Privacy Policy

Last updated: September 24, 2026

1. Who We Are and What This Covers

PeelBoard LLC ("PeelBoard," "we," "us," or "our") is a South Carolina company that provides shop management software for window tint, paint protection film, ceramic coating, detailing, vinyl wrap and flat-glass shops. Our address is 127 Bathurst Ln, Simpsonville, SC 29681, USA.

This Privacy Policy explains how we handle personal information in connection with:

• our marketing website at getpeelboard.com;
• our web app at app.getpeelboard.com and our iOS and Android apps;
• the shop websites, lead forms, proposals, booking pages, and payment pages we host on behalf of shops;
• the text messages and emails we send on a shop's behalf.

It covers two different groups of people: shop owners and their team members who use PeelBoard, and customers of those shops whose information passes through the platform. Where the answer differs for each, we say so.

Our Terms of Service and SMS Messaging Policy also apply.

2. Our Role: Controller for Accounts, Processor for Shop Data

Privacy law distinguishes between the party that decides why personal information is used and the party that only handles it for someone else. PeelBoard is in both positions, depending on the data:

• Controller (or "business") for account data. For information about shop owners and team members — your name, email, login, shop profile, subscription and billing metadata, support history, and how you use the app — we decide the purposes and are responsible to you directly.
• Processor (or "service provider") for shop-entered customer data. For the customer records, job history, photos, notes, quotes, invoices, messages, and form submissions a shop puts into PeelBoard, the shop is the controller. We hold and process that data on the shop's behalf, under its instructions and our Terms of Service, to deliver the Service. We do not use it for our own marketing and we do not sell it.

If you are a customer of a shop and want to see, correct, or delete your information, the shop is the right first stop. See Section 12.

3. Information We Collect

From shop owners and team members

• Account information: name, email address, phone number, password credentials (stored as salted hashes by our authentication provider, never in readable form), role, and team membership.
• Shop profile: shop name, logo, address, service area, business phone and email, hours, services offered, pricing, and website content you enter.
• Subscription and payment metadata: plan, status, billing period, invoices and receipts, the last four digits and brand of the card and its expiry, and processor identifiers and events. We never receive or store full card numbers, CVC codes, or bank credentials — those go directly to Stripe.
• Support and communications: emails, in-app messages, bug reports, and feedback you send us.
• Community activity: the posts, comments, likes, @mentions, photos, and guide videos you publish in the in-app Community feed, plus a record of which posts you have read, the reports you send us about other content, and the members you block. Your likes and your reads are shown by name to the other shops who can see that post — see Section 6.
• PeelBoard Supply orders: the order number, the email address used, the items, amounts, order status, and tracking information for supplies bought through the in-app store or the public store at getpeelboard.com/shop. Your name, shipping address and payment details are entered on Shopify's checkout, not collected by us — see Section 6.

Data a shop enters or receives about its customers

• Customer name, email address, phone number, and address (including a service address for mobile jobs);
• Vehicle or property details — year, make, model, color, VIN if entered, window counts and measurements;
• Lead, quote, proposal, appointment, job, and invoice records, including services, films or products, prices, discounts, taxes, deposits, and status history;
• Notes, checklists, signatures, accepted terms, documents, and photos the shop uploads;
• Electronic signatures: when a customer signs a proposal or document, the drawn signature, the name they type, the date and time of signing, their IP address, and their browser and device type, kept with a copy of what they signed so the shop has a record of the agreement;
• Records of payments taken through the shop's own processor — amount, date, tip, fees, and payment reference. Never card numbers.
• Records of the messages we sent on the shop's behalf — recipient, timestamp, content, delivery status, and opt-out status;
• Reviews and review requests, and referral records where the shop runs a referral program.

Shops choose what to collect. We do not require sensitive categories of information, and shops are contractually required not to enter data the product isn't built for — such as government ID numbers, health information, or card numbers in free-text fields.

Collected automatically

• Usage and diagnostic data: pages and features used, actions taken, timestamps, referring pages, IP address, browser and operating system, app version, device model, language and time zone, and error and crash logs.
• Device and push tokens: if you install our mobile app and enable notifications, the push token issued by Apple or Google so we can deliver notifications to that device.
• Cookies and first-party analytics on our marketing site and app — see Section 5.
• Security logs: sign-in events, IP addresses, and access records used to detect and investigate abuse.

