Privacy Policy

This Privacy Policy explains how VYRD Inc. and its relevant affiliates ("we," “us,” “our”) — which operates ThreeAAA and Casabot — collect, use, disclose, retain, and protect Personal Information when you visit threeaaa.com, use Casabot on our site or on a contractor’s site, communicate with us, request home-service work, sign an agreement, or make a payment through our services (the “Services”).

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a person or household. It does not include information that is lawfully considered deidentified or aggregated under applicable law.

Important summary

• Casabot is an automated system. Some responses are generated by artificial intelligence.
• Your messages, photos, and property details are processed to run the intake, quote the work, schedule it, and produce an agreement.
• We may create deidentified information and use it to train, test, and improve our systems, as described in Section 4.
• If you ask to be connected with a contractor, we disclose your request to that contractor and may be paid for it. Some privacy laws treat that transfer as a “sale” of Personal Information.
• When you sign an agreement through Casabot, the agreement is between you and the contractor. ThreeAAA is the technology provider, not a party to the work, and not your contractor.
• We keep signature and payment records because they are the evidence of what you agreed to.
• You may have rights to access, correct, delete, or limit certain uses of your information and to opt out of its sale or sharing.

1. Scope and responsible parties

This Policy applies to the Services that link to it. It does not apply to an independent contractor, a payment processor, an advertiser, or any other third party operating under its own privacy notice, even if you reached them through Casabot.

Which entity is responsible depends on the context:

• ThreeAAA and Casabot: VYRD Inc. is the controller/business for information processed to operate the intake, scheduling, agreement, and payment services. ThreeAAA and Casabot are properties of VYRD Inc., not separate legal entities. [Confirm whether “ThreeAAA” is a registered fictitious business name in each state where consumer agreements are issued.]
• A contractor running Casabot on its own site: where a contractor deploys Casabot for its own intake, that contractor is generally the controller of the inquiries it receives, and ThreeAAA acts as its service provider or processor. The contractor’s own privacy notice applies to its use of that information.
• After a transfer: once your request is passed to an independent contractor at your direction, that contractor processes it under its own notice and its own legal obligations.

If these roles overlap, we will apply whichever protections applicable law requires.

Two ways you may encounter Casabot — and it matters which

1. On a contractor’s own website. The contractor licenses Casabot and runs it as their own intake. In that case the contractor is the controller of the conversation, and VYRD acts as its service provider. Your inquiry goes to that contractor and nowhere else. It is not sold, because there is nothing to sell — you contacted them directly. The contractor’s own privacy notice governs what it does with the information.

2. On a ThreeAAA page, such as one of our /chat/ trade pages. Here VYRD is the controller, and these pages exist to connect homeowners with contractors. If you ask to be connected, we transfer your request to a contractor and we may be paid for it — the disclosure in Section 6B applies, and privacy law may treat it as a sale.

The chat looks similar in both cases. The difference in what happens to your information is substantial, so we tell you which one you are in before you give us contact details.

Other VYRD properties

VYRD Inc. also operates Botineer, the platform Casabot is built on, which other businesses license to run their own assistants. We do not combine the information you give Casabot with information from another VYRD property or from another business’s Botineer deployment, and a home-service request is not used to build a profile across them.

Because VYRD Inc. is the business responsible, a privacy request you send us — access, deletion, correction, or an opt-out of sale — is honored across the VYRD properties where we can identify you, not only the one you contacted.

2. Information we collect

A. Information you provide

• Identity and contact information: name, email address, telephone number, service address, billing address, and communication preferences.
• Property information: property type, approximate age or year built, square footage, system type and age, access notes, and whether the property is owner-occupied or tenanted.
• Service request information: the trade you need, a description of the problem in your own words, urgency, timing, budget range where you supply it, and your answers to diagnostic questions.
• Photos and media: images or video of the problem or the property that you upload so a technician arrives knowing what they are walking into.
• Agreement and signature records: the document version presented to you, your electronic signature, the timestamp, the IP address from which you signed, and your consent to transact electronically.
• Payment information: deposit and fee transaction records, amounts, dates, status, and the last four digits and brand of a payment card. Full card data is collected directly by our payment processor and is never stored by ThreeAAA. Funds settle to the contractor, not to us.
• Scheduling information: the appointment window you selected and any changes to it.
• Communications: chat transcripts, messages, support requests, survey responses, and call recordings where permitted and disclosed.

