Privacy policy

Effective date: October 25, 2026

This policy explains what personal data Thinkfleet AI, LLC, a North Carolina limited liability company ("iSpector", "we", "us") collects, why, who we share it with, and the choices you have. It covers the ispector.ai website, the iSpector web app at app.ispector.ai, the iSpector inspector app for iOS and Android, and the pages iSpector hosts for the businesses that use it (client and agent portals, report, agreement, repair request, invoice and quote links, booking pages, payment pages, website chat and business websites).

Two kinds of people, two roles

iSpector is software for home inspection businesses. That means two kinds of people show up in iSpector.

• Our customers. The inspection businesses that sign up for iSpector, and the people who work for them (owners, office staff, dispatchers and inspectors). For their account and billing data, and for visitors to ispector.ai, iSpector decides how the data is used. We are the controller (in US state law terms, the "business").
• The people our customers work for and with. The clients of those businesses (home buyers, sellers and owners), the real estate agents and other people on an inspection, and visitors to the businesses' booking pages, websites and website chat. A business puts their names, addresses, phone numbers, inspections, reports, agreements, invoices, photos, calls and messages into iSpector to run its work. For that data the business is the controller and iSpector is a processor (a "service provider"). We handle it only to provide iSpector to that business and on its instructions.

If you are a client or agent of a business that uses iSpector (for example, you received a report link, an agreement to sign, a reminder text or an invoice), that business is responsible for your data. Please contact the business first with questions or requests about your information. If you contact us, we will pass your request to the business and help it respond.

What we collect from businesses and their staff

Account data. Name, email address, phone number, password or passkey, second-factor settings, the business (organization) you belong to and your role in it. Sign-in, sessions, organizations, members, invitations and roles are handled by Base316, our account and billing provider. Your session is kept in a secure, httpOnly cookie on app.ispector.ai.

Billing data. Your plan, billing interval, trial status, seats, add-ons, invoices, usage (AI-assisted inspections, AI credits, texts, emails, phone numbers, call minutes and recordings), whether a payment method is on file, and credit pack purchases. Plan changes, payment cards and invoices are handled in Base316's billing portal. iSpector does not receive or store your full card number.

Business data. Everything you enter or create to run your business: clients and their contacts, real estate agents and other people on an inspection, properties and their addresses, requests, quotes, inspections, visits, schedules, inspection reports, agreements, repair requests, invoices, payments, pricebook, expenses, property systems and equipment, notes, photos, videos, forms, signatures, timesheets, calls, messages, team chat, automations, reviews, websites and settings. See "What we process for businesses" below.

Inspector app data. When an inspector uses the iSpector app:

• the inspections for today and tomorrow, stored on the phone in an encrypted database so the app works without signal, and deleted from the phone on sign-out;
• shift clock, breaks, travel and inspection times, with the time each action happened;
• photos and short videos taken at the inspection (with any markup drawn on them), notes, checklists, forms, signatures, quotes and payments recorded on site;
• a push notification token, so the app can tell the inspector when their inspections are booked, moved or canceled, and office users about new client texts and website chats (notifications are delivered through Expo's push service and Apple's or Google's);
• inspection reports written in the app: statuses, findings, notes, the photos and video clips attached to them and any markup drawn on them, and the agreement the client signs on the phone (the client's typed name, the drawn signature and the time);
• the comment library of the business's report templates, kept on the phone with the reports so they open without signal.

Camera and photos. With the inspector's permission, the app uses the camera to take inspection photos and video clips, and the photo library to attach photos the inspector chooses. Photos go only to the inspection they are taken for, as records of the business.

