connect an account:

• Your bank credentials go directly to Plaid: Suds never sees, receives, or stores your online banking username or password.
• What we receive: account details (institution, account name, type, last four digits), balances, and transaction history (date, amount, merchant, category), used solely to power your own profit & loss dashboard.
• Access tokens are encrypted at rest on our servers and are readable only by our systems.

Your financial data is visible only to your own authorized users within your Suds account. We do not use it to train AI or machine-learning models, we never sell it, and we never share it for advertising or marketing. When you connect an account through Plaid, Plaid’s End User Privacy Policy, which describes how Plaid processes your data.

You stay in control: disconnect at any time from the Profit & Loss page. Disconnecting revokes access with Plaid and deletes the stored tokens, connected accounts, and any imported transactions you haven’t categorized into your books.

If you choose to migrate data from another product into Suds, you provide the sign-in details or authorization we need to access your account with that product. We use those details only to perform the migration you requested, transmit and store them encrypted, never use them for any other purpose, and delete them as soon as reasonably practicable after the migration finishes, fails, or is cancelled, in accordance with our internal security and retention policies. Data we import at your direction (which may include your customers’ personal information) is handled as described in the customer-data section of this policy: we process it on your behalf as your service provider / processor. You are responsible for having the right to move that data into Suds.

Migrated data can include your communications history from the previous product: text threads, call recordings, and voicemails (with their transcripts). Once imported, we protect that history exactly like communications made on Suds (see Phone calls, recording & AI transcription); the business remains responsible for that history having been lawfully collected on the previous product, including under call-recording consent laws.

• Service addresses: we geocode the addresses customers provide so businesses can plan routes and show arrival maps (including a Street View image of the service address on the job page).
• Worker live location: while a worker is en route to a job and has chosen to share it, their phone periodically sends its GPS position so the customer’s tracking page can show an honest ETA. Sharing stops when the job starts or the worker turns it off. We do not track workers in the background outside of en-route sharing.
• No ad-tech location. We do not sell location data or use it for advertising.

If you work for a business that uses Suds, your employer’s account holds your profile (name, contact details, role, permissions), schedule and time-clock punches, job assignments and performance stats, pay and payout records (processed with our payroll provider if your employer enables payroll), messages on team chat, and the en-route location sharing described above. Your employer controls this data; privacy requests about it should start with your employer, and we support them in honoring those requests.

We protect data with encryption in transit (TLS) and at rest, access tokens and secrets stored server-side only, tenant isolation between businesses, least-privilege access for our systems and staff, and audit logging of sensitive actions. No system is perfectly secure; if a breach affecting personal data occurs, we will notify affected users without undue delay, and within 72 hours where required by law.

To keep public booking and lead forms usable by real customers, we also collect basic abuse-prevention signals on those pages (things like whether a real person is typing and interacting, automation markers, and IP-based rate limits that can temporarily block abusive addresses. These signals are used solely to prevent bots, spam, and fraud, and never for advertising or profiling.

We extend these rights to everyone, regardless of where you live:

• Know & access: ask what personal information we hold about you and receive a copy in a portable format.
• Correct: fix inaccurate information.
• Delete: have your information deleted (see Account & data deletion below).
• Opt out of targeted advertising / “sharing”: via the Global Privacy Control signal (honored automatically) or by emailing us.
• Opt out of texts: reply STOP at any time.
• Opt out of marketing emails: use the unsubscribe option where provided, or email us (or the business that messaged you) and we’ll stop them. Service emails about your own appointments and account continue.
• No discrimination: exercising these rights never affects your service.

To exercise any right, email support@getsuds.com. We verify requests using the email or phone number on file, respond within 45 days, and allow an authorized agent to act for you with written permission. If we decline a request, you may appeal by replying to our decision, and we will have a different reviewer respond; residents of California, Colorado, Connecticut, Oregon, Texas, Virginia, and other states with privacy laws may also contact their state attorney general. Where a feature involves data some laws treat as sensitive (like the voice sample a business owner records for Suds Voice), we collect it only with explicit consent and use it only for that feature; we never use your data for biometric identification.

• Business accounts: in the app: My Account → Info → Delete account (30-day grace period, cancellable, auto-renew stops immediately). Or email support@getsuds.com from your account email with the subject “Delete my account.” Either way we delete or de-identify the account’s data within 30 days (legal-hold records excepted). Ask us for a data export first if you need one. Deletion is permanent.
• Customers of a business: ask the business you booked with (they can fully erase your record, including message history, from their dashboard), or email us and we will coordinate the deletion.
• Connected services: disconnecting Ring, Google, Plaid, or an ad account immediately deletes its stored tokens and imported data, as described in each section above.

See Support → Account & data deletion for step-by-step instructions.

Suds can be installed from the browser as an app, and we may offer builds through the Apple App Store and Google Play. For those store listings, the categories we declare mirror this policy:

• Data linked to you: contact info (name, email, phone), financial info (transactions, never full card numbers), location (service addresses; en-route worker location), user content (messages, photos, documents), identifiers (account ID), purchase history, and usage data.
• Data used to track you: none by the Suds app itself. If a business’s booking page inside the app would load third-party advertising tags, we ask permission first through Apple’s App Tracking Transparency prompt, and those tags stay off unless you allow them.
• Account deletion: available in-app and by email, as described above, per Apple and Google requirements.

Our services are for adults booking auto services and businesses running their shops. They are not directed to children under 13, and we do not knowingly collect information from children under 13. If you believe a child provided us information, email us and we will delete it.

Suds is operated from the United States and our servers are located there. If you use Suds from outside the U.S., your information is transferred to and processed in the U.S. Where required, we honor applicable data-protection rights (including access, correction, deletion, and objection) as described in Your privacy rights above, and we protect transfers from the EEA, UK, and Switzerland with appropriate safeguards such as standard contractual clauses.

We may update this policy and will revise the date above when we do. For material changes, we notify subscribers by email or in-app notice before the change takes effect.

Suds Software LLC · support@getsuds.com. See also our Accessibility Statement, Terms of Service, SMS Terms, and Support.