4. How We Use Information

We use personal information to:

• create and operate accounts, authenticate users, and enforce team permissions;
• provide the Service — quotes, jobs, scheduling, invoices, inventory, reporting, hosted websites, and the messages a shop sends;
• process subscription billing, platform fees, and add-on purchases, and prevent payment fraud;
• send transactional and account communications — receipts, renewal and failure notices, security alerts, product updates, and our weekly business brief where enabled;
• provide support, investigate issues, and reproduce and fix bugs;
• secure the Service — detect, prevent, and respond to abuse, spam, fraud, and unauthorized access;
• measure and improve the product, understand which features are used, and prioritize work;
• produce aggregated, de-identified statistics and industry benchmarks (for example average close rates or typical job values across shops). These are built so they do not identify any shop or individual, and we may publish them;
• run the in-app "How you compare" benchmarks, which are on by default for every shop. Figures from a shop's completed work — its average ticket, and the film it uses per job, grouped by vehicle type — are folded into platform-wide medians and quartiles. Only those aggregates are ever shown: a figure appears only where at least three shops feed that grouping, and no shop's name, identity, or individual numbers are shown to any other shop. No customer information is used or shown. A shop can turn this off at any time on the Referrals page ("Share anonymous benchmarks"), which stops its figures being contributed and hides the comparison for it;
• market PeelBoard to shop owners and prospects (never to a shop's customers — see below), including our own email updates, which you can unsubscribe from;
• comply with law, tax and accounting obligations, and enforce our Terms and resolve disputes.

5. Cookies and Analytics

On our marketing website we use first-party cookies and local storage, plus a lightweight first-party analytics script, to remember preferences, measure traffic and referral sources, and understand which pages lead to signups. We may also enable Google Analytics and Google Ads conversion measurement on the marketing site; when those are active, Google sets its own cookies and processes that data under its own terms. In the app we use cookies and local storage that are strictly necessary for signing in, keeping you signed in, and remembering interface preferences.

On a shop's own website, a shop can add its own Google Analytics 4 measurement ID or Google Ads conversion ID in its website settings. When it does, Google's tag is loaded on that shop's site and Google sets its own cookies there under its own terms, at that shop's direction and for that shop's reporting — not for ours. If no ID is configured, no Google tag is loaded on the shop site.

You can block or delete cookies in your browser settings, though signing in will not work without the necessary ones. Because we do not use cookies for cross-site advertising, we do not respond to browser Do Not Track signals; where required, we honor the Global Privacy Control opt-out preference signal on our marketing site.

6. Who We Share Information With

We do not sell personal information. We share it only as described here.

With the shop you contacted

If you submit a form, accept a proposal, book an appointment, or pay an invoice on a PeelBoard-hosted page, that information goes to the shop whose page you used, so the shop can respond and do the work. What the shop does with it afterward is governed by the shop's own privacy practices.

Service providers (sub-processors)

We use a short list of vendors to run the product. Each one processes data only as needed for the service it provides, under contract, and may not use it for its own purposes:

• Supabase — database, authentication, and file storage (the primary store for account and shop data);
• Vercel — hosting and content delivery for our websites, app, and shop sites;
• Stripe — PeelBoard subscription billing, and card processing for shops that connect Stripe;
• Square — card processing for shops that connect Square;
• Twilio — sending and receiving SMS text messages;
• Resend — sending transactional and marketing email;
• OpenAI — drafting text for the optional AI writing features, and only when you ask for a draft (see below);
• Shopify — running the PeelBoard Supply store and its checkout, and processing the orders you place there;
• Cloudflare — hosting and transcoding the videos in Community guides (Cloudflare Stream), and bot protection on our sign-in, signup, and team-join screens (Cloudflare Turnstile);
• Google — Business Profile, Maps and Places data, review retrieval, and Firebase Cloud Messaging for Android push notifications; and Google Analytics and Google Ads conversion measurement on our marketing site when enabled;
• Apple — Apple Push Notification service for iOS notifications, and App Store purchase handling;
• Google Play — Play Billing purchase handling for Android;
• Quo — for the small number of shops that connected their own Quo phone number before we stopped offering that option, the customer's phone number and the message text so the shop can send from its own number;
• IndexNow (operated by Microsoft Bing and partner search engines) — when a shop changes its website we ping the search engines with the page addresses so the update is indexed. Public URLs only, no personal information;

We do not use any third-party analytics, crash-reporting, advertising, or attribution SDK inside our apps. Diagnostics and error logs go to our own Supabase database, not to an outside monitoring service.

