This Privacy Policy explains how Devtech LLC ("Dumpster Rental HQ," "we," "us") collects, uses, shares and protects personal information in connection with the website dumpsterrentalhq.io, the web application at app.dumpsterrentalhq.io, the Dumpster Rental HQ mobile applications for iOS and Android (the "Apps"), the customer portal, APIs and related services (the "Service"). It applies to website visitors; to the businesses that use the Service and their staff ("Customers" and "Users"); and to the people whose information Customers enter into or collect through the Service, such as their own clients, contacts and drivers ("End Users").
Two roles. For website visitors and account holders, we decide how and why data is processed (we are the "controller" or "business"). For End User information that a Customer enters or collects through the Service — names, addresses, jobsites, orders, signatures, payments, messages, driver location — the Customer decides, and we process it on the Customer's instructions as a "processor" or "service provider" under our Data Processing Addendum. If you are an End User, the dumpster or hauling company you dealt with is responsible for your data; contact them first and we will assist. To exercise rights directly with us, see Section 10.
- Information we collect
- Mobile App permissions and data
- How we use information
- How we share information
- Text messaging (SMS) privacy
- Payments (Stripe)
- Google, Meta and other platforms
- Cookies and analytics
- Data retention
- Your rights and choices
- U.S. state privacy disclosures (CCPA/CPRA and others)
- EEA, UK and other international users (GDPR)
- Security
- Children
- Account and data deletion
- Changes
- Contact
1. Information we collect
Information you give us
- Account and contact information: name, email address, phone number, company name, business address, role, password (stored hashed), and — for platform administrators — two-factor authentication secrets.
- Business verification information for payments and messaging registration: legal business name, EIN, address, website, representative name, and the information Stripe or carriers require to open a connected account or register a messaging campaign.
- Customer Data: everything a Customer or its Users enter or generate in the Service, including End User names, addresses, phone numbers, email addresses, jobsite details and gate codes, orders, price lines, invoices, payment records, documents and electronic signatures, photos, notes, tags and settings.
- Communications: emails, support requests, form submissions, and the content of notifications the Service sends on a Customer's behalf.
Information collected automatically
- Usage and device data: IP address, browser and operating system, device identifiers, App version, pages and features used, timestamps, referring URLs, crash and error reports.
- Location data from the Apps as described in Section 2.
- Cookies and similar technologies as described in Section 8.
Information from third parties
- Sign-in providers (Google) provide your name, email address and profile image.
- Stripe provides payment status, last four digits, card brand and expiry, and connected-account status.
- Google Maps Platform provides address geocoding, imagery and routing results for addresses you enter.
- Integrations a Customer connects (GoHighLevel, Meta lead forms, webhooks) provide the data the Customer configures them to send.
2. Mobile App permissions and data
The Apps request the following device permissions. Each is optional at the operating-system level, but some features will not work without it.
| Permission | Why we ask | Details |
|---|---|---|
| Location (while in use and, if your company enables it, background) | Live truck map, route history, stop completion, geofenced clock-in/clock-out, ETAs | Collected only while a driver is clocked in, at the interval the Customer configures. Background location lets the map keep updating while the phone is in a mount with the App not in the foreground. A persistent notification (Android) or the system location indicator (iOS) shows when collection is active. Location history is stored with the Customer's account and is visible to the Customer's dispatchers and administrators. Drivers can stop collection by clocking out or revoking the permission; the Customer decides whether location is required for its drivers. |
| Camera and photo library | Delivery, pickup, dump-ticket and damage photos; container barcode scanning | Photos are attached to orders and stored with the Customer's account. We do not access photos other than those you take or select in the App. |
| Notifications | New stops, dispatch changes, messages | Push tokens are stored to deliver notifications; you can disable them in device settings. |
| Network and device identifiers | Sign-in, sync, crash reporting, fraud prevention | Standard app operation. |
We do not use location or other App data for advertising, and we do not sell it. Data collected by the Apps is handled as Customer Data under the Customer's instructions. The Apps do not collect contacts, calendars, health data or precise location when the driver is not clocked in. Our Google Play Data Safety and Apple App Privacy disclosures reflect this section.
3. How we use information
- To provide, operate, secure, maintain and support the Service — booking, pricing, dispatch, routing, driver tracking, billing, e-signature, notifications, reports.
- To register and process payments and messaging campaigns, verify businesses, and prevent fraud, abuse and security incidents.
- To communicate with account holders about the account, security, changes to the Service and support, and — with an opt-out — product news and offers.
- To send messages on a Customer's behalf to its End Users, as the Customer instructs.
- To analyze, improve and develop the Service, including through aggregated and de-identified data.