B. Contractor and business information

Where you use the Services as a contractor or on behalf of one, we also collect business contact details, trade license numbers, insurance and bonding information you supply, service area, pricing and rate-card configuration, clause and template edits, calendar and accounting connection details, and account and billing records.

C. Information collected automatically

Device type, browser, operating system, IP address, approximate location derived from IP address, cookie and similar identifiers, pages viewed, links selected, session times, feature use, and security, fraud-prevention, and performance data.

D. Information from other sources

We may receive information from service providers, advertising and analytics partners, contractors who refer you, payment processors, and public sources, and may combine it with information collected through the Services.

E. Inferences

We may infer likely trade, urgency, job type, service area, or scheduling preference from other information. An inference is not a diagnosis, a quote, or a commitment that work will be performed.

3. Sensitive information

Please do not enter Social Security numbers, full financial-account numbers, passwords, authentication codes, or government identification into Casabot. The Services do not need them and no legitimate intake will ask for them.

Some home-service requests can reveal information that is sensitive under state law even though it is not obviously so. Accessibility and mobility work — grab bars, ramps, walk-in tubs, stair lifts, widened doorways — can indicate a disability or health condition. Where a request reveals that kind of information:

• we treat it as sensitive information and limit its use to fulfilling your request;
• we do not use it for advertising; and
• we do not sell it where applicable law requires a separate signed authorization that has not been obtained. See Section 9C.

4. Artificial intelligence and deidentified data

A. How Casabot uses AI

Casabot runs an authored workflow: the questions, the branches, and the wording are written in advance by ThreeAAA or by the contractor deploying it. Some responses within that workflow are generated or assisted by artificial intelligence. To operate these features, we and our contracted technology providers process your messages, uploaded media, generated responses, and related usage and device data.

Output may be reviewed by automated safety systems and, where appropriate, by authorized personnel for quality, security, abuse prevention, support, or legal compliance.

B. Training and improvement using Deidentified Data

We may create information from Service interactions that cannot reasonably be used to infer information about, or be linked to, a particular person or household ("Deidentified Data"), and use it to develop, train, test, validate, evaluate, benchmark, monitor, secure, research, and improve our models, workflows, safety systems, and other products.

We publicly commit to:

1. take reasonable technical and organizational measures designed to prevent Deidentified Data from being associated with a particular person or household;
2. maintain and use the information in deidentified form;
3. not attempt to reidentify it, except for controlled testing of whether our deidentification process works, and as otherwise expressly permitted by law; and
4. contractually require recipients of Deidentified Data to follow equivalent restrictions.

Deidentification may include removing or transforming direct and indirect identifiers, reducing detail, filtering unique narratives, separating account data, testing reidentification risk, restricting access, and applying contractual controls. Removing a name is not, by itself, deidentification. A service address, a property description, and an unusual job detail can identify a household together even when no name is present, and our process is designed around that fact.

We do not use identifiable intake content to train a general-purpose model for unrelated uses unless we give clear notice and obtain affirmative consent where required. Our service providers may process identifiable content only to provide contracted services to us, and may not use it to train their own independent general-purpose models unless we separately disclose and lawfully authorize that.

Photographs of your property are not used for model training unless they have been reviewed and cleared through the deidentification process, because an image of a house is frequently identifying on its own.

C. Changes to training practices

We will not rely on a retroactive policy change to use previously collected identifiable content for a materially expanded training purpose. If additional notice or consent is required, we will provide it before beginning that use.

