Privacy Policy

We collect information in three ways: information you provide directly, information collected automatically, and information from third-party sources.

The Free Scan (No Account Required):

Our public soil scan at /scan/ works without an account. When you use it we collect and store:

• Street Address: The property address you enter, and the approximate latitude and longitude it resolves to. We keep the address only if you save the scan, as explained below.
• Public Survey Data For That Location: Soil series, texture, drainage class, estimated pH, USDA hardiness zone, and related agronomic values drawn from public datasets. This describes the mapped soil unit at that location, not your individual lawn.
• Email Address: Only if you choose to save the scan. Saving also creates a free Blade Boss account so the scan has somewhere to live. You are told this on the page before you click.
• Timestamp of Consent: We record when the disclosure was shown to you.

If you run a scan and do not save it, we do not keep the street address you typed. We keep only the map coordinates and ZIP code it resolved to, filed under a one-way scrambled code made from the address, for up to 30 days, so the same address loads faster the next time. Your browser may also keep the address on your device so you can return to it, and you can clear that at any time through your browser settings.

We use the address you type only to read your soil and build your lawn plan. We never sell it or its location, and we never share it with advertisers.

An account created this way has no password. You access it through a link we email you, or by using the Forgot Password option to set one. You can delete it at any time, and doing so deletes the scan and the address with it.

Information You Provide:

• Account Registration: Name, email address, password, city, and state.
• Profile Data: Lawn size, grass type, soil type, experience level, and lawn care preferences.
• Property Data: Physical property addresses, GPS coordinates, USDA hardiness zone, and property metadata including soil composition data.
• Zone Mapping Data: Custom lawn zone boundaries (GPS polygon coordinates), zone names, area measurements, zone groupings, and associated soil test results.
• Calculator & Tool Data: Inputs and outputs from lawn care calculators, saved calculation history, and tool preferences.
• Payment Information: Billing details provided during subscription checkout. Full credit card data is processed and stored exclusively by our payment processor, Square, Inc. We keep only the references Square gives us and your card's last four digits and brand, as Section 03 explains.
• Communications: Information provided when you contact our support team, submit feedback, or participate in consultations.
• Mobile Number (Text Alerts): If you sign up for text alerts, your mobile phone number, the email address you give with it, and a record of your consent: when you gave it, on which page, and the exact wording you agreed to.

Information Collected Automatically:

• Usage Data: Pages visited, tools used, features accessed, login timestamps, session duration, and interaction patterns.
• Device & Browser Data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
• Cookies & Local Storage: Session cookies, authentication tokens, user preferences, and cached data stored via browser localStorage and IndexedDB for performance optimization.
• Activity Logs: Login events, property additions, zone creation, tool calculations, and calendar task completions are logged for analytics and platform improvement.

Information From Third Parties:

• Mapbox: Satellite imagery, geocoding data, and map tile rendering for property visualization.
• Square: Payment confirmation, subscription status, and transaction records.

We use your personal information for the following purposes:

• Platform Operation: To create and manage your account, process subscriptions, deliver membership features, and provide access to tools and content based on your tier.
• Lawn Care Services: To generate personalized lawn care recommendations, calculate fertilizer and product application rates, display weather and growing degree day data, and provide zone-specific guidance.
• Property Mapping: To render your property on satellite imagery, store zone boundaries, calculate area measurements, and display soil data.
• Payment Processing: To process subscription payments, manage billing cycles, handle cancellations and refunds, and maintain payment history records.
• Communications: To send transactional emails (account confirmations, password resets, billing receipts), membership updates, and, with your consent, marketing communications about platform features and lawn care content.
• Analytics & Improvement: To understand usage patterns, identify popular tools and features, diagnose technical issues, and improve the Platform experience.
• Security: To detect and prevent fraud, unauthorized access, and other malicious activity.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

All payment processing is handled by Square, Inc., a PCI DSS Level 1 certified payment processor. When you enter your credit or debit card information during checkout, that data is transmitted directly to Square's secure servers using industry-standard TLS encryption.

• We do not store your full credit card number, CVV, or expiration date on our servers at any time.
• We do store the references Square gives us (a customer ID, a subscription ID and a card ID), and the last four digits and brand of your card (e.g., Visa, Mastercard) so we can show you which card is on file. Our system logs may also record the last four digits and brand when a payment runs.
• Payment transaction history (amount, date, status, payment type) is stored in our database for your billing records and our accounting purposes.