- To comply with legal obligations, enforce our terms, and protect rights, safety and property.
We do not sell personal information, we do not use Customer Data or End User data for targeted advertising, and we do not use Customer Data to train third-party artificial-intelligence models. Where we use AI-assisted features (for example, drafting a message), the Customer's data is processed only to return the result to the Customer.
4. How we share information
- Service providers (subprocessors) that process data for us under contract and only on our instructions: cloud hosting and database (Supabase, DigitalOcean — U.S. regions), payments (Stripe), mapping and routing (Google Maps Platform), messaging (Twilio and/or other SMS and voice carriers), transactional email (Resend or SMTP provider), push notifications (Apple, Google), error and performance monitoring, and customer-support tools. The current list is in the Data Processing Addendum.
- Integrations the Customer connects (GoHighLevel, QuickBooks/Xero export, Meta, webhooks, API clients) — under the Customer's instructions and the third party's terms.
- Partner haulers when a Customer sends them a stop (jobsite address, contact and instructions only).
- End Users see their own orders, invoices, documents and the Customer's business information in the portal.
- Legal and safety: to comply with law, subpoena or court order; to enforce our terms; to protect the rights, property or safety of us, our customers or the public.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, with notice to Customers and continued protection under this policy.
- With consent or at your direction.
Mobile phone numbers and SMS opt-in data are never shared with third parties or affiliates for their own marketing or promotional purposes (see Section 5).
5. Text messaging (SMS) privacy
When you provide a mobile number to us or to a Customer through the Service, it is used to send the messages you agreed to receive — for example, order confirmations, delivery and pickup notices, signature and payment links, reminders and, only with separate consent, marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use-case categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties. You can opt out at any time by replying STOP, and get help by replying HELP. Message and data rates may apply. Full program terms are in our SMS Terms.
6. Payments (Stripe)
Subscription payments to us and card payments from End Users to Customers are processed by Stripe. When you enter card details, they go directly to Stripe over an encrypted connection; we receive and store only a token, the card brand, last four digits and expiry, and transaction records. Customers who activate payments open a Stripe connected account, and we share the business and identity information Stripe requires for that account and for its "know your customer" and anti-fraud obligations. Stripe processes personal information under its own Privacy Policy as an independent controller for those purposes.
7. Google, Meta and other platforms
Google Maps Platform. Addresses and coordinates you enter are sent to Google to geocode, display maps and imagery, and compute routes. Google's Privacy Policy applies to that processing.
Google Sign-In and Google APIs. If you sign in with Google, we receive your name, email and profile image. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use it only to provide and improve the sign-in and account features you see, do not transfer it except to provide those features, to comply with law, or as part of a merger or acquisition with notice, and never use it for advertising or allow humans to read it except with your consent, for security, to comply with law, or in aggregated form.
Meta (Facebook / Instagram). If a Customer connects a Meta lead form, page or the Meta Pixel, we receive the lead or event data the Customer configures and process it as Customer Data under the Customer's instructions and Meta's Platform Terms. Customers may disconnect the integration at any time, and anyone may request deletion of data received through Meta using our Data Deletion instructions. Our website does not use the Meta Pixel unless disclosed in the Cookie Policy.
Apple and Google app stores. If you download the Apps, Apple or Google may collect information under their own policies; we receive aggregated download and crash statistics.
8. Cookies and analytics
The web application uses strictly necessary cookies and local storage for sign-in, security, session state and preferences. The marketing website may use first-party, privacy-respecting analytics to count visits; where required by law we ask for consent before setting non-essential cookies and honor your choice. We do not use cross-site advertising cookies on the Service. Because there is no common standard, we do not respond to browser "Do Not Track" signals, but we do honor Global Privacy Control signals as an opt-out of sale/sharing where that right applies. Details, including any third-party tags in use, are in the Cookie Policy.
9. Data retention
| Data | Retention |
|---|---|
| Account and Customer Data | For the life of the account; after closure or trial lapse, a 30-day grace period (extendable up to 90 days by our administrators at the Customer's request) for export or reactivation, then deletion from production systems. Encrypted backups roll off within a further 35 days. |
| Driver GPS history | For the life of the Customer's account, or shorter if the Customer configures a retention period; deleted with the account. |
| Financial and tax records (invoices, payments) | Up to 7 years where required by tax and accounting law, in a restricted archive. |
| SMS consent and opt-out records | At least 4 years after the last message, as required by TCPA record-keeping guidance; opt-out numbers are kept on a suppression list indefinitely so we do not message them again. |
| Logs, security and error data | Up to 12 months. |
| Support communications | Up to 3 years. |
We may keep information longer where required by law, to resolve disputes or enforce agreements, and we may keep de-identified data indefinitely.
