At Cuadrilly ("Cuadrilly", "we", "us") we take care of the personal data that flows through our platform. This policy explains what data we process, why, who we share it with and how you can exercise your rights, including deleting your data.
1. Who we are and who this applies to
Cuadrilly is cloud software for field-service businesses (cleaning, maintenance, installations and similar): scheduling, crew management, quotes, payments, CRM and an inbox connected to WhatsApp, Instagram and Telegram.
We process personal data in two different roles:
- As a controller, for the people who create and use a Cuadrilly account (business owners and their team members) and for visitors to our website.
- As a processor, for the data each business (the "Customer") uploads or receives through Cuadrilly about its own clients, employees, applicants and contacts. The business decides how that data is used, and we process it only to provide the service, following its instructions.
If you are a client or contact of a business that uses Cuadrilly, we recommend also reading that business's privacy policy.
2. Data we process
Account data
- Name, email, password (stored as a one-way hash, never in plain text), role and preferred language.
- Business details: name, logo, currency, settings and subscription billing details.
Data the Customer manages in Cuadrilly
- Clients and leads: name, phone, email, service addresses and locations, appointment history, quotes and payments.
- Employees and applicants: contact details, photo, ID document, criminal-record certificate, pay rate, availability and bank details used to pay them.
- Messages: conversation content (text, images, audio, documents and locations), the contact's phone number or ID, and their profile name.
Technical data
- IP address, browser, access and error logs, and strictly necessary cookies (see Cookies).
3. Data from WhatsApp, Instagram and other Meta platforms
When a business connects its WhatsApp Business or Instagram account to Cuadrilly — either by configuring it manually or by authorizing us through Meta's window ("Embedded Signup") — we receive, through Meta's official APIs:
- the IDs of the WhatsApp Business account, the phone number and the Instagram page or account, plus an access token;
- the messages its contacts send and the delivery status of the messages the business sends;
- if the business also uses the same number in the WhatsApp Business app on its phone (coexistence): the messages it sends from the phone and, if it authorizes it, the recent history of its chats and the names of its contacts.
Regarding this data, we commit that:
- it is used only to provide the service to the business that connected the account: displaying and replying to its conversations, organizing its CRM and, if enabled, letting its AI agent reply;
- we do not sell it, do not use it for advertising or profiling, and do not share it with third parties other than the providers listed in section 5;
- tokens and credentials are stored encrypted;
- we comply with the Meta Platform Terms and the WhatsApp Business Policy;
- when a channel is disconnected we stop receiving its data, and you can ask us to delete what was already received (see section 10).
4. How we use data
- To provide the service: scheduling, job assignment, reminders, quotes, payments, messaging and reports.
- To manage the account, subscription and billing.
- To provide support and send service notices (changes, security, billing).
- To keep the platform secure, prevent abuse and meet legal obligations.
- To improve the product using aggregated usage metrics; we do not use the content of the Customer's messages for this.
Our legal bases are performance of the contract with the Customer, our legitimate interest in running a secure service, compliance with legal obligations and, where applicable, consent.
5. Who we share data with
We use providers that process data on our behalf and only for these purposes:
- Meta Platforms (WhatsApp Business Platform, Instagram) and Telegram: sending and receiving messages on the channels the business connects.
- Anthropic and OpenAI: only if the business enables an AI agent, to generate replies from the conversation. Under their business terms, they do not use this data to train their models.
- Stripe and ONVO: processing the payments the business collects from its clients. Cuadrilly does not store card numbers.
- Polar: billing for the Cuadrilly subscription.
- OpenStreetMap / Nominatim: maps and converting addresses into coordinates.
- Cloud infrastructure providers (servers, database, backups) and email delivery providers.
We may also disclose data when required by law or a competent authority, or to protect people's rights and safety.
6. International transfers
Some of these providers are located outside Costa Rica (for example, in the United States). When we transfer data, we require appropriate safeguards equivalent to those in this policy.
7. How long we keep data
- While the Customer's account is active, we keep the data needed to provide the service.
- When the account is closed, or when the Customer asks, we delete its data within 30 days, except what we must keep by law (for example, invoices).
- Backups are overwritten on a rolling basis and disappear within 90 days at most.
8. Security
- Encrypted connections (HTTPS) and separation of each business's data.
- Tokens, credentials and API keys encrypted in the database.
- ID documents and criminal-record certificates kept in private storage, accessible only to authorized users.
- Role-based permissions within each business and an audit log of relevant actions.
No system is infallible; if an incident affects your data, we will notify you as required by law.
9. Your rights
Under Costa Rica's Law 8968 on the Protection of Individuals regarding the Processing of their Personal Data and other applicable laws, you can request access to your data, its correction or deletion, object to certain processing and withdraw your consent.
- If you have a Cuadrilly account, email us at privacy@cuadrilly.com.
- If you are a client, employee or contact of a business that uses Cuadrilly, please contact that business first, since it decides about your data. If you write to us, we will forward your request and help the business respond.
We reply within 10 business days at most. You may also file a complaint with Costa Rica's data protection agency (PRODHAB) or the authority in your country.
10. How to delete your data
If you are a business using Cuadrilly
- Disconnect a channel (WhatsApp, Instagram, Telegram): in Cuadrilly, go to Settings → Connected channels, choose the channel and click Disconnect. We will stop receiving its messages.
- Delete conversations: in the Inbox, open the chat and use Delete chat; all its messages and files are deleted.
- Remove access from Meta: in Meta Business Suite, go to Settings → Integrations → Partners / Connected apps and remove Cuadrilly. We will stop receiving data from that account.
- Delete your whole account and its data: email privacy@cuadrilly.com from the account owner's email address with the subject "Delete my account". We will confirm the request and delete the data within 30 days.
If you messaged a business on WhatsApp, Instagram or Telegram
Ask the business to delete your conversation, or email us at privacy@cuadrilly.com with your phone number or username and the name of the business. We will coordinate the deletion with the business and confirm once it is done.
11. Cookies
We only use cookies required for the site to work: the session, cross-site request forgery (CSRF) protection and your preferred language. We do not use advertising or third-party tracking cookies.
12. Children
Cuadrilly is intended for businesses, not for people under 18. We do not knowingly create accounts for minors.
13. Changes to this policy
We may update this policy. We will post the new version on this page with its date and, if the change is significant, notify account owners by email or in the app.
14. Contact
For any privacy question: privacy@cuadrilly.com.