Privacy Policy

NailWhale holds two kinds of personal information, and our responsibility is different for each.

• Your account information - the name, work email and role of the people at your company who log in. We decide what to collect here and why, so we are the controller of it.
• Your customers’ information - the homeowners in your jobs: names, addresses, phone numbers, photographs of their property, and the financial records of their project. You decided to collect that; we only hold and process it on your instruction, so we are the processor and you are the controller.

The practical consequence: if a homeowner asks us to delete their information, we cannot simply act - it is your record, not ours. We will pass the request to you and help you carry it out. Our obligations as a processor are set out in the Data Processing Addendum.

The page you are reading is a set of static files. It has no accounts, no database, no forms and no server-side code. It sets no cookies and does not track you across other sites.

We do measure page views through Vercel Web Analytics, which is cookie-free and does not build a profile of you or follow you off this site. If you want none of it, a content blocker or the browser’s Do Not Track setting is enough - nothing here depends on it.

• Account data: name, email address, role and company, plus a password held only as a cryptographic hash - we cannot read it and cannot tell you what it is.
• The data you enter: jobs, clients, tasks, notes, proposals, payment schedules, invoices, recorded payments, and uploaded files and photographs.
• Activity records: who changed a job stage, who recorded a payment, when an invite was sent. This exists so that "who did this and when" is answerable, which is a feature of the product rather than surveillance of your staff.
• Technical logs from our hosting provider: IP address, request URL and timestamp, kept for a short period for security and debugging.
• Billing contact details held by Stripe. Card numbers go directly to Stripe and never reach our systems.

We use it to run the service for you: to show you your jobs, to send the notifications you asked for, to produce your documents, to bill you, and to support you when something goes wrong.

We do not:

• Sell personal information, and we do not share it for cross-context behavioural advertising.
• Use your customers’ personal information for our own marketing.
• Train AI models on your data, or permit our providers to do so.
• Read your data casually. Staff access to a customer workspace happens for support or investigation, on request or on need, and it is logged.

We use a small number of providers to run the service. Each one is bound by a contract that limits them to processing data on our instructions.

The AI drafting feature is worth calling out specifically: when someone on your team asks NailWhale to draft proposal text, the job details in that request are sent to Anthropic to produce the draft. They do not use it to train models. If you would rather that never happen, tell us and we will disable the feature for your workspace.

• Every record carries the company that owns it, and access rules are enforced by the database itself rather than by application code remembering to filter - so one customer reaching another customer’s data is prevented at the layer that stores it.
• Data is encrypted in transit, and encrypted at rest by our hosting and database providers.
• Uploaded files live in private storage; they are never publicly addressable, and links to them are short-lived and scoped to the person requesting them.
• Production data is separated from development and testing environments, which contain no real customer data.
• Access to production systems is limited to the people who need it to operate the service.

No system is perfectly secure. If a breach affects your data, we will tell you without undue delay and with enough detail to act on - what happened, what was affected, and what we are doing about it.

While your subscription is active, we keep your data so the service works - a job from three years ago is still your record. After your account ends we keep it for 30 days so you can request an export, then delete it from live systems. It ages out of encrypted backups on our providers’ ordinary retention cycle after that.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to some processing. You can exercise any of it by emailing hello@nailwhale.com. We do not charge for it, and we will not treat you differently for asking.

If your request concerns information held inside a contractor’s workspace - for example you are a homeowner whose project is recorded in it - we will forward your request to that contractor, who is the controller of it, and support them in responding.

NailWhale is business software. It is not directed at children and we do not knowingly collect information from anyone under 16.

If we change this policy in a way that materially affects you, we will notify you at the email address on your account before it takes effect. The effective date at the top always reflects the current version.