Last updated: July 2026
SepticCycle (“we,” “us,” or “our”) operates the website at www.septiccycle.com and the SepticCycle platform (collectively, the “Service”). SepticCycle is a Texas-based software-as-a-service platform for septic, grease-trap, and portable-sanitation service companies (“operators”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website or use our Service.
This Privacy Policy applies to two categories of individuals whose data we process: (i) operators who subscribe to and use the Service, and (ii) end-customers whose personal information operators input into the Service (such as customer names, addresses, phone numbers, property records, and SMS consent status).
Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.
2.1 SepticCycle as Controller. With respect to operator account information (name, email, company name, billing information, account credentials, and usage data), SepticCycle acts as the controller, and we determine the purposes and means of processing this data to provide, maintain, secure, and improve the Service.
2.2 SepticCycle as Processor. With respect to end-customer data that operators input into the Service (customer names, addresses, phone numbers, property and tank records, service history, SMS consent status, and contract or invoice data), SepticCycle acts as a processor, and we process this data on behalf of and under the instructions of the operator. Operators are the controllers of their end-customer data and are responsible for providing all required notices to, and obtaining all required consents from, their end-customers under applicable law.
2.3 Subprocessing. When we engage subprocessors (listed in Section 5) to assist in processing end-customer data, we do so under written data processing agreements that impose obligations substantially equivalent to those in this Privacy Policy, including restrictions on use, security requirements, breach notification, and data deletion. For full details on how we process personal data on behalf of operators, see our Data Processing Addendum at www.septiccycle.com/dpa.
We collect information you voluntarily provide when you: (i) create an account (name, email address, password, company name); (ii) set up your company profile (business address, phone number, service area); (iii) add customer records (customer names, addresses, contact information, property details); (iv) create contracts, invoices, and job records; (v) connect a payment processor (Stripe account information); or (vi) contact us for support.
When an operator using the SepticCycle platform records SMS consent for a customer, we collect and store that customer’s mobile phone number and consent status for the purpose of sending service-related text messages on the operator’s behalf. This includes appointment reminders, technician notifications, job completion updates, and invoice or payment reminders.
Consent is recorded via an optional, unchecked-by-default checkbox on the customer record form. Mobile phone numbers collected for SMS are used solely to deliver transactional, service-related messages on behalf of the operator. They are never used for marketing purposes and are never sold, rented, or shared with third parties outside of the subprocessors listed in Section 5. For full details on how SMS consent is collected and how to opt out, see our SMS Terms & Conditions at www.septiccycle.com/sms-terms, including the SMS Opt-In Documentation in Section 11 of those Terms.
When you access the Service, we may automatically collect: (i) device and browser information (type, version, operating system); (ii) IP address and approximate location derived from IP address; (iii) pages visited, features used, and actions taken within the Service; (iv) date and time of access; and (v) referring website or source.
Payment processing is handled by Stripe. We do not store credit card numbers or bank account details on our servers. Stripe’s privacy policy governs the handling of your payment information. See stripe.com/privacy.
We use the information we collect to: (i) provide, operate, and maintain the Service; (ii) process transactions and send related information (invoices, confirmations, reminders); (iii) send transactional emails on your behalf (invoice emails, appointment reminders); (iv) send transactional SMS notifications on behalf of operators to their customers (with explicit consent recorded through the Service); (v) respond to your comments, questions, and support requests; (vi) monitor and analyze usage trends to improve the Service; (vii) detect, prevent, and address technical issues, fraud, or violations of our Terms of Service; (viii) send you product updates and marketing communications (with your consent, and subject to your right to opt out at any time); and (ix) comply with applicable legal and regulatory obligations.
Clarification regarding service improvement. When we reference “improve the Service” in this Section 4, we do so in our capacity as controller of operator account information and service usage data (as described in Section 2.1), not in our capacity as processor of end-customer data. We do not use end-customer data input by operators for service improvement, analytics, product development, or any purpose beyond providing and maintaining the Service on the operator’s behalf. Our processing of end-customer data is governed by our Data Processing Addendum.
We do not sell your personal information. We do not use your personal information for targeted advertising. We do not process your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
We share data with the following subprocessors who perform services on our behalf. Each subprocessor processes data only as necessary to provide its designated service to SepticCycle and is contractually prohibited from using your data for any other purpose.
An up-to-date list of our subprocessors is maintained at www.septiccycle.com/subprocessors.
We may also share information in the following circumstances: (i) Your customers: when you use the Service to send invoices, contracts, or appointment reminders, your company information is shared with your customers as part of those communications; (ii) Legal requirements: we may disclose information if required by law, regulation, legal process, or governmental request; and (iii) Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, and we will provide notice before your information becomes subject to a different privacy policy.