10. Your rights and choices
Depending on where you live, you may have the right to know what personal information we hold about you, to access it, to correct it, to delete it, to receive a portable copy, to restrict or object to certain processing, to opt out of sale, sharing or targeted advertising (we do none), to limit use of sensitive personal information (we do not use it for anything other than providing the Service), and not to be discriminated against for exercising your rights. To exercise any right, email [email protected] or write to Devtech LLC, Attn: Legal, Medina County, Ohio, USA. We will verify your identity (typically by confirming control of the email or phone number on file) and respond within 45 days (extendable once by 45 days with notice) or the shorter period your law requires. You may use an authorized agent with written proof of authorization. If we deny a request you may appeal by replying to our decision; we will respond to the appeal within 45 days and tell you how to contact your state attorney general if you disagree.
If you are an End User, we will forward your request to the Customer that holds your data and assist them, because they decide how it is used. Account holders can also update information and export data from Settings, unsubscribe from marketing email with the link in any message, reply STOP to any text, disable push notifications and location in device settings, and delete their account as described in Section 15.
11. U.S. state privacy disclosures (CCPA/CPRA and others)
This section applies to residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with comprehensive privacy laws, as those laws apply to us. In the preceding 12 months we collected the categories of personal information listed below, for the purposes in Section 3, from the sources in Section 1, and disclosed them for a business purpose to the categories of recipients in Section 4.
| Category (Cal. Civ. Code § 1798.140) | Collected | Disclosed for a business purpose to |
|---|---|---|
| Identifiers (name, email, phone, address, IP, account ID) | Yes | Hosting, payments, messaging, email, support providers |
| Customer records (business contact and billing information) | Yes | Payments, hosting |
| Commercial information (orders, invoices, payment history) | Yes | Hosting, payments, integrations the Customer chooses |
| Internet or network activity | Yes | Hosting, analytics, monitoring |
| Geolocation data (driver location while clocked in) | Yes (Apps, if enabled by Customer) | Hosting, mapping |
| Audio/visual (photos taken in the Apps, signatures) | Yes | Hosting |
| Professional or employment information (role, employer) | Yes | Hosting |
| Inferences | No | — |
| Sensitive personal information (account credentials; precise geolocation of drivers; government ID / EIN for business verification) | Yes, limited to what is listed | Hosting, payments (Stripe) for verification only |
We do not sell personal information, do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide the Service and for security, which does not require a "limit use" option under the CPRA. Notice at collection: the categories, purposes and retention periods above are provided at or before the point of collection. California residents may request the information in Section 10 twice in a 12-month period free of charge. Nevada residents: we do not sell covered information as defined in NRS 603A.
12. EEA, UK and other international users (GDPR)
We are based in the United States and process data there and in the regions of our subprocessors. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performance of a contract (providing the Service to account holders); legitimate interests (security, fraud prevention, product improvement, business communications), balanced against your rights; consent (marketing, optional cookies, App permissions), which you may withdraw at any time; and legal obligation. For End User data we act as processor under the Data Processing Addendum, which includes the EU Standard Contractual Clauses and UK Addendum for international transfers. You have the rights in Section 10 and the right to lodge a complaint with your supervisory authority. Our contact for data protection matters is [email protected].
13. Security
Customer Data is isolated per company using database row-level security, encrypted in transit with TLS and at rest, backed up daily, and accessible to our staff only for support and operations under logged, role-limited access. Administrators can require two-factor authentication for their team; platform administrators must use it. We test and monitor for vulnerabilities and maintain an incident-response process. No method of transmission or storage is completely secure; if we learn of a breach of security affecting your personal information we will notify affected Customers without undue delay and as required by law, and assist them with notices to End Users.
14. Children
The Service is for businesses and adults. We do not knowingly collect personal information from children under 13, or under 16 where a higher age applies, and the Apps are not directed to children. If you believe a child has provided us information, contact [email protected] and we will delete it.
15. Account and data deletion
You can delete your account and associated data yourself: in the web application, Settings › Account › Delete account; in the Apps, Account › Delete account; or by emailing [email protected] from the address on file. Deletion of an individual User's login removes their profile and credentials immediately; Customer Data belongs to the Customer's account and is deleted when the account owner deletes the company account or requests deletion. Full instructions, including for data received through Meta or Google integrations, are on our Data Deletion page. Deletion follows the retention schedule in Section 9.
16. Changes
We will post updates here with a new effective date and, for material changes, notify account holders by email or in the Service before they take effect. Where consent is required for a new use, we will ask for it.
17. Contact
Devtech LLC · Devtech LLC, Attn: Legal, Medina County, Ohio, USA · [email protected] (privacy) · [email protected] (support)