Stripe and Square act as independent controllers of the payment data they collect, under their own privacy policies. Card details you enter on a payment page go to them, not to us.

AI-assisted writing (OpenAI)

The optional AI writing features draft text for you: the marketing email writer, the AI actions inside the email editor, and the "Write it for me" website copywriter. They are off unless you use them — nothing leaves PeelBoard for an AI provider until you press an AI button or type a prompt. The first time you use one we show a consent notice that names OpenAI and says what is sent, and you must accept it before anything is sent. You can withdraw that permission at any time from Settings → Shop → "AI writing help" (the shop owner or an Admin controls the switch), and once it is off our servers refuse the request outright rather than relying on the app to hide the button. Everything else in PeelBoard works the same whether you use them or not.

When you ask for a draft, we send the details the draft is built from to OpenAI (model gpt-4o, at api.openai.com) and receive the drafted text back:

• Email writer: your shop name, phone, address and service area, installer name, brand color, the services, films and brands you offer, your package names and starting prices, subject lines from your recent campaigns, and — when the draft includes reviews — the text of real customer reviews together with the reviewer's first name as it was published.
• Website copywriter: your shop's business details — name, service area, address, services offered, years in business and jobs completed, installer name and bio, your existing "about" text, films, brands and warranties, package names and starting prices, your review count and average, and short review excerpts.

We do not send your customer list, customer phone numbers or email addresses, job records, invoices, quotes, or photos to OpenAI. Under OpenAI's API terms, data sent through their API is not used to train their models; they process it to return the draft and retain it only for a limited period for abuse monitoring under their own policies.

A draft is a starting point, not finished work. The shop is responsible for reading and correcting a draft before sending it to customers or publishing it — including any price, claim, or review text it repeats. If you would rather review text or an installer's name were not sent, remove them from your shop profile or don't use the AI features.

Other PeelBoard shops (Community)

Community is a feed inside the app where PeelBoard shops talk to each other. Anything you post there can be seen by every other PeelBoard shop with Community access — it is not private to your shop. A post or comment shows your name, your shop's name, and your shop's logo, along with what you wrote and any photos or video you attached; @mentions and guides work the same way. Community is available to a shop owner and to any active team member of a shop that has Community switched on, whatever their role — installers included. It stays inside PeelBoard: there is no public or unauthenticated way to read it, it is never published to the open web, and it is never shown to your customers. It is not the place for customer records — please do not post a customer's name, phone number, address, or a readable license plate.

Likes and views carry names. Anyone who can see a post can open the counts under it and see which shops liked it and which shops have read it — your name and your shop's name, with the time. Opening a post in the feed is what records that you read it; there is nothing to press, and it happens whether or not you like or comment. This works in both directions: the shops whose posts you read can see you in their list, just as you can see who read yours. If you would rather not appear, do not open or like the post. The author of a post is not counted as a reader of their own post.

You can delete your own posts and comments, and you can block another member so their posts and comments are hidden from you. Deleted content may remain in caches and backups for a short period before it expires. We keep reports and moderation records — including removals and bans — after content is gone, so we can apply the rules consistently.

PeelBoard Supply orders

Shopify powers the PeelBoard Supply store and its checkout — both the storefront inside the app and the public store at getpeelboard.com/shop, where anyone can buy without a PeelBoard account. In the app, when you open checkout we pass your shop's email address, business phone number, the items in your cart, and an identifier for your shop so the order can be matched back to your account. A public buyer's cart carries no shop identifier.

You enter your name, shipping address and payment details on Shopify's hosted checkout page, not in PeelBoard, and we never see your card number. At that point Shopify's own privacy policy applies to the checkout, and Shopify — as the store's platform and payment processor — handles the payment, sales tax, and shipping. Products are supplied through Shopify Collective, so the supplying merchant who makes the product receives the order and the shipping address in order to ship it directly to you, and handles returns and refunds under its own policy and privacy practices.

When an order is placed, shipped, or refunded, Shopify notifies us and we store a copy of the order in PeelBoard, tied to the shop — order number, the email used, items, amounts, status, and tracking — so your order history is visible in the app. A purchase made on the public store is only tied to a PeelBoard account if the email used matches one.