Microphone. With the inspector's permission, the app uses the microphone for calls with clients through the business's phone line (the business decides whether its phone system records its calls; the recording, when there is one, is a record of the business), for the sound on video clips and, only when the inspector turns on the wake word ("Hey Rex" or another name they pick), to listen for that name. The wake-word listening runs on the phone itself with a small open-source speech model: before the name is said, nothing is recorded, kept or sent anywhere, and the few words spoken after the name (a command such as "next" or "take a photo", or a note) are recognized on the phone too. Only the text of a note or an answer is sent to iSpector, exactly as a typed note would be. No audio from the wake word ever leaves the phone. Notes dictated with the phone's keyboard are turned into text by the phone's own keyboard (Apple's or Google's, under their terms); iSpector receives only the text. The inspector can turn the wake word off at any time on the same screen, and it stops by itself after a period of silence.

Location. With the inspector's permission ("while using the app"), the app shares the phone's precise location only while the inspector is clocked in or on the way to an inspection, and only while the app is open. It pauses when the app goes to the background and is never collected off the clock. The business's office sees the inspector's latest position on its dispatch map. When the inspector taps "On my way", the client they are driving to can follow them on a tracking link until they arrive, never before or after. We keep each inspector's latest position and a trail of positions for two weeks, then delete the trail. An inspector can turn location off in the phone's settings; the rest of the app keeps working. "Directions" opens Google Maps, Apple Maps or Waze, which are separate apps with their own privacy policies. The in-app map shows inspection addresses on map tiles from OpenFreeMap. Face ID or fingerprint unlock is handled by the phone itself; iSpector never receives biometric data.

Usage and technical data. Our servers record requests (such as the page or operation, the time, the result and a request ID) to run, secure and debug the service. We keep an activity log of changes made in each business (who did what and when, including changes made by Flo, the AI assistant, or through the API). We use IP addresses, or a one-way hash of them, for rate limiting and abuse prevention.

Support and communications. What you send us by email, live chat or our forms.

What we process for businesses

When a business uses iSpector, it may put the following personal data about its clients and the other people on its inspections into iSpector, and iSpector processes it on the business's behalf:

• names, contact people, email addresses and phone numbers, and contact preferences (whether a number may be texted, whether marketing emails are allowed);
• real estate agents and other people on an inspection: name, brokerage or company, email, phone, license number, their role on the inspection, and whether they are notified and may see the report;
• property addresses and details (such as size, year built and foundation). Addresses are converted to map coordinates (geocoded) using OpenStreetMap's Nominatim service;
• requests, quotes, inspections, visit history, the property's systems and equipment, inspection reports with their photos, videos and findings, repair requests, signatures and notes;
• agreements: the exact wording the client signed, their typed name, an optional drawn signature, the time, and the IP address and browser they signed from, kept as the record of the signature;
• invoices, payments, tips, refunds and card fees. For online payments, iSpector stores the card brand and last four digits, never the full card number (see "Payments");
• emails and text messages the business sends through iSpector, and replies;
• phone calls on the business's iSpector phone line (see "Phone calls, recordings and the AI receptionist");
• website chat conversations (see "Website chat");
• online booking and website form submissions, with where the visitor came from (the page, referrer, campaign tags and ad click IDs);
• Google reviews of the business, and which client wrote a review when the reviewer's name matches exactly one client;
• when the business turns on visit safety, a count of public sex offender registry listings near a property and a short description, never who they are (the property's approximate coordinates or ZIP code are sent to the lookup service; nothing is shown to the client);
• weather forecasts for inspection days, looked up with coordinates rounded to about 1 km.

Clients and agents also use pages iSpector hosts for the business: the client portal and the agent portal, report, agreement, repair request, invoice and quote links, payment pages, online booking, the email and text preferences page, website chat and the business's website. What they enter there goes to the business.

Client and agent sign-in. Clients and real estate agents sign in to a business's portal with a one-time code sent by email or text to the address the business has on file; there is no password. The code is stored only as a one-way hash and expires. A signed-in session is kept in a secure, httpOnly cookie for up to 30 days. To prevent guessing, failed attempts are counted per IP address.

