Effective date: September 10, 2026 Last updated: September 10, 2026 (rev 1)
This Privacy Policy (the "Policy") explains how Haven Brands, Inc., a Kentucky corporation with offices in Florence, Kentucky ("SellWorthy," "we," "us"), collects, uses, discloses, and protects personal information in connection with the SellWorthy software-as-a-service platform made available at app.sellworthy.ai and its related properties (collectively, the "Services").
This Policy applies to:
- Customers — the businesses (contractors, dealers, and other companies) that subscribe to the Services under our Terms of Service;
- Authorized Users — the individuals a Customer authorizes to use the Services on its behalf (owners, admins, salespeople, technicians, and other staff); and
- End Customers — the homeowners, property managers, and other third parties whose information a Customer submits to the Services in the course of quoting, contracting, invoicing, servicing, and collecting for a job.
Capitalized terms not defined here have the meanings given in our Terms of Service.
1. Roles: Controller and Processor
SellWorthy acts in two different roles depending on the data:
- Processor / service provider. For Customer Data that a Customer or its Authorized Users submit to the Services — including End Customer names, addresses, phone numbers, emails, job details, photos, quote and contract content, signature records, payment card metadata handled by Stripe, and similar information — the Customer is the "controller" (or "business") and SellWorthy is the "processor" (or "service provider"). SellWorthy processes Customer Data on the Customer's behalf to provide the Services, and does not sell or share it for cross-context behavioral advertising.
- Controller. For information collected directly from Customers and Authorized Users when they create an account, subscribe, contact us, or otherwise interact with SellWorthy as a company — including billing contact details, subscription and payment metadata, support correspondence, and usage telemetry associated with their account — SellWorthy is the controller.
Where SellWorthy acts as a processor, each Customer is responsible for providing lawful notice to, and where required obtaining consent from, its Authorized Users and End Customers.
2. Information We Collect
2.1 Information a Customer or Authorized User provides directly
- Account information: name, work email, phone, company name, address, role, password (stored as a salted hash), and profile settings.
- Billing information: subscription plan, billing contact, tax information, and payment method metadata. Full payment card numbers are handled by our payment processor and are not stored on SellWorthy servers.
- Customer-generated content: quotes, jobs, customer records, service agreements, contracts, signatures, PDFs, uploaded documents, photos, notes, tasks, follow-up cadence entries, messages, and other content the Customer or its Authorized Users create or upload through the Services.
2.2 Information about End Customers that a Customer submits
To provide quoting, contracting, invoicing, servicing, follow-up, and payment features, the Services store End Customer information that the Customer or its Authorized Users enter or import. This may include name, service address, phone, email, quote and job history, signatures on contracts, payment card metadata handled by Stripe, and other information the Customer chooses to record.
2.3 Information collected automatically
When the Services are used, we automatically collect certain technical information, including:
- IP address, device and browser type, operating system, and time zone;
- pages viewed, features used, and the timestamps of those actions;
- log data related to errors, latency, and system events;
- authentication events (sign-in, sign-out, failed attempts, session identifiers);
- cookies and similar technologies as described in Section 6.
2.4 Information from third parties
We may receive information from third parties that support the Services, such as:
- Payment processors (Stripe): payment status, refund status, dispute status, payout summaries, and payment method metadata (such as the last four digits, brand, and expiration month of a saved card).
- Communication and messaging providers: delivery status, bounces, and engagement events for messages we send on behalf of a Customer.
- Authentication providers: identifiers and profile information returned when a user signs in using a third-party identity provider (where offered).
3. How We Use Information
We use the information described in Section 2 to:
- provide, operate, and maintain the Services, including generating quotes, contracts, invoices, dashboards, recurring billing runs, follow-up cadences, and other outputs a Customer configures;
- authenticate Authorized Users and enforce access controls;
- process subscription payments and Customer-initiated payments through Stripe;
- respond to requests, provide support, and communicate about the account, security, updates, and service changes;
- monitor, secure, and improve the Services, including debugging errors, preventing abuse, and detecting fraud;
- generate Aggregated Statistics (as defined in the Terms of Service) that do not identify any Customer, Authorized User, or End Customer;
- comply with legal obligations, respond to lawful requests, and enforce our Terms of Service and Acceptable Use Policy.
We do not use Customer Data to train generative-AI models for the benefit of third parties, and we do not sell Customer Data or End Customer information.
4. AI Features
The Services include AI-assisted features, including image rendering that generates a nighttime preview of a proposed lighting design from a daytime photo, and drafting helpers for messages, contracts, and other templates.
When a Customer or Authorized User uses an AI feature, the relevant input (for example, an uploaded photo, a job description, or a prompt) is transmitted to a third-party AI provider under a contract that prohibits the provider from using the input to train its models for the benefit of third parties, to the extent such a contractual commitment is available for the model in use. AI outputs are stored with the associated quote, job, or record so the Customer can retrieve and reuse them.
AI features generate approximations, not commitments. The Customer is responsible for reviewing AI outputs before sending them to an End Customer or relying on them for a business decision.
5. When We Share Information
We share information only as described below.
5.1 With the Customer
Information about an Authorized User's activity in the Services (sign-ins, actions taken, records touched) is available to the Customer that authorized the user, as part of the operating, auditing, and security functions of the Services.
5.2 With subprocessors and service providers
We share information with vendors that help us run the Services under written contracts that require appropriate confidentiality and security. Current categories include:
- Payment processing: Stripe.
- Hosting and cloud infrastructure: cloud compute, storage, database, and CDN providers used to operate the Services.
- Communication providers: email, SMS, and voice-messaging providers used to send messages on a Customer's behalf.
