What we hold, and why
Privacy Policy
Last updated August 27, 2026 · Applies to chalkcrm.com and app.chalkcrm.com
Chalk holds the records a service business runs on: its customers, its quotes, its jobs, its money. This page says exactly what we store, who else touches it, how long it stays, and the things we will not do with it. It is written to be checked, not skimmed past.
Are you the customer of a business that uses Chalk? A painter, landscaper or cleaner probably sent you a quote, an invoice or a text through us. That business decides what to collect about you and why. We only hold it for them. Contact them first, and see section 10.
Contents
- Two roles, and which one we are in
- What we collect
- What we never collect
- How we use it
- Who else processes it
- Messaging, carriers and consent
- Cookies and tracking
- How long we keep it
- How we protect it
- If you are somebody's customer
- Your rights and choices
- California and other state rights
- People outside the United States
- Children
- Changes to this policy
- How to reach us
1 Two roles, and which one we are in
Chalk handles information in two different capacities, and it matters which:
- For the business that subscribes, we are the controller of its account: who signed up, the email and phone on the account, what was paid, how the software was used. We decide how that is handled and this policy governs it.
- For everything that business puts into Chalk about its own customers, we are a processor, or in California terms a service provider. The business decides what to collect and why; we hold and process it on their instructions, under our User Agreement, and for no purpose of our own.
2 What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Business name, address, phone, email, industry, hours, logo and branding, plus each user's name, email, phone, role and permissions. | Entered by the business at signup or in Settings. |
| Credentials | A password hash, PIN hash, two factor codes and device trust records. Never the password or PIN itself. | Created when a user sets one. |
| Business records | Customers and their contacts and property addresses, leads, quotes, line items and measurements, jobs, visits, schedules, invoices, payments, expenses, timesheets, payouts, notes and tags. | Entered or generated by the business as it works. |
| Files | Photos of work and property, receipts, documents, and signatures drawn by a customer approving a quote. | Uploaded by the business, or captured from its customer. |
| Communications | The text messages and emails sent through Chalk and their delivery status, including inbound replies. | Sent and received through the app. |
| Payment metadata | Stripe customer, account, charge and payout identifiers, amounts, the last four digits and brand of a card, and payment status. | Returned to us by Stripe. Card numbers never reach Chalk. |
| Registration details | Legal entity type, EIN, address and website supplied for carrier messaging registration. | Entered by the business when it registers a text number. |
| Technical | IP address, browser and device type, timestamps, pages and endpoints requested, errors, and an audit trail of who changed what inside an account. | Generated automatically when the software is used. |
3 What we never collect
- Card numbers. Payment details are entered on Stripe's own pages and go straight to Stripe. Chalk stores only Stripe's reference tokens.
- Bank login credentials. Bank details for payouts are held by Stripe under the business's own Stripe account.
- Location tracking. Chalk does not track the location of crews or devices. Addresses are geocoded so they can be shown on a map; nobody is followed.
- Advertising profiles. There are no advertising trackers, no data brokers, and no cross site profiling anywhere in Chalk or on this website.
4 How we use it
- To run the software: show a business its own records, send the quotes, invoices, reminders and receipts it asks us to send, take payments through Stripe, and keep the schedule.
- To bill: take subscription payments, apply seats and taxes, and keep the records that go with them.
- To support: answer questions and investigate faults. Staff access to a business's records is limited to what a specific problem requires.
- To keep it safe: detect and prevent abuse, fraud, unauthorised access and messaging violations, and to enforce our agreement.
- To improve it: understand which features are used and where the software fails, using aggregated and de-identified information wherever that will do.
- To comply with law: respond to lawful requests, keep tax and transaction records, and meet carrier and payment network obligations.
We do not sell personal information, and we do not share it for cross context behavioural advertising. We do not use a business's customer records to market to those customers ourselves. We do not train models on one business's records for the benefit of another.