What we collect on ispector.ai

Demo and contact forms. Your name, email address, and optionally your phone number, business name, trade, team size and message, plus the page you sent it from. We email each request to our team through Amazon Simple Email Service (Amazon SES), and we may also file it as a lead in our own iSpector account. We use it to answer you and to follow up about iSpector.

Scheduling a demo. After a demo request you can pick a time on our Cal.com booking page. We pass it your name and email to fill in the form. Cal.com handles the booking under its own privacy policy.

Live chat. The chat bubble is provided by Crisp. If you use it, Crisp receives your messages and anything you choose to share (such as your email address), along with technical information about your browser. Crisp stores cookies and local storage in your browser to keep your conversation going between pages and visits.

Photos and maps. Some photos on ispector.ai and on business websites built with iSpector are loaded directly from Unsplash or Pexels, as their terms require. Maps in the web app load map tiles from OpenStreetMap, and maps in the inspector app from OpenFreeMap. When your browser or phone loads an image or a map tile, that service receives your IP address and browser or device information.

Website analytics. With your permission, we use Google Analytics on ispector.ai to understand traffic, page views, referral sources and how visitors use the website. Google Analytics uses cookies and receives technical information about your browser and visit. The Google Analytics tag does not load until you choose Allow analytics. We remember your choice for 30 days. You can decline analytics or change your choice using Cookie settings in the footer. Turning analytics off stops future measurement; it does not remove data already collected. Google signals and advertising personalization are disabled in our tag configuration. Crisp uses its own cookies and storage for live chat, as described above.

Business websites, QR codes and visitor statistics

Businesses can publish a website with iSpector and print QR codes. To show them simple statistics, iSpector counts:

• Website page views per day and page, using a beacon that sets no cookie.
• QR code scans: the device type, phone system and browser family (read from the browser's user agent), the country when our network provides it, and a daily visitor hash (a one-way hash of the IP address, user agent, day and a secret value), used only to count unique scanners. We do not store the IP address.

A business website also remembers, for the length of the browser tab, the first page of the visit, so a booking or message can say where the visitor came from.

Website chat

A business can add a chat to its website. Depending on the business's settings, a visitor's messages are answered by the business's team, by an AI assistant (Claude, from Anthropic), or by the AI first and the team after. Messages written by the AI are labeled "Virtual assistant (AI)", and the chat says that answers may come from an AI assistant. The AI never claims to be a person, cannot see the business's clients, invoices or prices, and can only offer and hold times, take a request, save the contact details the visitor types, or hand the chat to a person. The chat keeps a random token in the browser's local storage so the conversation continues when the visitor returns. The visitor's messages, the name, phone and email they choose to give, and the page they chatted from go to the business. The business replies by text only if the visitor checks the "Text me replies" box, which is never checked in advance and lasts 30 days.

How we use personal data

• To provide iSpector: run accounts, store and show your data, send the emails and texts you ask for, connect calls, process payments, sync with the tools you connect, and run the inspector app.
• To bill for iSpector, count usage (AI-assisted inspections, AI credits, texts, emails and phone usage) and enforce plan limits.
• To secure iSpector: authenticate users, prevent abuse and fraud, rate-limit requests, keep audit logs and investigate incidents.
• To support you and answer your requests.
• To tell you about changes to iSpector and, if you are a business customer or asked for a demo, about our products. You can opt out of marketing emails at any time.
• To comply with the law and enforce our terms.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use the data of our customers' clients, agents or website visitors for our own purposes.

