Privacy policy

Last updated: August 2026

Plain-language answers about how we handle your data.

This Privacy Policy explains what information Lakehouse collects, how we use it, who we share it with, and the choices you have. It covers the Lakehouse mobile app, web app, and admin portal.

Who we are and our role

Lakehouse provides field service software for home service businesses. For the accounts of our staff and business users, we act as the data controller. For the end-customer data a business enters into Lakehouse (its customers, jobs, and communications), the business is the controller and Lakehouse acts as a processor on its behalf, handling that data under our agreement with the business.

Data we collect

Staff and account data. Name, email, phone, role, and identity information from Google Sign-In, Apple Sign-In, or an email one-time code.

Contact data the business enters. Customer, general contractor, property manager, and vendor names, emails, and phones, along with service addresses, billing addresses, notes, and SMS-consent status.

Job and equipment data. Job details and scheduling, equipment make, model, and serial numbers, and photos including job before and after photos and equipment nameplate photos, stored in Supabase Storage.

Communications content. Two-way SMS and email threads, and phone-call metadata from the click-to-call voice bridge.

Payment-related data. We store Stripe customer, invoice, and quote references, amounts, statuses, and due and paid dates. Card and bank details are handled by Stripe and are not stored by Lakehouse.

Address autocomplete. Address queries are sent to the Google Places API to suggest and verify addresses.

Device, usage, and log data. IP address, device information, timestamps, and diagnostics.

Third-party service providers (sub-processors)

We use a small number of third-party service providers to operate the Service. Each receives only the data necessary to perform its function. Each provider processes that data under its own privacy policy and terms of service, which are linked at the end of this section, and we select providers whose published commitments are consistent with the protections described in this policy.

Supabase, Inc. (United States) — Database, authentication, and file storage; the hosting layer for the Service. Processes all data you and your customers enter into the Service, including contact records, addresses, jobs, documents, messages, photos, and uploaded files.

Retell AI, Inc. (United States) — AI phone answering, where a business has enabled it. Processes audio of the inbound call, real-time transcription, an AI-generated summary, the call recording, the caller’s phone number, and details the caller provides during the call: name, callback number, email address if offered, service address, preferred appointment time, reason for calling, answers to the business’s intake questions, and whether they consent to text messages.

Twilio Inc. (United States) — Telephone numbers, voice calls, and SMS text messaging. Processes business and customer phone numbers, the content of SMS messages sent and received, delivery status, and call metadata such as time, duration, and caller ID. For A2P 10DLC regulatory registration, it also processes the business’s registration details, such as legal name, address, and tax identification number.

Twilio SendGrid (United States) — Sending and receiving email. Processes sender and recipient email addresses, subject lines, message bodies, attachments, message identifiers, and delivery events.

Stripe, Inc. (United States) — Payment processing and invoicing. For a business’s customers, processes name, email address, billing and service address, invoice and estimate line items and amounts, tax, and payment status. For the business itself, processes legal entity details, billing email, and subscription payment details. Payment card details are entered directly with Stripe; we never receive or store card numbers.

Google LLC (United States) — Four separate functions, described below.

Apple Inc. (United States) — Sign in with Apple, and push notification delivery to iOS devices. Processes name and email address, or Apple’s private relay address, for users who sign in with Apple, together with the device push token and notification content.

Expo (650 Industries, Inc.) (United States) — Push notification relay and over-the-air app updates. Processes device push tokens and the title, body, and routing data of push notifications sent to staff devices.

Google services

Google provides four distinct functions, which process different data:

  • Google Sign-In — for staff who sign in with a Google account: email address, name, profile image, and Google account identifier.
  • Google Places — when a user types into an address field, the partial address text is sent to Google to return address suggestions. No other record data is sent.
  • Firebase Cloud Messaging — device push tokens and notification content, used to deliver notifications to Android devices.
  • Google ML Kit (on-device) — text recognition used to read a receipt or an equipment label the user photographs. This runs entirely on the device. No image, no recognized text, and no other data is transmitted to Google or to any other party for this feature.

Artificial intelligence and your data

The Service uses artificial intelligence in two places, and they work very differently.

AI phone answering (optional, configured by the business). If a business enables this feature, incoming telephone calls to that business’s own phone line may be answered by an automated assistant provided by Retell AI, Inc. The assistant discloses at the start of the call that it is an AI assistant. The call audio, the transcript, an AI-generated summary, and the call recording are processed and stored by Retell AI under Retell AI’s own privacy policy and terms, linked below. The resulting message is delivered to the business. This feature operates on the business’s telephone line at the server level; it is configured through our web administration portal, and is not enabled, controlled, or performed by our mobile application. A business considering this feature should review Retell AI’s privacy policy and terms before enabling it.

On-device text recognition. When a user photographs a receipt or an equipment label, text recognition runs entirely on the user’s device using Google ML Kit. No image or extracted text leaves the device for this feature, and no third-party AI service is contacted.

Provider privacy policies

SMS messaging disclosures

With your consent, Lakehouse sends transactional text messages such as job, invoice, estimate, and subscription notices. Reply STOP to opt out at any time, and START to opt back in. Message and data rates may apply, and message frequency varies based on your activity.

Mobile opt-in data and consent are not shared or sold to third parties for marketing.

How we use data

We use information to provide and improve the service, authenticate users, schedule and manage jobs, send messages you initiate, process payments, verify addresses, provide support, and meet legal obligations.

Legal bases

Where required, we process personal data on the bases of performing our contract with you, your consent (for example, SMS messaging), our legitimate interests in operating and securing the service, and compliance with legal obligations.

Sharing and disclosure

We share data with the sub-processors listed above to run the service, and we may disclose data to comply with the law or a valid legal request, or in connection with a business transfer such as a merger or acquisition. We do not sell your personal information.

Data retention

We retain personal data for as long as an account is active and as needed to provide the service, then for a limited period afterward to meet legal, accounting, and dispute-resolution requirements, after which it is deleted or anonymized.

Security

We use reasonable technical and organizational safeguards, including encryption in transit, access controls, and authentication through trusted providers, to protect personal data.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can request account deletion directly through the in-app "Request account deletion" flow, or by emailing us. Residents of California have rights under the CCPA and CPRA, including the right to know, delete, correct, and opt out of sale or sharing (we do not sell personal information). Residents of the EEA and UK have rights under the GDPR. To exercise any right, contact customersupport@getlakehouseai.com.

Children

Lakehouse is not directed to children. We do not knowingly collect personal information from anyone under 13, or under 16 where a higher age applies.

International data transfers

We are based in the United States and process data there. Where data is transferred from other regions, we rely on appropriate safeguards as required by law.

Cookies and local storage

The web build uses cookies and local storage to keep you signed in, remember preferences, and understand usage so we can improve the product. You can control cookies through your browser settings.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected here with a new effective date. This policy is effective as of July 2026.

Contact

For privacy questions or requests, email customersupport@getlakehouseai.com. Lakehouse is headquartered at 1763 Columbia Rd NW, Washington, DC 20009.