Privacy Policy

Welcome to HomeIndex ("we," "our," or "us"), a product of Covala, Inc. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the HomeIndex application and website at homeindex.co (collectively, the "Service").

By accessing or using HomeIndex, you agree to the terms of this Privacy Policy. If you do not agree with the practices described here, please do not use the Service.

We use the information we collect to:

• Provide, operate, and maintain the HomeIndex Service, including product catalog search, inventory management, maintenance tracking, and insurance export features
• Personalize your experience, such as providing relevant product suggestions and maintenance reminders
• Power AI-assisted features, including the HomeIndex assistant, to help you manage your inventory more effectively
• Process your transactions and manage your account
• Communicate with you about the Service, including updates, security alerts, and support messages
• Analyze usage patterns to improve the Service, fix bugs, and develop new features
• Detect, prevent, and address technical issues, fraud, or security concerns
• Comply with legal obligations

We take the security of your data seriously and implement industry-standard measures to protect it.

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Your data is stored in encrypted databases. We use Supabase for our database and authentication infrastructure, which provides AES-256 encryption at rest.
• Access controls: Access to user data is restricted to authorized personnel on a need-to-know basis. We enforce row-level security policies on all database tables.
• Infrastructure security: Our application is hosted on Vercel, which maintains SOC 2 Type II compliance and provides enterprise-grade infrastructure security.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we commit to promptly notifying affected users in the event of a data breach as required by applicable law.

We do not sell your personal information or inventory data to third parties. We do not share your data with advertisers or data brokers.

We may share limited information with the following categories of recipients:

• Service providers: We work with third-party companies that help us operate the Service, including Supabase (database and authentication), Vercel (hosting and deployment), and analytics providers. These providers access your data only to perform services on our behalf and are contractually obligated to protect it.
• Legal requirements: We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Covala, Inc., our users, or the public.
• Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.
• With your consent: We may share your information with other parties when you explicitly direct us to do so, such as when you export your inventory for an insurance claim.

We use cookies and similar technologies to operate and improve the Service:

• Essential cookies: Required for the Service to function, including authentication tokens and session management. These cannot be disabled.
• Analytics cookies: Help us understand how users interact with the Service so we can improve it. We use privacy-respecting analytics that do not track you across other websites.
• Preference cookies: Remember your settings and preferences, such as your preferred display options.

We do not use third-party advertising cookies or tracking pixels. You can control cookies through your browser settings, but disabling essential cookies may prevent you from using certain features of the Service.

You have the following rights regarding your personal information and inventory data:

• Access: You can access all of your inventory data and account information at any time through the Service.
• Export: You can export your complete inventory data in standard formats (PDF, CSV) at any time. Your data belongs to you.
• Correction: You can update or correct any of your personal information or inventory data directly within the Service.
• Deletion: You can delete individual inventory items at any time. You may also request complete deletion of your account and all associated data by contacting us at privacy@homeindex.co. We will process deletion requests within 30 days.
• Portability: You have the right to receive your data in a structured, commonly-used, machine-readable format.
• Withdraw consent: Where we rely on consent to process your data, you may withdraw that consent at any time.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to opt out of the sale of personal information (we do not sell your data), and the right to non-discrimination for exercising your privacy rights.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including the rights described above and the right to lodge a complaint with your local data protection authority.

HomeIndex is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@homeindex.co.

We retain your account information and inventory data for as long as your account is active or as needed to provide you with the Service.

If you delete your account, we will delete your personal information and inventory data within 30 days, except where we are required to retain certain information for legal, tax, or regulatory purposes. Anonymized and aggregated data that cannot be used to identify you may be retained indefinitely to improve the Service.

Usage logs and analytics data are retained for up to 24 months and then automatically deleted or anonymized.

HomeIndex is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

By using the Service, you consent to the transfer of your information to the United States. We take appropriate safeguards to ensure that your data is treated securely and in accordance with this Privacy Policy, regardless of where it is processed.

We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or applicable laws. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email or displaying a notice within the Service.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@homeindex.co
• General support: support@homeindex.co
• Entity: Covala, Inc.

We will respond to all privacy-related inquiries within 30 days.