AI features

iSpector's AI features use Claude, a model provided by Anthropic:

• Flo (AI assistant). The chat assistant answers questions about your business and proposes changes. To answer, it sends Anthropic your question, your name and role, the business's name, the date, the page you are on, and the records it reads to answer (for example, clients, inspections or invoices). It can only see and do what your role allows, and every change waits for you to approve it. Your conversations are saved to your account, visible only to you, and you can delete them.
• Review replies. When you ask for a draft, iSpector sends the review and, when there is one, the matched client's last inspection.
• Website and campaign copy. When a business builds a website or a campaign, iSpector sends its services, service area and trade to draft the wording.
• Inspection reports (the writer, the inspection assistant and photo suggestions). When an inspector asks for help on a report, in the web app or the mobile app, iSpector sends Anthropic the text of the report item or finding, the inspector's own words (typed or dictated), the photos the inspector chose for that finding, the relevant parts of the business's report template and comment library, and the name of the business. The guided inspection asks its questions from the report's own data without a model; the AI drafts findings, rewrites wording and suggests where a photo belongs. Nothing is shown to the client until a person at the business publishes the report. Depending on the business's settings, some low-risk suggestions may be applied for the inspector to review and undo; they are marked as AI-assisted until reviewed. In the web app, a voice note can be transcribed by Deepgram (the audio is not kept); on the phone, notes are dictated with the phone's keyboard.
• Call summaries. When a business records calls, Claude reads the call's transcript (never the audio) and writes a short summary.
• AI receptionist and website chat. See "Phone calls, recordings and the AI receptionist" and "Website chat".
• Template import. When a business imports a report template from a standards document it uploads, the document is sent to Claude to draft the template. When it learns a template and its writing style from its own past reports, those reports (which can include its clients' names and addresses) are sent to Claude; client names, addresses, phone numbers and email addresses are left out of what is kept, and the reports stay private to the business.

Each request includes only the business data needed for it. Anthropic (and, for speech, Deepgram) processes it as our subprocessor to return a response. iSpector does not use your data to train AI models. AI output can be wrong, so iSpector shows drafts for review, and the inspector and the business remain responsible for the report and everything they send or publish.

Payments

What businesses pay iSpector is billed through Base316 and its payment processor.

What clients pay a business goes through Stripe Connect. Each business has its own Stripe account and is onboarded and verified by Stripe. Clients pay on Stripe-hosted pages, so card and bank details go straight to Stripe and never reach iSpector's servers. Bank (ACH) payments use Stripe's bank connection; pay-over-time options (Affirm, Klarna, Afterpay), when the business offers them, are provided by those lenders through Stripe, which receive the details they need to approve the client. If a business passes card processing fees to its clients, the fee is shown before paying and on the receipt. iSpector stores the payment's amount, tip, card fee, status, fees, Stripe's reference numbers, the payment method type and the card brand and last four digits. Stripe uses payment data under its own privacy policy, including for fraud prevention.

Emails and text messages

Businesses send emails and texts to their clients and to the agents on their inspections through iSpector (agreements, reminders, "on my way" texts, report links, quotes, invoices, receipts and campaigns). Texts and phone calls go through Twilio, on an account iSpector provides to the business (or a Twilio account the business connects instead); emails go through iSpector email (iSpector's own Amazon SES account, the default) or the provider the business connects in its messaging settings instead: Resend, Postmark, SendGrid, Mailgun or its own Amazon SES account. iSpector keeps a log of each message, its content and its delivery status, and records replies, opt-outs (such as STOP), bounces and complaints so they are honored.

iSpector also sends its own emails to users, such as notifications about their account and their business.

iSpector text alerts. If you turn on text alerts in Settings → Notifications and give your cell phone number, iSpector texts you from its own toll-free number about your work and account: inspections assigned to you or canceled, and account, billing and integration alerts. Message frequency varies. Msg & data rates may apply. Reply STOP to stop, HELP for help. Turning alerts on is optional and not required to use iSpector; you can turn them off at any time in the same place.

Cell phone numbers and text consent are never shared for marketing. Cell phone numbers and SMS opt-in and consent data, ours and those the businesses collect through iSpector, are not sold, rented or shared with third parties or affiliates for their marketing or promotional purposes. They are shared only with the providers that deliver the messages (Twilio and the mobile carriers), and only to deliver them. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services.

Phone calls, recordings and the AI receptionist

A business can use iSpector as its phone system, on numbers iSpector provides through Twilio. iSpector keeps a log of each call: the numbers, the time, its length, who answered, voicemail, and what the call led to.