For more information about how Square handles your payment data, please refer to Square's Privacy Policy at squareup.com/legal/privacy.

We use cookies and browser storage technologies to operate the Platform effectively. Here is what we use and why:

Essential Cookies (Required):

• WordPress Session Cookies: Maintain your login session and authenticate your identity. Login cookies expire after 2 days (or 2 weeks if "Remember Me" is selected).
• Security Cookies: Temporary cookies to verify browser capability and prevent cross-site request forgery (CSRF).
• Nonce Tokens: Short-lived security tokens that validate form submissions and API requests.

Functional Storage (Performance):

• localStorage: Stores user preferences, map settings, and cached data (BladeData) for faster page loads and cross-tab synchronization. This data remains on your device and is not transmitted to our servers unless you explicitly save changes.
• IndexedDB: Stores larger datasets locally including zone data, soil tests, calculation history, and an offline sync queue. This enables the Platform to function during temporary network interruptions.

Analytics & Advertising Cookies:

• Blade Boss visit counter (our own): We count visits and the steps of the Scan ourselves, so we can see which pages work and where people get stuck. A cookie named bbx holds a random ID, with no name, email or address in it, for up to 180 days. With it we record the page, your type of device (phone, tablet or computer), the website that sent you, the campaign tags in the link, how long the page took to load and how long you stayed. We never record your IP address, anything you type, or the address you scan. If you create an account, we link that ID to it and note a few milestones (signing up, saving your first map zone, payments), so we can see which pages lead to members. The same ID keeps you on one version of a page while we test changes. Raw records are deleted after about 13 months.
• Meta (Facebook) Pixel: We use the Meta Pixel to measure advertising effectiveness, build custom audiences, and deliver relevant ads on Facebook and Instagram. This pixel may collect your IP address, browser information, and pages visited. You can opt out of Meta's tracking via your Facebook Ad Settings or the Digital Advertising Alliance opt-out page.
• Meta Conversions API: When you create an account or make a purchase, our server also tells Meta about it through the Meta Conversions API, so we can measure which ads work. We send your email address and ZIP code in hashed form (scrambled so they cannot be read), a scrambled member number, your IP address and browser details, and the purchase amount. Our Meta Pixel also sends the same page and signup events to Meta through Meta's own server connection, and Meta matches the copies so each one counts once.
• Google Analytics: We use Google Analytics to count visits and see which pages and tools people use. It sets cookies and collects your IP address, browser and device details, and the pages you visit. You can opt out with Google's Analytics opt-out browser add-on.
• Google Ads: We use Google Ads conversion tracking to measure which of our Google ads lead to a signup or a purchase. It sets cookies and records whether a visit that came from one of our ads went on to a signup or purchase. You can manage how Google personalizes ads in your Google ad settings.
• Microsoft Clarity: We use Microsoft Clarity to see how our pages are used, through heatmaps and recordings of clicks, scrolling and mouse movement, so we can fix what is confusing. It sets cookies and collects your IP address and browser details.
• Google Maps (the Scan): Addresses you type into the Scan are looked up with Google Maps to find your property.

Most browsers allow you to control cookies through their settings. Disabling essential cookies may prevent the Platform from functioning properly. Disabling localStorage or IndexedDB will significantly degrade performance.

Do Not Track: Some browsers send a "Do Not Track" signal. There is no common standard for what it should mean, so the Platform does not change how it works when it receives one. You can still turn off each service above with the opt-outs in Section 09.

Tracking across other sites: Meta, Google and Microsoft (through the Meta Pixel, Google Analytics, Google Ads and Microsoft Clarity) may collect information about your activity on the Platform over time and across other websites and apps you use. We do not track you across other companies' sites ourselves.