5. How we use information

We use Personal Information to operate and improve the Services, run intake and diagnostics, quote and schedule work, generate and execute service agreements, process deposits and fees, communicate with you about your request, provide support, detect and prevent fraud and abuse, comply with law and recordkeeping obligations, establish or defend legal claims, send marketing where permitted and honor opt-outs, and create and use Deidentified Data as described above.

We will not use Personal Information for a materially different, unrelated purpose without any additional notice or consent the law requires.

6. How we disclose information

A. Service providers

Vendors that host data, process payments, send communications, provide analytics, security, AI infrastructure, document processing, or support. They may process the information only for contracted purposes.

B. Contractors and service professionals

If you ask to be connected with a contractor, we may disclose your Request Data — name, contact details, service address, the trade requested, a summary of the problem, photos you uploaded, timing, and communication preferences — to one or more independent contractors ("Contractor Recipients").

We may be paid a fixed fee, subscription fee, lead fee, or other consideration in connection with that transfer, whether or not you hire anyone. Applicable privacy law may define this as a sale of Personal Information. The fact that the chat is free to you does not mean your information moves for free.

We will give clear notice and obtain the direction or consent applicable law requires before transferring Request Data. A Contractor Recipient is an independent business and will use the information under its own privacy notice to evaluate your request, contact you, and offer services.

Unless specifically disclosed before you authorize the transfer:

• we will not send Request Data to contractors outside the trade you asked for;
• we will not disclose more than is reasonably necessary for the connection you requested;
• we will not sell Social Security numbers, account passwords, financial credentials, authentication codes, or complete payment-card data; and
• we will not sell information that reveals a health condition or disability where a separate signed authorization is required and has not been obtained.

C. Advertising and analytics partners

Device, cookie, usage, and advertising information may be disclosed to partners that measure campaigns or deliver advertising. Depending on the technology and the law, that may constitute a “sale,” “sharing,” or targeted advertising even where no money changes hands. See Section 8 for opt-outs.

We do not use the content of a service request for cross-context behavioral advertising. What is wrong with your house is not advertising signal.

D. Payment processing

Deposits and fees settle directly to the contractor’s own payment account. The contractor is the merchant of record; ThreeAAA does not hold or take custody of consumer funds. Our payment processor collects and processes card data directly. We receive transaction metadata — amount, date, status, and the last four digits and brand of the card — so we can show you a receipt and attach the payment to your agreement. We do not receive or store full card numbers.

E. Corporate transactions, legal and safety

We may disclose information in connection with a financing, merger, acquisition, reorganization, bankruptcy, or asset sale, subject to confidentiality requirements; and where we reasonably believe disclosure is necessary to comply with law or valid legal process, protect a person’s safety, investigate fraud, enforce agreements, or establish or defend legal claims.

F. With your direction, and deidentified data

We may disclose information where you direct us to, and may disclose Deidentified Data or aggregated information subject to the commitments in Section 4.

7. Agreements, signatures, and payment records

When you sign a service agreement through Casabot, the agreement is between you and the contractor. ThreeAAA provides the technology that produces the document, captures the signature, and processes the deposit. We are not a party to the work, we are not your contractor, and we do not perform, warrant, or supervise it.

We retain the executed document, the version of the template that was presented to you, your signature, the timestamp, the originating IP address, and your consent to transact electronically. These records exist to protect both sides. They are what shows what you actually agreed to, and we retain them for at least the period in which a dispute about the agreement could arise. See Section 11.

You may request a copy of any agreement you signed through the Services at any time.

8. Your privacy rights and choices

Depending on where you live, and subject to legal exceptions, you may have the right to confirm whether we process your information; access or obtain a copy; correct inaccuracies; delete certain information; opt out of sale, of sharing for cross-context behavioral advertising, and of targeted advertising; opt out of certain profiling; limit certain uses of sensitive information; withdraw consent; and appeal a refusal.