5 Who else processes it
Chalk is built on other people's infrastructure, and each of these sees a defined slice of information in order to do its job. This is the full list as of the date at the top of this page.
| Provider | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosting, database, file storage, network security | Everything stored in Chalk, at rest in its database and object storage, and every request in transit |
| Stripe | Subscription billing and customer card payments | Payer name, email, amounts, card details entered on Stripe's pages, and the business's own identity and bank details |
| Telnyx | The built in text number, and carrier registration | Phone numbers, message contents and delivery status, plus the business details filed for registration |
| The Campaign Registry and mobile carriers | Approving a business to send text messages in the United States | The registration details described in section 2 |
| Resend | Sending email | Recipient address, subject and message content |
| United States Census Bureau geocoder and Photon | Turning a street address into map coordinates | The address text only, with no customer name attached |
| CARTO | Map images behind the schedule map | Which map tiles a browser requested, which reveals the area being viewed |
| The model host for ChalkBot | Generating replies, drafts, bookings and other assistant output | The prompts and shop context ChalkBot needs for that task: messages, names, job details, prices and your instructions. We do not sell this, and we do not use one business's records to train a model for another |
A business may also connect optional services of its own, such as a different texting provider or an automation tool. What those receive is governed by the business's relationship with them.
We also disclose information when:
- The law requires it, or a valid legal process compels it. Where we may lawfully tell the business first, we will.
- It is needed to investigate fraud, abuse or a security incident, or to protect somebody's safety.
- Chalk is sold, merged or reorganised, in which case the information moves with the business and this policy continues to apply until replaced with notice.
6 Messaging, carriers and consent
Text messages sent through Chalk go out from a number registered to the business that sent them, not from us. To make that possible, business registration details are filed with Telnyx, The Campaign Registry and the mobile carriers, and message contents pass through those carriers to reach a handset.
Mobile numbers and consent are never sold, rented or shared for anyone else's marketing. Consent a customer gives to one business is used only by that business, and is not shared with third parties or affiliates for their own marketing. It is not passed to any other business using Chalk.
Message contents and delivery records are kept in the sending business's account so it has a history of what was sent. Standard message and data rates may apply to recipients. Anyone can stop messages from a business by replying STOP, and should contact that business directly with any other request.
6.1 Your opt-in, and what happens to it
This is the part US carriers require to be stated plainly, and it is the page our customers' carrier registrations point at:
We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. Your mobile number and your consent are never sold, rented, or passed to anyone else's marketing, to affiliates, or to any other business using Chalk.
The one place your number does go is the technical path a text has to take: our messaging carrier and the mobile networks, which is the only way a message reaches a handset. They handle it to deliver the message, not to market to you. What the messages contain, how often they come and how to stop them is set out in the messaging programme description.
7 Cookies and tracking
Chalk uses a small number of strictly necessary cookies and nothing else. There are no advertising cookies, no analytics scripts, no pixels and no third party trackers on this website or in the app, which is why you are not being asked to accept anything.
| Cookie | Purpose | Lifetime |
|---|---|---|
chalk_session | Keeps you signed in. Http only. | Up to the length of the session you chose |
chalk_trust | Remembers a device you confirmed, so it is not asked for a code every time. | 60 days |
chalk_device | Marks a shared shop device as enrolled, so the crew PIN pad can appear on it. | Until removed |
The app also uses your browser's local storage, under names beginning
chalk_, to remember preferences such as your chosen view and theme, and
to hold work typed while offline until it can be saved.
That stays on your device. If you turn on notifications, your browser's push service
holds a subscription identifier so a message can reach you.
8 How long we keep it
- While the account is open: business records are kept until the business deletes them. Chalk deliberately archives rather than deletes anything money has touched, so history stays intact.
- Backups: a nightly copy of each account is written to encrypted storage and kept for about fourteen days, then overwritten in the ordinary course.
- If the account is closed: records are deleted immediately and permanently when the owner closes it, and any text number is released. Copies inside backups age out within roughly fourteen days. This is why the closing screen offers a full download first.