Other disclosures

• Integrations you connect. If you connect an integration — for example Google Business Profile or a calendar feed — we exchange the data needed for that feature with that provider at your direction.
• Legal and safety. We may disclose information if we reasonably believe it is required by law, subpoena, court order, or other valid legal process, or where necessary to protect our rights, investigate fraud or abuse, enforce our Terms, or protect the safety of any person.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy with comparable protections. We will notify affected shops of a material change in control.
• With your direction or consent, for anything else.

7. Text Messages and Email

When a text or email goes to a shop's customer, the shop is the sender. PeelBoard provides the delivery infrastructure; the shop decides who is contacted and what is said, and is responsible for obtaining consent and following the applicable laws and carrier rules.

Depending on the shop's plan, a text is either sent for the shop by PeelBoard from our own phone numbers (Business plan, automatic texts) or written by PeelBoard and sent by the owner from their own phone, in which case the message goes through the owner's own carrier and its content and replies never pass through us. PeelBoard only sends texts to US and Canadian numbers and refuses any other number.

If you submit a form on a PeelBoard-hosted shop page and provide your phone number, the form discloses at the point of submission that you consent to receive text messages from that shop about your quote, appointment, and service. Message and data rates may apply. Message frequency varies.

Reply STOP to any message to opt out at any time, or HELP for assistance. Opt-outs are processed automatically and recorded against that phone number so the shop cannot text it again through PeelBoard. We keep a record of an opt-out even after other data is deleted, because we need it to keep honoring the opt-out. Full details are in our SMS Messaging Policy.

We do not sell or share phone numbers with third parties for marketing, and no mobile information is shared with third parties or affiliates for marketing or promotional purposes. We store delivery metadata (recipient, time, status, and content) so shops have a record of what was sent and so we can troubleshoot delivery.

Texts from PeelBoard to shop owners. Separately from the messages a shop sends its customers, PeelBoard texts shop owners directly from the PeelBoard number — a welcome text shortly after you start a trial, a short weekly "one thing" tip during your first few weeks, occasional platform messages from our founder, and account alerts — at the mobile number you gave us when you created the account, which is required at signup. Those are from us, not from your shop, and we send them because of your account relationship with us. Reply STOP to stop them, or email admin@getpeelboard.com and we will remove your number; replies go to PeelBoard staff, who read and answer them. Details are in our SMS Messaging Policy.

Separately, we send shop owners our own account and product emails. Marketing emails from us include an unsubscribe link; transactional emails about your account, billing, and security are part of the Service and cannot be unsubscribed from while your account is open.

8. Testimonials and Reviews of PeelBoard

We sometimes invite shop owners to review PeelBoard inside the app. Submitting a review is voluntary. A review is published only if you consent to publication, and we may publish it with your name, your shop's name, your city, and your logo on our website, in our apps, or in marketing materials. Some reviews are displayed anonymously in an aggregated feed if that is what you chose. You can withdraw consent at any time by emailing admin@getpeelboard.com, and we will stop new use and remove the published review within a reasonable time.

9. Data Retention

• While your account is active, we keep your account data and your shop's data so the Service works and your history stays intact.
• When you delete your account — from Settings → Shop → Delete account, or by asking us — the shop and its data are removed from the live Service. We retain a recoverable copy for up to 30 days in case the deletion was a mistake, then delete it permanently. See our Account Deletion page, including how to request deletion if you can no longer sign in.
• Customer records are retained as long as the associated shop account is active, or until the shop deletes them. We will action a verified customer deletion request within 30 days.
• Encrypted backups roll off on their own schedule, generally within 30 days, so deleted data may briefly persist in backups before expiring.
• We keep longer only what we must: billing and tax records for the period required by law, SMS opt-out records for as long as needed to honor the opt-out, security and audit logs for a limited period, and anything we must preserve for a legal claim or investigation.
• Aggregated, de-identified data may be retained indefinitely, because it no longer identifies anyone.

10. Security

We take security seriously and use measures appropriate to a product of our size, including:

• Encryption in transit (HTTPS/TLS on every connection) and encryption at rest for our database and file storage;
• Row-level isolation per shop — database policies enforce that each shop's records are reachable only by that shop's authorized users, not just in the interface but at the data layer, and we test that isolation as part of our development process;
• role-based permissions inside a shop, so owners control what administrators and installers can see, including whether a team member can see prices and money;
• credential hashing, scoped access keys, least-privilege service accounts, audit logging, and time-limited, visible support access;
• keeping payment card data entirely out of our systems, so it cannot be exposed by us.