We integrate with the following third-party services to operate the Platform. Each service has its own privacy policy governing how it handles your data:

• Square, Inc.: Payment processing, subscription management, and billing. Square Privacy Policy
• Mapbox, Inc.: Satellite imagery, map rendering, geocoding, and property visualization. When you use Lawn Map Pro, your property coordinates are sent to Mapbox to render map tiles. Mapbox Privacy Policy
• Map imagery providers (Mapbox, MapTiler, Esri, OpenStreetMap, CARTO and Google): The map tiles you see in Lawn Map Pro come from these providers, depending on the map style you pick. When your browser loads them, each one receives your IP address and the map area you are viewing. MapTiler, Esri, OpenStreetMap, CARTO and Google privacy policies.
• Twilio Inc.: Text message delivery. If you sign up for text alerts, your mobile number and the texts we send you pass through Twilio, which delivers them and handles STOP and HELP replies. Twilio Privacy Policy
• Zoho Bigin: Customer relationship management (CRM). Contact information may be stored in our CRM for member support and communication purposes. Zoho Privacy Policy
• Meta Platforms (Facebook): Advertising and analytics through the Meta Pixel and the Meta Conversions API, as described in Section 04. Meta Privacy Policy
• Google LLC: Website analytics (Google Analytics), ad conversion measurement (Google Ads), and address lookup for the Scan (Google Maps). Google Privacy Policy
• Microsoft Corporation: Page usage analytics through Microsoft Clarity. Microsoft Privacy Statement
• Cloudflare, Inc.: Security and content delivery. Every request to the Platform passes through Cloudflare, which processes your IP address and browser details to deliver pages and block attacks. Cloudflare Privacy Policy
• Public data services (USDA, NOAA, Open-Meteo, ISRIC SoilGrids): When you run a scan or view your property, our server sends these services the map coordinates of the address to fetch soil, climate and weather data. They never receive your name or email address.
• WordPress / Automattic: Core platform infrastructure. Standard WordPress cookies and functionality. Automattic Privacy Policy

We carefully select third-party partners that maintain strong data protection practices. However, we are not responsible for the privacy practices of third-party services. We encourage you to review their respective policies.

We do not sell, rent, or trade your personal information to third parties.

We may share your information only in the following limited circumstances:

• Service Providers: With the third-party services listed above, solely to the extent necessary to operate the Platform (payment processing, email delivery, mapping, etc.).
• Legal Requirements: When required by law, regulation, subpoena, court order, or other governmental request.
• Safety & Protection: When we believe disclosure is necessary to protect the rights, property, or safety of Blade Boss LLC, our members, or the public.
• Business Transfer: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. You will be notified via email or prominent notice on the Platform of any change in ownership or use of your personal information.
• With Your Consent: When you explicitly authorize us to share information for a specific purpose.

We will never share your street address, GPS coordinates, or lawn zone data with advertisers, data brokers, or any third party for marketing purposes. Your ZIP code is shared with Meta only in hashed form, as described in Section 04.

Text messages (Blade Boss Lawn Alerts): We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. This covers the mobile number and consent you give us for text messages. We do not sell or share your mobile phone number, or your consent to receive text messages, with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data is shared only with the service providers that run the program for us: Twilio, which delivers our texts, and Zoho Bigin, where we keep the consent record.

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specific retention periods include:

• Account Data: Retained for the duration of your active account. Upon account deletion, personal information is purged within 30 days, except as required for legal or accounting obligations.
• Payment Records: Transaction history is retained for 7 years in accordance with IRS record-keeping requirements and generally accepted accounting practices.
• Activity Logs: Usage analytics and activity logs are retained for up to 24 months, after which they are anonymized or deleted.
• Property & Zone Data: Retained as long as your account is active. Deleted within 30 days of account closure.
• Marketing Preferences: Your email marketing opt-out preferences are retained indefinitely to ensure we continue to honor your choices.
• Scan Data: If you saved a scan, the address and soil profile are retained with your account and deleted within 30 days of account closure. If you provided an email but never created an account, that record is retained for up to 24 months and then deleted, unless you ask us to remove it sooner.
• Client-Side Data: Data stored in your browser (localStorage, IndexedDB) can be cleared at any time through your browser settings. We do not control the retention of data stored locally on your device.

We implement industry-standard security measures to protect your personal information, including:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS). Passwords are stored using one-way cryptographic hashing and are never stored in plain text.
• Access Controls: Administrative access to user data is restricted to authorized personnel only and protected by multi-factor authentication.
• Payment Isolation: Credit card data is processed exclusively by Square's PCI DSS Level 1 compliant infrastructure and never touches our servers.
• Monitoring: We monitor our systems for unauthorized access attempts and suspicious activity.
• Nonce Verification: All API requests and form submissions are validated with security tokens to prevent cross-site request forgery.

