Privacy Policy

01Introduction

This Privacy Policy explains how Santos Lab, LLC, a Florida limited liability company doing business as HomeWay ("HomeWay," "we," "us," or "our"), collects, uses, and protects information when you use the HomeWay mobile application and website at www.homewayapp.com (together, the "Service").

HomeWay is a platform for managing private residential estates. It is used by property owners, estate and house managers, household staff, and service providers. By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

02Who controls your data

Estates are set up by an account holder (the owner or estate manager). For data that staff and service providers enter about an estate, the account holder is the controller and HomeWay acts as a processor on their behalf. For account, billing, and Service-operation data, HomeWay is the controller. If you are staff or a service provider, some requests about your data may need to go through your estate's account holder.

03Information we collect

a. Information you provide

• Account & profile: name, email, phone, photo, role, and (for staff) position and pay rate. Accounts are created by invitation.
• Estate operations data you enter into the app, which may include: work hours, service requests, calendar events and notices, vendor and contractor records, quotes and expenses, vehicle/appliance/system/furniture records, inventory and pantry items, package logs, pet records, documents, and related notes and photos.
• Payment information: when an account holder subscribes at app.homewayapp.com, all payments are processed by our payment processor, Stripe, Inc. Card details are entered directly with Stripe. We do not receive or store full card numbers on our servers; we receive limited details such as the card's last four digits and subscription status. See Stripe's privacy policy.
• Support communications you send us.
• Demo scheduling: if you schedule a demo on our website, our scheduling provider, Calendly LLC, collects the name, email address, and meeting details you provide in order to book and manage the meeting. See Calendly's privacy policy.

b. Information collected automatically

• Location: with your permission, we use your device location at the moment you clock in or out to confirm you are on the property (geofencing). We record the location associated with that time entry. We do not track your location in the background or when the feature is not in use.
• Camera & photos: with your permission, to scan barcodes (pantry, packages), capture receipts and documents, and add photos to requests, logs, and assets.
• Device & usage data: app version, device type and OS, IP address, and diagnostic and crash information, to keep the Service working.
• Push notification token: to send you notifications you've enabled.

c. Our website

Our marketing website at www.homewayapp.com uses Google Analytics, a service provided by Google LLC, to measure traffic. It records pages viewed, the site that referred you, an approximate region derived from your IP address, and your browser and device type, and it sets a first-party cookie so we can tell one visit from another. Google Analytics 4 does not log or store IP addresses.

Google Analytics runs on the front end of our website only, and we use the data it collects solely for marketing purposes — to understand which pages help people decide about HomeWay. The HomeWay app contains no analytics, advertising, or tracking software of any kind, and no estate information is ever sent to Google. We have disabled Google's advertising features, including Google Signals, remarketing, and advertising personalization, so this data is not used to build advertising profiles.

d. Children

We do not knowingly collect data from children. The Service is for adults managing or working at a residence and is not directed to children under 13.

04How we use information

We use information to: provide and operate the Service; authenticate you and enforce role- and permission-based access; record work hours and verify on-property clock-ins; send notifications you enable; process subscriptions and payments; provide support; maintain security and prevent fraud; comply with legal obligations; and improve the Service. We process this data to perform our contract with you, for our legitimate interests in operating the Service, with your consent (for permissions like location and camera), and to meet legal obligations.

Information collected through our website is used only for marketing purposes — measuring traffic and improving the pages that explain the Service. Information you and your estate enter in the app is used only to provide and operate the Service for that estate.

We do not sell your personal information. We do not share it for advertising, we do not rent or trade it, we do not disclose it to data brokers, and we do not use it to train machine-learning models. We do not use estate information for any purpose of our own beyond running the Service.

These are permanent commitments, not a description of current practice. See Our privacy commitments.