• Recording is off unless the business turns it on. When it is on, a recording notice plays at the start of the call. The notice can only be turned off by the business for calls where both parties are known to be in states that allow one-party consent; calls with anyone in an all-party-consent state, or whose state is unknown, are always announced. The business is responsible for the consent its calls need.
• Recordings and transcripts are stored in iSpector (the copy at Twilio is deleted) and are visible only to the business's owners and admins. Transcripts are made by Twilio. They are deleted after the business's retention period (90 days unless the business chooses otherwise).
• The AI receptionist (an optional add-on) answers calls the team does not take. It always says it is a virtual assistant and that the call is transcribed. The caller's speech is turned into text by Deepgram, the replies are written by Claude (Anthropic) and spoken by Deepgram's voice (or OpenAI's, if the business picks it). The AI part of the call is not recorded as audio; its transcript is kept with the call's retention.

Integrations you connect

• Google Business Profile. If a business connects Google, iSpector reads its locations and reviews and posts the replies the business writes. Tokens are stored encrypted. Disconnecting revokes access; reviews already synced stay.
• QuickBooks Online (Intuit) and Xero. If a business connects its accounting software, iSpector sends clients, invoices, payments and related records to the business's company file. Tokens are stored encrypted. Disconnecting revokes access.
• Calendars (Google Calendar, Microsoft Outlook, calendar links). If an inspector connects a calendar, iSpector reads when they are busy (start and end times only, never event titles) so clients cannot book those times, and, if they choose, adds their inspections to that calendar. Tokens and calendar links are stored encrypted. An inspector can also share a private calendar feed link of their inspections; anyone with the link can read it until it is replaced. Disconnecting removes the inspections iSpector added and stops access.
• Webhooks, the API and AI assistants. A business on a plan that includes them can send event data to addresses it chooses, or let tools and AI assistants it connects (with an API key or by signing in) act for a person within that person's role. What happens there is the business's responsibility.

Who we share data with

We share personal data only:

• with the subprocessors below, to run iSpector;
• within a business, according to the roles the business sets (for example, inspectors see only their own inspections, and cost data is hidden from roles without access);
• with the people a business chooses to share with (for example, a report or repair request shared with the agents on an inspection);
• with services a business or inspector chooses to connect (Google, Microsoft, QuickBooks, Xero, its messaging providers, its webhook endpoints, API keys and AI assistants);
• when the law requires it, or to protect the rights, safety and property of our users, the public or iSpector;
• with a buyer or successor if iSpector is involved in a merger, acquisition or sale of assets, under this policy's protections.

Subprocessors

Where a business connects its own Twilio, email, Google, Microsoft, QuickBooks or Xero account, that provider also acts under the business's own agreement with it. We will update this list when we add or change a subprocessor.

Where data is stored

iSpector stores data in the United States, on Amazon Web Services in the us-east-2 (Ohio) region. Some subprocessors may process data in other countries (for example, Crisp is based in the European Union). If you use iSpector from outside the United States, your data is transferred to and processed in the United States, where data protection laws may differ from those in your country.

Security

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit (HTTPS/TLS) for the website, the app, the API and the inspector app;
• integration and calendar tokens, webhook secrets and messaging provider credentials encrypted with AES-256-GCM, under keys we can rotate; portal sign-in codes, report and agreement links stored only as one-way hashes;
• database row-level security, so each business's records are separated from every other business's at the database level, in addition to permission checks on every request;
• role-based permissions, with every change recorded in an activity log;
• session tokens kept in httpOnly cookies, not readable by page scripts; two-factor sign-in and passkeys supported; each login can be signed in on at most two devices at a time;
• an encrypted local database on inspectors' phones, with the key held in the phone's secure storage, and optional Face ID or fingerprint unlock;
• database backups with point-in-time recovery.