- If a subscription simply lapses: the account is locked but the data is kept, so a business that comes back finds its records where it left them. We may delete a long dormant unpaid account after notice to the address on file.
- What outlives the account: billing and tax records we are required to keep, and a short note that an account existed and was closed, which contains the business name and date and none of its customer records.
- Logs: technical and security logs are kept for a limited period, typically weeks rather than years.
9 How we protect it
- Encrypted in transit, and at rest in Cloudflare's database and object storage.
- Passwords and PINs are stored only as salted hashes. Session, invitation, reset and device tokens are stored hashed as well, so a copy of the database does not hand somebody a working key.
- Two factor sign in by emailed or texted code when a new browser appears, with device trust so it is not asked for daily.
- Every request is fenced to a single business. Cross business access is tested automatically on every release.
- Roles and permissions limit what each person in a business can see, including price and financial visibility for field crews.
- Data exports and backups deliberately exclude credentials and access tokens.
- A full audit trail records who changed what.
No system is perfectly secure, and we cannot guarantee that information will never be accessed improperly. If a breach affects a business's information we will notify it without undue delay and provide what we know, so it can meet its own notification obligations to its customers.
10 If you are somebody's customer
If a business sent you a quote, an invoice, a receipt or a text through Chalk, that business chose to collect your information and decides what happens to it. We hold it on their behalf and we do not use it for anything of our own.
- To see, correct or delete what a business holds about you, ask that business. They control it and they can act on it directly.
- To stop text messages, reply STOP to the message. To stop emails, use the unsubscribe link or reply and ask.
- Links to a quote, invoice or portal are unguessable web addresses so you do not need an account to open them. Treat one like a private link and do not forward it to anyone you would not show the document to.
- If you cannot reach the business, or believe it is misusing your information, write to us at info@chalkcrm.com and we will pass it on and help where we can. In most cases we must refer you to the business, because acting on its records without instruction is not ours to do.
11 Your rights and choices
If your business holds a Chalk account, you can at any time:
- Export everything as spreadsheets or as a full backup file, from Settings and Data.
- Correct anything in the account, including the business name, directly in Settings.
- Delete individual records, or close the account and have everything deleted at once.
- Control notifications and choose which channels are used for what.
- Ask us for a copy of the account information we hold as controller, or for it to be corrected or deleted, by writing to us.
We do not discriminate against anyone for exercising a privacy right. We may need to verify a request, and we will respond within the time the applicable law allows.
12 California and other state rights
Residents of California and of other states with comprehensive privacy laws have rights to know, access, correct, delete, and to obtain a portable copy of personal information, and to appeal a refusal. Where we act as a service provider to a business, those requests should go to that business, and we will assist it.
In the twelve months before the date of this policy we collected the categories in section 2, for the purposes in section 4, and disclosed them for business purposes to the providers in section 5. We do not sell personal information, and we do not share it for cross context behavioural advertising, including of anyone under 16. We do not use or disclose sensitive personal information beyond what is necessary to provide the service. We offer no financial incentive in exchange for personal information. An authorised agent may make a request with proof of authorisation.
13 People outside the United States
Chalk is operated from the United States and built for businesses working in the United States, and information is processed there and on globally distributed infrastructure. If you use Chalk from elsewhere, you are sending information to the United States, where privacy law differs from your own.
If a business has obligations under the GDPR, UK GDPR or a similar regime, write to us and we will provide a data processing agreement covering our role as processor, including the standard contractual clauses where they are required.
14 Children
Chalk is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13, and accounts require users to be at least 18. If you believe a child's information reached us, write to us and we will remove it.
15 Changes to this policy
We will update this policy as Chalk changes, and the date at the top will change with it. If a change is material, we will give notice by email or in the app before it takes effect. Providers added to section 5 will appear here before they begin processing anything.
16 How to reach us
Chalk · info@chalkcrm.com · Duncan, South Carolina, United States. Privacy, security, data protection and deletion requests all go to that address, and a person reads it.
Read this alongside the User Agreement, which sets out each side's responsibilities.