- Analytics, error monitoring, and performance monitoring: providers that help us detect defects, measure uptime, and improve the Services.
- AI providers: providers that power AI features such as image rendering and drafting helpers.
- Support and customer-communication tools: the tools we use to receive and respond to Customer support requests.
A current list of subprocessor categories is available at sellworthy.ai/privacy. We may update this list from time to time.
5.3 With End Customers of a Customer
The Services generate documents (quotes, contracts, invoices, receipts, and similar outputs) that a Customer sends to its End Customers in the ordinary course. Those documents contain the information the Customer has entered.
5.4 For legal reasons
We may disclose information when we believe in good faith that disclosure is required to:
- comply with a lawful subpoena, court order, or other legal process;
- respond to a request from a governmental authority with appropriate jurisdiction;
- enforce our Terms of Service or Acceptable Use Policy;
- protect the rights, property, or safety of SellWorthy, our Customers, End Customers, or the public;
- investigate or prevent fraud, abuse, or a security incident.
Where legally permitted, we will use reasonable efforts to notify the affected Customer before disclosing Customer Data in response to a legal request.
5.5 In a corporate transaction
If SellWorthy or Haven Brands, Inc. is involved in a merger, acquisition, financing, or sale of assets, information described in this Policy may be transferred to the counterparty, subject to standard confidentiality protections and continuing to be handled consistent with this Policy or its successor.
6. Cookies and Similar Technologies
The Services use cookies and similar technologies for:
- Authentication — keeping an Authorized User signed in after they log in;
- Security — detecting suspicious sessions, CSRF protection, and rate limiting;
- Preferences — remembering settings such as time zone or last-viewed dashboard;
- Analytics — measuring how the Services are used so we can debug and improve them.
Most browsers let users refuse or delete cookies. Disabling cookies may prevent the Services from functioning correctly, including signing in.
7. Data Retention
We retain Customer Data for as long as the Customer maintains an account, and for a reasonable period after termination to complete winddown, meet legal and audit obligations, and support dispute resolution. Backups may persist for a longer period, consistent with our operational backup schedule.
A Customer may request deletion of its Customer Data as described in the Terms of Service. Requests for deletion of End Customer information must come from the Customer that submitted it, unless applicable law grants the End Customer a direct right.
We retain account and billing information for as long as needed to comply with tax, accounting, and other legal requirements.
8. Security
We use commercially reasonable administrative, technical, and physical safeguards designed to protect information in our custody, including:
- encryption of data in transit using TLS;
- encryption of data at rest for databases and object storage where supported by our hosting provider;
- role-based access controls, least-privilege access, and audit logging for administrative access;
- vendor-managed key storage for authentication secrets;
- Stripe-hosted payment card handling, so that primary account numbers are not stored on SellWorthy servers.
No system is perfectly secure. We cannot guarantee that unauthorized access, disclosure, or loss will never occur. In the event of a security incident that affects information we control, we will notify affected Customers as required by law and cooperate with the Customer to determine the appropriate notice to any End Customers.
9. Your Choices and Rights
9.1 Authorized Users
Authorized Users may update their name, email, password, and notification preferences from within the Services. Requests to close an Authorized User account should be made through the Customer whose account authorized the user.
9.2 Customers
A Customer may:
- update its account, billing, and company information from within the Services;
- request an export of Customer Data associated with its account;
- request deletion of its account and associated Customer Data, subject to Section 7;
- change its subscription or cancel its plan as described in the Terms of Service and pricing page.
9.3 End Customers
Requests from End Customers concerning their information (for example, access, correction, deletion, or opting out of communications) should be directed to the Customer that provided that information to the Services. SellWorthy will support Customers in responding to such requests as required by applicable law.
9.4 Marketing communications
SellWorthy may send Authorized Users occasional messages about product updates, security, and service-related announcements. Marketing messages will include a way to opt out. Transactional and security messages will continue even after opting out of marketing messages.
10. State- and Region-Specific Disclosures
10.1 California
For California residents whose personal information SellWorthy processes as a business (rather than a service provider for a Customer), the following disclosures apply under the California Consumer Privacy Act, as amended:
- The categories of personal information collected are described in Section 2.
- The sources and purposes of that collection are described in Sections 2 and 3.
- The categories of recipients are described in Section 5.
- SellWorthy does not sell personal information and does not share personal information for cross-context behavioral advertising.
- California residents may exercise their rights to know, delete, correct, and limit as described in Section 9 by contacting us at the address in Section 12.
Where SellWorthy processes personal information as a service provider on behalf of a Customer, the Customer is the "business" and the California resident should direct rights requests to that Customer.
10.2 Other state privacy laws
SellWorthy will honor rights requests from residents of other U.S. states that grant analogous rights, to the extent required by, and in the manner set out in, the applicable law.
10.3 EEA, UK, and other international users
The Services are intended for use by contractors and dealers in the United States. If personal information is transferred to us from outside the United States, that information will be processed in the United States. Customers subject to non-U.S. data-protection law are responsible for determining whether such transfer is lawful under that law and for putting appropriate transfer mechanisms in place.
11. Children
The Services are intended for use by businesses and their staff. The Services are not directed to children under 13 (or the equivalent minimum age in the applicable jurisdiction), and we do not knowingly collect information from children. If we learn that we have collected information from a child in violation of this Policy, we will delete it.
12. Contact
Questions about this Policy or requests related to information described here should be sent to:
Haven Brands, Inc. — Attn: SellWorthy Privacy Florence, Kentucky Email: privacy@sellworthy.ai
13. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this Policy and, where appropriate, notify Customers through the Services or by email. Continued use of the Services after an update constitutes acceptance of the updated Policy.