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you become aware of any unauthorized access to your account, please contact us immediately at support@bladebosshq.com.

You have the following rights regarding your personal information:

• Access: You may request a copy of the personal data we hold about you. Most of your data is accessible directly through your Account dashboard.
• Correction: You may update or correct your personal information at any time through your Profile settings.
• Deletion: You may request deletion of your account and associated personal data by contacting support@bladebosshq.com. We will process your request within 30 days, subject to legal retention requirements.
• Deleting a Scan: If you used the free scan and want your address and soil profile removed, email support@bladebosshq.com from the address you gave us and we will delete it. You do not need to log in, and you do not need an account for us to honor this.
• Data Export: You may request an export of your personal data in a machine-readable format.
• Marketing Opt-Out: You may unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly. Transactional emails (billing receipts, password resets, security alerts) are not subject to opt-out.
• Text Message Opt-Out: Reply STOP to any text from us to stop text messages at any time, or HELP for help. The full text terms are in Section 16 of our Terms & Conditions.
• Cookie Control: You may disable non-essential cookies through your browser settings. You can clear localStorage and IndexedDB data at any time.
• Ad Tracking Opt-Out: You may opt out of Meta Pixel tracking via your Facebook Ad Settings or the DAA Opt-Out Tool, and of Google's through your Google ad settings and the Google Analytics opt-out add-on.

To exercise any of these rights, contact us at support@bladebosshq.com. We will respond to verified requests within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collection, and the categories of third parties with whom it is shared.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If this practice ever changes, we will provide a "Do Not Sell My Personal Information" link on the Platform.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact support@bladebosshq.com with the subject line "CCPA Request." We will verify your identity before processing any request and respond within 45 days.

Blade Boss LLC is based in the United States and the Platform is primarily designed for U.S. residents. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

For residents of the European Economic Area (EEA) or United Kingdom, we recognize the following rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data.
• Right to rectification of inaccurate personal data.
• Right to erasure ("right to be forgotten").
• Right to restrict or object to processing.
• Right to data portability.
• Right to lodge a complaint with a supervisory authority.

Our legal basis for processing your data includes: performance of a contract (providing the services you've subscribed to), legitimate interests (improving the Platform, preventing fraud), consent (marketing communications), and legal obligations (tax and accounting requirements).

To exercise any GDPR rights, contact support@bladebosshq.com with the subject line "GDPR Request."

The Platform is not intended for use by children under the age of 13. We do not knowingly collect, solicit, or store personal information from anyone under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

If we discover that we have collected personal information from a child under 13, we will delete that information promptly. Parents or guardians who believe their child has provided personal information to us should contact support@bladebosshq.com immediately.

The Platform may include embedded content from third-party websites (videos, images, maps, articles). Embedded content from other websites behaves identically to visiting that website directly. Those sites may collect data about you, use their own cookies, embed additional third-party tracking, and monitor your interaction with the embedded content.

We may also link to external websites, products, or services. Blade Boss LLC is not responsible for the privacy practices or content of external sites. We encourage you to review the privacy policy of any site you visit through our links.

Before you create an account, we keep a small record in your own browser's local storage of things you have given us or done on the site:

• An email address you typed into any form.
• A property address you scanned, and the result of that scan, including the soil series and hardiness zone for that lot.
• The general topic categories of the guides and articles you opened. We store categories such as "lawn disease," never a list of the specific pages you visited.
• Which calculators you used, and which locked sections you tried to open.
• How you first arrived at the site, and how many times you have visited.

This exists so that we do not ask you for the same information twice. If you scan your lawn and then create an account, we already have your address and skip that question. If you have been reading about lawn disease, we start there instead of something generic.

None of it leaves your browser unless you choose to create an account, at which point it is sent with your registration and stored with your account. It expires on its own after 30 days without a visit.

You can remove it at any time by clearing your browser's site data for bladebosshq.com. Deleting your account also removes the copy stored with your account, as described in Section 09.

On a device you share with other people, note that an email address you entered may be filled in for the next person who uses that browser. Where we do this, we show you which address is filled in and give you a way to change it before you continue. We never fill in a password, and we never sign anyone in automatically.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy.
• Notify registered users via email for significant changes that affect how your data is collected or used.
• Post a prominent notice on the Platform for at least 30 days.

Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the revised policy. We encourage you to review this page periodically.