No system is perfectly secure. If we learn of a security breach that affects your personal data, we will notify you and, where required, the authorities, as the law requires. If a breach affects data a business controls (its clients' data), we will tell the business without undue delay and give it the information it needs to notify the people affected.

How long we keep data

• Business data is kept while the business's account is open, so the business can use it. When an account is closed, we delete or de-identify the business's data within 30 days, unless the business asks for an export first or we must keep it by law. Backups are overwritten within 35 days after that.
• Downgrading a plan does not delete anything: the business can still see everything it made.
• Operational records are deleted on a schedule: system event records after 90 days, webhook delivery logs after 30 days, the accounting sync log after 90 days, Stripe event IDs after 30 days, delivered usage records after 90 days, and the activity log after 365 days.
• Location: the trail of inspectors' positions is deleted after 14 days; only the latest position is kept.
• Call recordings and transcripts are deleted after the business's retention period (90 days unless it chooses otherwise); the call log and AI summary stay with the business's records.
• Inspector app data on the phone is limited to today's and tomorrow's inspections, photos are removed from the phone once uploaded, and signing out deletes the business's data from the phone.
• Conversations with Flo are kept until the person deletes them or the account is closed.
• Website and demo requests sent to us are kept as long as needed to follow up and for our business records.
• Billing and payment records are kept as long as tax, accounting and financial laws require.

Your rights and choices

Depending on where you live, you may have the right to:

• know and access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• get a copy of your data in a portable format;
• opt out of the sale or sharing of personal data, or of targeted advertising. We do neither;
• appeal a decision we make about your request.

Business users can view and correct most of their data in the app. A business can ask us for an export of its data at any time.

Deleting your account. Accounts are created by the business you work for, which can remove you at any time. You can also ask us to delete your iSpector account, from the web app or the inspector app, by emailing privacy@ispector.ai from the address you sign in with. We delete your account and sign-in details within 30 days. Records you made while working for a business (such as inspection reports, notes, photos and timesheets) belong to that business and stay with it, without your account.

To make a request, email privacy@ispector.ai. We will verify your identity before acting on it, usually by confirming you control the email address on the account. You may use an authorized agent where the law allows; we may ask for proof of their authority. We will respond within the time the law requires (for example, 45 days under California law). We will not discriminate against you for exercising your rights.

If you are a client or agent of a business that uses iSpector, please send your request to that business, which controls your data. If you contact us, we will forward it to the business. You can always stop marketing emails and texts from a business through the unsubscribe link in its emails, by replying STOP to its texts, or on the preferences page linked in its messages.

US state privacy rights

Residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island) have the rights described above, as their laws provide. In the last 12 months, for our own customers, users and website visitors, we have collected the categories described in this policy: identifiers (such as name, email, phone, IP address), commercial information (plan and billing history), internet activity (requests to our servers, chat), professional information (business name, role, trade), for inspectors, records of work time and inspection photos, and, for inspectors who allow it, precise location while on the clock. We collect them from you, from the business you work for, and automatically when you use iSpector, and keep them as described in "How long we keep data". We collect them for the purposes in "How we use personal data" and disclose them only to the recipients in "Who we share data with". We do not sell personal data or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of anyone under 16. We use sensitive personal data (such as account credentials and inspectors' precise location) only to provide iSpector as described here, and not to infer characteristics about anyone.

For data a business puts into iSpector about its clients and the people on its inspections, iSpector acts as that business's service provider, and the business handles consumer requests.

Children

iSpector is a tool for businesses and is not directed to children; the inspector app is for adults working for a business. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@ispector.ai and we will delete it.

Changes to this policy

We may update this policy as iSpector changes. We will post the new version here with a new effective date. If a change materially affects how we use personal data, we will tell business customers by email or in the app before it takes effect.

Contact us

Thinkfleet AI, LLC
A North Carolina limited liability company
2890 Mount Pleasant Road South, Mount Pleasant, NC 28124
privacy@ispector.ai