We have entered into data processing agreements with each of our subprocessors, which include obligations regarding data security, breach notification, subprocessor restrictions, and data deletion or return upon termination.
Mobile phone numbers collected for SMS notifications are never sold, rented, or shared with third parties for marketing purposes. They are transmitted to Twilio solely to deliver service-related messages on behalf of the operator. Twilio’s use of this data is governed by their privacy policy at twilio.com/legal/privacy.
We use essential cookies to maintain your session, authentication state, and security. These cookies are necessary for the Service to function and cannot be disabled.
We use Google Analytics on our marketing website (www.septiccycle.com) to understand how visitors interact with our site. Google Analytics uses cookies to collect aggregated usage data, including how often you visit, what pages you view, and what other sites you visited prior to coming to our site.
We do not use Google Analytics for targeted advertising. Google Signals is disabled in our configuration, and personalized advertising through our Google Analytics integration is disabled. Google’s ability to use and share information collected by Google Analytics is governed by the Google Analytics Terms of Service and the Google Privacy Policy.
You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on, available at tools.google.com/dlpage/gaoptout.
Google Analytics does not run in the authenticated (logged-in) portion of the Service.
Our hosting provider, Vercel, offers an analytics product (Vercel Analytics). As of the date of this Privacy Policy, Vercel Analytics is not active on the SepticCycle platform and does not collect any data. If we activate Vercel Analytics in the future, we will update this Privacy Policy before it begins collecting data.
When you visit our marketing website, a consent banner will inform you about the non-essential cookies we use and offer you the choice to accept or decline them. Non-essential cookies (including Google Analytics cookies) are not placed until you affirmatively accept them. If you take no action on the consent banner, only essential cookies will be set. You may change your preference at any time by clicking the “Cookie Settings” link in the footer of any page on our website. For detailed information about the cookies we use and how to manage them, see our Cookie Policy at www.septiccycle.com/cookies.
Some browsers transmit “Do-Not-Track” (DNT) signals. There is currently no industry standard for how websites should respond to DNT signals. We do not currently respond to DNT signals, but we do recognize the Global Privacy Control (GPC) signal as described in Section 8.6.
We implement appropriate technical and organizational security measures to protect your information. These include: (i) encryption in transit (TLS/SSL) and encryption at rest; (ii) role-based access controls; (iii) row-level security policies in our database that ensure each operator’s data is completely isolated from other operators on the platform; (iv) multi-factor authentication for administrative access; and (v) regular security reviews and monitoring.
However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.
SepticCycle may qualify as a small business under the Texas Data Privacy and Security Act’s exemption for businesses meeting SBA size standards. Regardless of whether we qualify for this exemption, we voluntarily provide the privacy rights described in this Section 8 to all users and end-customers of the Service. These commitments reflect our values, not solely our legal obligations, and we honor them as described in this Privacy Policy.
Depending on your location and applicable law, you may have the following rights with respect to your personal information. To exercise any of these rights, contact us at privacy@septiccycle.com. We will respond to verifiable requests within forty-five (45) days of receipt. If we need additional time, we will notify you within the initial forty-five-day period and will respond within ninety (90) days of the original request.
8.1 Right to Access. You may request confirmation of whether we process your personal information and, if so, request a copy of that information.
8.2 Right to Correction. You may request that we correct inaccurate personal information we hold about you.
8.3 Right to Deletion. You may request that we delete your personal information, subject to certain exceptions (such as where retention is required by law or necessary to complete a transaction you requested).
8.4 Right to Data Portability. You may request a copy of your personal information in a structured, commonly used, machine-readable format. You may also export your data at any time through the Service.
8.5 Right to Opt Out. You may opt out of: (i) marketing communications at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at privacy@septiccycle.com; (ii) SMS notifications at any time by replying STOP to any message; and (iii) non-essential cookies through the consent banner on our marketing website or through your browser settings.
8.6 Right to Opt Out of Targeted Advertising, Sale, or Profiling (Texas TDPSA and Other State Laws). We do not sell your personal information, share your personal information for targeted advertising, or engage in profiling in furtherance of decisions that produce legal or similarly significant effects. If we change these practices in the future, we will update this Privacy Policy and provide an opt-out mechanism before engaging in any such processing. We recognize the Global Privacy Control (GPC) signal. If your browser or device sends a GPC signal, we will treat it as a valid request to opt out of any processing that constitutes targeted advertising or sale of personal data under applicable law.