05How information is shared

• Within your estate: data is visible to other members of the same estate according to the access levels the estate manager sets. Spend totals and certain records are restricted to managers.
• Service providers (subprocessors) who help us run the Service, under contract, including: Supabase (database, authentication, file storage, hosting), Stripe (payments), Vercel (website hosting), Expo (app delivery and push notifications), and Calendly (demo scheduling on our website). A current list is available on request.
• Website analytics: Google LLC receives website usage data from our marketing website, as described in Information we collect. Google receives no data from the app and no estate information.
• Legal & safety: when required by law, or to protect rights, safety, and security.
• Business transfers: if HomeWay or Santos Lab, LLC is ever acquired, merged, reorganized, or sells all or substantially all of its assets, personal information may be transferred as part of that transaction — but only on the following terms. Before any personal information is transferred, the acquiring party must agree in a signed written contract, and must execute a non-disclosure agreement, to be bound by the commitments in this Policy, including the commitment never to sell personal information. We will not complete a transfer on any other basis, and we will give notice of a change of control that affects your information. See Our privacy commitments.

06Our privacy commitments

The commitments in this section are the reason HomeWay is built the way it is. They are binding on us, and they are intended to be permanent.

• We will never sell your personal information. We do not sell, rent, trade, or otherwise disclose personal information for money or other valuable consideration, and we do not share it for cross-context behavioral advertising. This applies to every category of information described in this Policy, including all estate information.
• Estate information stays private. Information entered in the app is used only to provide and operate the Service for the estate that entered it. We do not mine it, publish it, license it, use it to train machine-learning models, or use it to build products for anyone else. Access is limited to that estate's own members, at the levels the account holder sets, and to the small number of our personnel who need it to support or secure the Service.
• Website analytics are for marketing only. The only information we collect for our own commercial purposes is website traffic data from www.homewayapp.com, collected through Google Analytics on the front end of our website and used solely to improve our marketing pages, and the contact details you choose to share with us when you schedule a demo. No analytics, advertising, or tracking software runs inside the app.
• These commitments survive a change of ownership. If Santos Lab, LLC is acquired, or if HomeWay or its assets are sold, we will require the acquiring company to agree in a signed written contract, and to execute a non-disclosure agreement, to honor the commitments in this Policy — including the commitment never to sell personal information — before it receives any personal information. An acquirer unwilling to sign does not receive the data.
• We will not weaken these commitments retroactively. If we ever change this section, the change will apply only to information collected afterward, we will describe it plainly under Changes to this Policy, and we will give notice in the app or by email before it takes effect.

07Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, and accounting obligations. When an estate or account is deleted, we delete or de-identify its data within 30 days, except where retention is legally required.

08Your choices and rights

• In-app controls: update your profile, manage notification preferences, and control camera/location/notification permissions in your device settings.
• Account deletion: you can request deletion of your account and associated personal data from within the app (Settings → Delete account) or by emailing us at the address in Contact us.
• Access, correction, deletion, portability, objection: depending on your location (for example, CCPA/CPRA in California), you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to withdraw consent. To exercise these, contact us; we will respond as required by law. Staff and service-provider requests may be routed through the estate account holder where they are the controller.
• Do Not Sell/Share: we do not sell or share personal information as defined by California law, and we never have. There is no opt-out request to submit, because there is nothing to opt out of — but you are welcome to hold us to that statement.
• Website analytics: you can opt out of Google Analytics on our website by installing Google's browser opt-out add-on or by blocking analytics cookies in your browser. Opting out has no effect on the app, which contains no analytics.

09Security

We use industry-standard measures to protect your data, including encryption in transit and at rest, role- and permission-based access enforced at the database level, and access controls for our team. No system is perfectly secure, but we work to protect your information and will notify you and regulators of a breach where required by law.

10Where data is processed

The Service is offered in the United States and is not available in the European Economic Area or the United Kingdom. We and our subprocessors process data in the United States.

11Changes to this Policy

We may update this Policy. We will post the new version with a revised "Last updated" date and, for material changes, notify you in the app or by email. Continued use after changes means you accept the updated Policy. Changes will never reduce the commitments in Our privacy commitments for information we have already collected.

12Contact us