Submit a request through [Privacy Request URL], or email [privacy@threeaaa.com] with the subject “Privacy Request.” To opt out of sale or sharing, use [Your Privacy Choices link].

We may need to verify your request. An authorized agent may submit one where permitted. We will respond within the period the law requires and explain any right to appeal. We will not unlawfully discriminate against you for exercising a right.

A deletion request does not undo work already performed, and it does not delete a signed agreement or payment record that we are required to keep, or that a contractor holds as a party to that agreement. Where we must retain a record, we will say so and limit its use.

Opt-out preference signals

Where required, we treat a qualifying universal opt-out signal, including Global Privacy Control, as a request to opt out of sale, sharing, and targeted advertising for the browser or device sending it. A legacy “Do Not Track” header is not the same thing.

Marketing communications

Unsubscribe from marketing email using the link in the message. Reply STOP to opt out of marketing texts. We may still send non-marketing messages about a job you booked — appointment confirmations, technician arrival, and payment receipts.

Withdrawing a transfer permission

You may withdraw permission for future transfers using [method]. Withdrawal does not undo a transfer already made. After a transfer, contact the contractor directly about its copy.

9. State disclosures

A. California

California residents have the rights in Section 8. The table below must be conformed to actual data-mapping records before publication.

We do not knowingly sell or share the Personal Information of consumers under 16.

B. Other states

Residents of other states with comprehensive privacy laws may exercise their rights using the methods in Section 8. We recognize qualifying universal opt-out mechanisms where required.

C. Consumer health data

Most home-service requests do not involve health data. Accessibility and mobility work can. Where a request reveals a health condition or disability and a state consumer-health privacy law applies, that law’s requirements control. We will not sell that information where a separate signed authorization is required unless the authorization has been completed and contains every term the statute requires.

[Operational recommendation: exclude accessibility and mobility requests from the ordinary lead flow, or transfer only a non-revealing request — “homeowner requests a bathroom remodel consultation” — and let the homeowner supply the detail directly to the contractor they choose.]

10. Data retention

We retain each category only as long as reasonably necessary for the purpose disclosed, considering sensitivity, the service involved, account status, limitation periods, legal holds, and regulatory requirements.

• Account and subscription records: for the account lifecycle plus a reasonable legal and audit period.
• Chat transcripts: for the support, safety, and dispute-resolution period applicable to the service. Where a transcript is the record of how an agreement was reached, it is retained with the agreement.
• Signed agreements, signature audit trails, and payment records: for at least the period in which a claim on the agreement could be brought, and any longer period the law requires.
• Property photos: for the job lifecycle plus a limited period, then deleted unless attached to a disputed agreement.
• Transfer and consent records: long enough to evidence the transfer and the authorization, and for any period telemarketing or privacy rules require.
• Deidentified Data: as described in Section 4.
• Backups: for a limited period after deletion until overwritten.

We will not retain Personal Information longer merely because storage is inexpensive.

11. Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature and sensitivity of the information, which may include access controls, encryption in transit and where appropriate at rest, logging, vendor review, incident response, training, and data minimization. No system is completely secure and we cannot guarantee absolute security. If a breach occurs, we will investigate and provide legally required notifications in the time and manner the law requires.

12. Children

The Services are intended for people 18 or older. We do not knowingly collect Personal Information from a child under 13, or knowingly sell or share the information of anyone under 16.

13. International users

The Services are controlled from the United States and directed to users in the United States. Information may be processed in the United States or other countries where our providers operate.

14. Changes

We may update this Policy and will post the new version and effective date. If a change materially expands how we use or disclose information already collected, we will provide additional notice and obtain consent where required, rather than relying on continued use alone.

15. Contact

VYRD Inc. (operating ThreeAAA and Casabot) [Confirm registered address — the 1LAW filings use 311 South State Street, Suite 450, Salt Lake City, Utah 84111] [privacy@threeaaa.com] [phone] [Privacy Request URL] [Appeal instructions]