No system is perfectly secure, and we cannot guarantee absolute security. Protect your own account: use a strong, unique password, do not share credentials, and remove team members promptly when they leave. If we become aware of a breach affecting your personal information, we will notify you and any affected shop as required by applicable law.

11. Your Choices and Rights

Depending on where you live, you may have the right to know what personal information we hold about you, to access a copy of it, to correct it, to delete it, to limit certain uses, and not to be discriminated against for exercising these rights.

• Shop owners and team members: you can view and edit most of your information in the app. You can export your shop's data while your account is active, and delete your account from Settings. For anything else, email admin@getpeelboard.com.
• Customers of a shop: contact the shop that holds your records. Because the shop controls that data, we act on the shop's instructions. If you cannot reach the shop or don't know who to ask, email us and we will help route your request and assist the shop in fulfilling it.
• Marketing: unsubscribe from our marketing emails using the link in any of them; reply STOP to opt out of texts.
• Push notifications: turn them off in your device settings or in the app.
• Benchmarks: switch "Share anonymous benchmarks" off on the Referrals page to stop contributing your figures to platform benchmarks.
• AI writing: turn it off in Settings → Shop → "AI writing help", and nothing further is sent to OpenAI.
• Community: taking part is optional. You can delete your own posts and comments, and a shop owner can have Community switched off for the shop by emailing us.

We respond to rights requests within 30 days (or within the period your local law requires), and we may need to verify your identity first — for example by confirming control of the email or phone number on the record. An authorized agent may submit a request with written proof of authorization. We may decline a request where an exception applies, and we will tell you why.

12. If You Are a Customer of a Shop

You most likely reached us because a tint, PPF, ceramic, detailing, wrap, or glass shop uses PeelBoard to run its business. In that relationship:

• the shop decides what to collect from you, why, how long to keep it, and whether to text or email you;
• PeelBoard stores and processes it for the shop and sends messages at the shop's direction;
• if you sign a proposal or document electronically, we record your drawn signature, the name you type, the date and time, your IP address, and your browser and device type, and keep them with a copy of what you signed for the shop;
• the shop's own privacy policy governs what it does with your information beyond our platform;
• requests about your data should go to the shop first. Email us at admin@getpeelboard.com and we will help identify and reach the right shop, and support it in honoring your request.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to access a copy in a portable format; to correct inaccurate information; to delete your personal information; and to limit the use and disclosure of sensitive personal information. You may not be discriminated against for exercising these rights.

The categories we collect are described in Section 3 and correspond to CCPA categories: identifiers; customer records; commercial information; internet and electronic network activity; geolocation only at the level of a service or business address; and inferences drawn for product analytics. Our purposes are in Section 4, the categories of recipients are in Section 6, and retention is in Section 9. We do not collect sensitive personal information for the purpose of inferring characteristics. Sources are: you, your shop, your interactions with our sites and apps, and our service providers.

Where a shop enters customer data, PeelBoard acts as that shop's service provider, and we handle consumer requests about that data with and through the shop. To exercise your rights with us, email admin@getpeelboard.com with "Privacy Request" in the subject line.

14. Other State Privacy Laws

Residents of other US states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana, among others — have similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale of personal information, or profiling that produces legal effects, so those opt-outs do not apply to our processing. To exercise any right, use the contact details in Section 18. If we deny a request and your state provides an appeal process, you may appeal by replying to our decision, and we will respond within the time your law allows.

15. Children's Privacy

PeelBoard is a business tool. It is not intended for anyone under 18, account holders must be at least 18 years old, and the Service is not directed to children. We do not knowingly collect personal information from children. If you believe a child's information has been submitted through our platform, contact us at admin@getpeelboard.com and we will delete it promptly.

16. Where Data Is Stored and International Transfers

PeelBoard is operated from the United States, and our infrastructure and sub-processors store and process data in the United States. Some providers may use support or delivery infrastructure in other countries. If you access the Service from outside the US, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. Where an applicable law requires a transfer safeguard, we rely on the mechanisms our providers offer, such as standard contractual clauses.

17. Changes to This Policy

We may update this Privacy Policy as the product and the law change. When we do, we will update the "Last updated" date at the top of this page, and for material changes we will notify shop owners by email and by an in-app notice. Continued use of PeelBoard after an update takes effect means you accept the updated policy.

18. Contact Us

For questions about this policy, your data, or a privacy request:

• PeelBoard LLC, 127 Bathurst Ln, Simpsonville, SC 29681, USA
• Email: admin@getpeelboard.com
• Website: getpeelboard.com