Privacy Policy

Account information. When you sign up we collect your name, email address, and password. Passwords are stored only as secure hashes; we never store or see your actual password.

Company profile. Your company name, business address, phone number, and logo, used on the quotes, invoices, and emails you send to your customers.

Business records you create. Clients, job-site addresses, quotes, invoices, scheduled visits, payment records, and job photos you add while running your business (more on this under “Your customers’ data” below).

Emails from MakeHay. We send emails about MakeHay itself on four lists: Getting started tips, Product updates, Offers and programs, and Feedback requests. If you signed up for product updates (including our pre-launch waitlist), we collect your email address and use it only for MakeHay announcements and related updates. Every list email includes an unsubscribe link that takes you off the list it came from, and the page it opens also lets you unsubscribe from all of them. Opting out is honored immediately. If you have a MakeHay login, you can also choose your lists from Account in your account menu. Account and security emails, billing emails and receipts, and notices about changes to our terms are not on a list and are always sent.

We use the information above to:

• Provide the service: quoting, scheduling, invoicing, and payments.
• Send the emails you trigger (quotes, invoices, receipts) and the automated reminders, review requests, and portal notifications you turn on.
• Look up map coordinates for job-site addresses and fetch weather forecasts for scheduled visits.
• Respond to support requests and notify you about important changes to the service.
• Monitor errors and keep the service secure and reliable.

We do not sell your personal information, and we do not use your business data for advertising.

As a business using MakeHay, you store information about your own customers: names, email addresses, phone numbers, job-site addresses, quotes, invoices, payment records, and job photos. MakeHay processes this data on your behalf and under your instructions; you control it, and we use it only to provide the service to you.

If you are a customer of a business that uses MakeHay and you want your information corrected or deleted, the fastest path is to contact the business directly; it is their customer record. You can also send privacy requests to support@makehay.io and we will help route them.

Quote approvals. When someone approves a quote through its secure link, we record the approver’s name, IP address, and browser user-agent. This serves as the acceptance record for the business: the digital equivalent of a signature on the estimate.

Electronic signatures. When someone signs a document through its emailed link, we record their name (typed, or an image of the signature if they draw one), their email address, the time they agreed to sign electronically and the time they signed, IP address, browser, and a cryptographic fingerprint of the document, and generate a signed PDF with that audit trail for the business.

Request forms. When you fill out a business’s request form, on makehay.io or embedded on the business’s own website, what you enter (name, contact details, address, message, photos, and any custom answers) is stored for that business. If the business turns it on and you gave an email address, you receive a confirmation email from the business sent through MakeHay. Submissions our spam checks flag are kept for the business, marked as spam, and no email is sent.

Client portal. Messages, photos, and documents your customers send through their portal link are stored for the business they belong to.

Websites MakeHay hosts. Some businesses have a website that MakeHay builds and hosts for them, at an address MakeHay assigns or at their own domain. Those sites set no cookies. MakeHay counts page views per page per day, without identifying the visitor, and keeps a short-lived record of the visitor’s IP address for an hour only to limit repeat counting and abuse. A quote request sent through the site is the business’s request form, described above. Reviews shown on a site come from the business’s Google Business Profile and are Google’s content.

Online payments are processed by Stripe through Stripe Connect. Card numbers and bank account numbers go directly to Stripe and are never stored on, or even pass through, MakeHay servers. We store only the payment amount, status, date, whether it was paid by card or bank transfer, and Stripe’s reference IDs for the payment, so invoices show what was paid. Stripe’s privacy policy applies to the payment data it processes.

When a business’s customer saves a card or bank account for autopay, those details go to Stripe as well. MakeHay stores the type of payment method, its brand or bank name, the last four digits, the expiry, and a record of the authorization the customer gave (its wording and version, when it was given, and the network address and browser used), so both the business and the customer can see what was agreed. Removing the saved method, from the client portal or by the business, detaches it at Stripe.

Emails from MakeHay (quotes, invoices, receipts, and reminders) are sent through Resend on the sending business’s behalf. We store delivery status for each email, including bounces and spam complaints, so businesses can see whether their messages arrived.

Open tracking. Emails sent through MakeHay, not only automated ones, may include a small tracking pixel, added by our email provider, that records the time the email is first opened. Businesses use this to see whether a quote, invoice, or reminder was read. Blocking remote images in your email client prevents this tracking.

Unsubscribing. Automated reminder emails (quote follow-ups, overdue invoice reminders, visit reminders, review requests) and messages a business sends you from its customer portal include an unsubscribe link. When you opt out, we store your email address together with the sending company so the opt-out is honored; transactional email you request, like a receipt for a payment you made, is unaffected.