8.7 Right to Appeal (Texas Residents). If we decline to take action on a request you submit under this Section 8, we will inform you of our reasons and provide instructions for how to appeal within forty-five (45) days of receiving your request. To appeal, send a written request to privacy@septiccycle.comwith the subject line “Privacy Rights Appeal.” We will respond to your appeal within sixty (60) days of receiving it. If we are unable to respond to your initial request within forty-five (45) days, we will notify you of the extension and the reason for it within that initial period, and will respond within ninety (90) days of the original request. If your appeal is denied, you may contact the Texas Attorney General to submit a complaint at www.texasattorneygeneral.gov.
8.8 Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, or provide you a different level or quality of service because you exercised a right under this Section 8.
8.9 Authorized Agents.You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent’s authority before processing the request.
8.10 End-Customer Rights. If you are an end-customer of a septic service company that uses SepticCycle, your service provider (the operator) is the controller of your personal information. To exercise your privacy rights with respect to data held in SepticCycle, please contact your service provider directly. If your service provider is unable to fulfill your request, you may contact us at privacy@septiccycle.com and we will assist the operator in responding.
9.1 Retention Criteria. We retain your information based on the following criteria: (i) for as long as your account is active or as needed to provide you the Service; (ii) as necessary to comply with our legal, regulatory, tax, accounting, or reporting obligations; (iii) as necessary to resolve disputes, enforce our agreements, or establish or defend legal claims; and (iv) as described in any applicable data processing agreement with an operator.
9.2 Account Deletion.If you close your account, you may export your data using the Service’s export functionality for a period of thirty (30) days following the termination effective date. We will delete or anonymize your personal data within 90 days of the termination effective date, unless we are required to retain it for legal or regulatory purposes. Residual copies of your data may persist in encrypted backups beyond the 90-day deletion window but will not be actively processed and will be overwritten in the ordinary backup rotation cycle.
9.3 End-Customer Data.End-customer data is retained for as long as the operator’s account is active or as instructed by the operator. Upon termination of an operator’s account, end-customer data is deleted in accordance with Section 9.2.
10.1 Notification to Operators. In the event of a confirmed security incident involving unauthorized access to, or unauthorized disclosure of, end-customer personal information that we process on behalf of operators, we will notify affected operators (as controllers of their end-customer data) without unreasonable delay and in any event within seventy-two (72) hours of confirmation, in accordance with our Data Processing Addendum. We will cooperate with affected operators so they may fulfill their own notification obligations to their end-customers and to regulatory authorities under applicable law.
10.2 Notification to Individuals (Controller Data).With respect to operator account information for which SepticCycle is the controller, we will notify affected individuals directly as required by applicable law, including the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code §521.053) and any other applicable state or federal breach notification statutes.
10.3 Cooperation. SepticCycle will provide reasonable cooperation and assistance to affected operators in connection with their investigation of any security incident and their obligations to notify regulatory authorities or affected individuals under applicable law, as further described in our Data Processing Addendum.
We do not knowingly collect or process sensitive personal data as defined by the Texas Data Privacy and Security Act, including racial or ethnic origin, religious beliefs, health diagnoses, sexuality, citizenship or immigration status, genetic or biometric data, children’s data, or precise geolocation data that directly identifies the specific location of a natural person. The Service stores property addresses and geographic coordinates entered by operators to identify service locations (such as the location of a septic tank, grease trap, or property boundary) for the purpose of service delivery and route optimization. These coordinates identify the location of a property or piece of infrastructure, not the real-time or specific location of any individual, and are static records that do not track consumer movement or whereabouts. If we become aware that sensitive data has been provided to us without the required consent, we will take steps to delete it. We will not sell sensitive personal data without the data subject’s explicit consent.
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@septiccycle.com.
The Service is operated from the United States. If you access the Service from outside the United States, you understand and consent to the transfer, storage, and processing of your information in the United States, where data protection laws may differ from those in your jurisdiction. We process data transferred from outside the United States in accordance with applicable law and the contractual safeguards described in our subprocessor data processing agreements.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page, updating the “Last updated” date, and, for material changes, sending notice by email to the address associated with your account at least thirty (30) days before the changes take effect. At the time an updated Privacy Policy takes effect, you will be required to affirmatively re-accept the updated Privacy Policy through the Service before continuing to use it. We encourage you to review this Privacy Policy periodically.
If you have questions about this Privacy Policy, wish to exercise any of your rights under Section 8, or wish to submit a complaint, please contact us at:
SepticCycle
Privacy Inquiries: privacy@septiccycle.com
Legal Inquiries: legal@septiccycle.com
Website: www.septiccycle.com