If a business you work with uses the Texting add-on and records that you agreed to texts, MakeHay sends you text messages about your job on that business’s behalf from a MakeHay toll-free number: a quote is ready, an invoice was sent or is due, a visit is scheduled, a review request, or an autopay set-up link. We store your mobile number, who recorded your consent and when, each message sent and its delivery status, and your replies. Replying STOP ends texts to your number from every business on MakeHay; replying START allows them again; replying HELP returns help. The number is outbound only: any other reply is discarded, not read, stored or forwarded. Message and data rates may apply. We do not use your mobile number for marketing and do not share it with anyone but the carrier that delivers the message (Twilio).

MakeHay runs on a small set of service providers. Each receives only the data needed for its job:

• Vercel : Application hosting and content delivery.
• Vercel Analytics : Cookieless page-view analytics (page, referrer, browser and device type, approximate location). No cross-site tracking, no advertising use.
• Supabase : Database hosting (PostgreSQL on AWS, us-east-1).
• Stripe : Payment processing and payout accounts (Stripe Connect). Card and bank details go directly to Stripe and never touch MakeHay servers.
• Resend : Email delivery for quotes, invoices, receipts, reminders, and other messages sent from your company, and for MakeHay's own product updates. Email you send to our @makehay.io addresses is also received through Resend and forwarded to our inbox.
• Vercel Blob : File storage for company logos, job photos, photos submitted through request forms, session photos and videos, customer documents, message attachments, and signed contract PDFs.
• Anthropic : Answers questions you ask the help assistant inside MakeHay. Your question, the conversation so far, and basic details about your own account (your role, which add-ons you have, and the page you're on) are sent to Anthropic to write the answer. MakeHay keeps the questions and answers for 90 days to improve its help articles.
• Sentry : Error monitoring. If something breaks, Sentry may receive technical context about the error so we can fix it.
• Google : Optional “Sign in with Google.” If you use it, Google shares your name, email address, and profile picture with MakeHay; we store no Google password.
• US Census Bureau Geocoder : Converts job-site addresses to map coordinates. Addresses you geocode are sent to this service.
• Photon (OpenStreetMap) : Address autocomplete, and geocoding for Canadian addresses and any others the US Census geocoder can't resolve. Text you type into address fields is sent to this service to suggest matches.
• US National Weather Service : Weather forecasts for scheduled visits. Job-site coordinates are sent to this service to fetch the forecast.
• Esri (ArcGIS World Imagery & Wayback) : Satellite imagery tiles for the satellite measurement tool: the free public tool and the one inside MakeHay. Your browser requests map tiles for the area you view directly from Esri.

Address lookups and weather forecasts mean job-site addresses and coordinates are sent to the US Census Bureau, Photon (OpenStreetMap), and the National Weather Service, respectively. These lookups include only the address or coordinates, never names or contact details.

MakeHay uses cookies to keep you signed in and, when you reach sign-up from one of our own pages or a campaign link, to remember which one sent you (a first-party cookie that expires after 30 days). We do not use advertising cookies. We use Vercel Analytics for cookieless page-view analytics, no cross-site tracking.

Public quote and invoice pages use unguessable tokenized links, are marked so search engines do not index them, and are served with no-store caching so they are not retained by shared caches.

MakeHay is hosted on US infrastructure; the database runs on Supabase in AWS’s us-east-1 region. All traffic to and from MakeHay is encrypted in transit with TLS. Access to production data is limited to what is needed to operate and support the service, and every account’s data is isolated by company; one business can never see another’s records.

Files you and your customers upload (logos, photos, documents, signed PDFs) are stored at long, unguessable URLs. Anyone who has a file’s exact link can open it without logging in, so treat those links like the documents themselves.

We keep your data for as long as your account is active. The account owner can download everything the business entered and close the account under Settings › Account; a closed account’s data is deleted 30 days later, except the invoice and payment records the tax rules require us to keep. You can also ask for either by emailing support@makehay.io.

To protect accounts and stop abuse, we keep the network (IP) address and the kind of device (for example “Chrome on Windows”) of each sign-in, for 180 days after it was last used. When MakeHay closes an account for abuse, such as phishing or scams, it keeps the email addresses and network addresses it blocked, with a note of why, after the rest of the account is deleted.

MakeHay is operated from the United States and serves businesses in the US and Canada. If you are a California resident (or live in a state or province with a similar privacy law), you have the right to know what personal information we hold about you, to request a copy of it, to request its deletion, and to not be discriminated against for exercising those rights. MakeHay does not sell personal information, yours or your customers’, so there is nothing to opt out of on that front. To exercise any of these rights, email support@makehay.io and we will respond within the timelines the law requires.

MakeHay is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

If we make material changes to this policy, we will update the date at the top of this page and notify account holders by email before the changes take effect. Minor clarifications may be posted without notice.

Questions, privacy requests, or anything else: support@makehay.io.