PRIVACY POLICY

Summary of Key Points

• What we collect: account details you give us (such as name, installation address, email, and phone number), the measurements your Monitor sends, and limited technical information from our website and Apps. Learn more.
• Sensitive information: we do not process sensitive personal information.
• Location: we keep the installation address of your Monitor. The Apps do not collect your phone’s location. Learn more.
• Tracking: the Apps contain no advertising, no analytics, and no tracking identifiers. Our public website uses some cookies and measurement tools. Learn more.
• Sharing: we share information with service providers who help us run the Services, and with well professionals you choose to work with. Learn more.
• Deleting your account: you can delete your account in the Apps or on our website. Learn more.
• Your rights: depending on where you live, you may have rights to access, correct, or delete your information. Email support@imbrr.com. Learn more.

1. What Information Do We Collect?

Personal information you provide to us

In short: we collect personal information that you provide to us.

We collect personal information that you provide when you register for the Services, set up or claim a Monitor, express an interest in our products, or contact us. Depending on how you use the Services, this may include:

• names;
• installation addresses;
• email addresses;
• phone numbers;
• your account password (we store it only in a protected, hashed form); and
• the settings you choose, such as Monitor nicknames, alert thresholds, and notification preferences.

Sensitive information. We do not process sensitive information.

Payment data. If you make a purchase, the data needed to process your payment, such as your payment card number and security code, is handled and stored by PayPal. See PayPal’s privacy notice at paypal.com.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to it.

Information from your Monitor

Your Monitor sends us the measurements and status information that make the Services work. This includes water level and depth, water flow and usage, water pressure, temperature, pump electrical current, the Monitor’s firmware version, Wi-Fi signal strength, diagnostic and error reports, the Monitor’s serial number and security certificate, and the internet (IP) address it connects from.

Information from the imbrr Apps

When you use the Apps, they send us:

• your email address and password when you sign in (the password is sent over an encrypted connection to check it and is not stored on your phone);
• an identifier for your account, and a random identifier created for each installation of the App (not a hardware or advertising identifier);
• your phone’s model name and the App’s version, so you can recognize your signed-in devices in your account;
• a push notification token, if you turn notifications on, so we can send you alerts;
• the Monitor nicknames, alert settings, and notification preferences you change in the App;
• the serial number of a Monitor you claim, read from its label; and
• the IP address your phone connects from, as part of each request.

The Apps do not collect your phone’s location, contacts, photos, or browsing history, and they do not use advertising or tracking identifiers. When you scan a Monitor’s label, the camera image is processed only on your phone to read the code; the image is not stored or sent to us. When you set up a Monitor, the Wi-Fi network name and password you enter go directly from your phone to the Monitor over a short-range wireless connection; they are not sent to our servers.

Information automatically collected on our website

In short: some information, such as your IP address and browser characteristics, is collected automatically when you visit our website.

When you visit or use our website and dashboard, we automatically collect certain information. It does not reveal your specific identity by itself, but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, and information about how and when you use the website. We need this information mainly to keep the Services secure and working, and for our internal analytics and reporting. We also collect information through cookies and similar technologies (see section 4). This includes:

• Log and usage data: service-related, diagnostic, usage, and performance information our servers record when you use the Services, such as your IP address, browser type, date and time stamps, pages viewed, actions you take, and error reports.
• Device data: information about the computer, phone, or tablet you use to access the website, such as IP address, browser type, hardware model, internet service provider, operating system, and system configuration.

Location information

We keep the installation address of each Monitor, and a map position derived from that address, so the Services can show where a Monitor is installed and so well professionals you work with can find it. We do not collect the precise location of your computer or phone through the website or the Apps.

Information collected from other sources

In short: we may collect limited data from public databases.

To provide the Services and keep our records up to date, we may obtain information from other sources, such as public databases. This includes well permit data for the installation location.

2. How Do We Process Your Information?

In short: we process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with law. We also compile de-identified, anonymized data from our devices for product optimization and analytics. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you use the Services, including:

• To create and manage accounts, including signing in on the website and in the Apps.
• To deliver the Services, including measurements, charts, reports, and insights about your well system.
• To send you alerts by email and, if you turn them on, as push notifications in the Apps.
• To respond to inquiries and support requests.
• To send administrative information, such as details about our products and services and changes to our terms and policies.
• To fulfill and manage your orders, payments, returns, and exchanges.
• To request feedback and to contact you about your use of the Services.
• To protect the Services, including fraud monitoring and prevention.
• To identify usage trends so we can improve the Services.
• To operate and maintain the Services, including improving the accuracy and performance of our algorithms, monitoring Monitor health, supporting troubleshooting, and updating Monitor firmware.

Anonymized and aggregated data. We may compile, anonymize, and aggregate technical data, device sensor data, and operational metrics collected through our products and services so that it can no longer be used to identify you, your company, or any individual user. We may use these de-identified, aggregated datasets to improve our products and algorithms and for industry benchmarking and research, and may share them with partners for those purposes. Because this data does not contain personal or company-identifying information, its use and disclosure are not subject to the restrictions of this Privacy Policy.

3. When and With Whom Do We Share Your Personal Information?

In short: we may share information in the situations described in this section and with the following categories of third parties.

Service providers. We share information with vendors, service providers, contractors, and agents who perform services for us and need access to it to do that work. We have contracts in place with them that are designed to help safeguard your personal information: they may use it only as we instruct, may not share it with anyone else, must protect it, and must keep it only for the period we instruct. The categories of service providers we use, and examples, are:

• Push notifications: Apple Push Notification service (for iPhone) and Google Firebase Cloud Messaging (for Android) deliver alerts to your phone. They receive your push notification token and the text of each notification.
• Maps: map services display installation locations to well professionals. On Android this is Google Maps; on iPhone it is Apple Maps; on our website it is OpenStreetMap. These services receive map requests, including the IP address of the phone or computer viewing the map.
• Website security and analytics: see section 4.
• Payments: PayPal (see section 1).
• Hosting, email delivery, and data analytics services that help us run the Services.

Well professionals you choose. If you invite or accept a well service professional (a “servicer”) through the Services, that servicer can see your Monitors, their measurements and alerts, and your contact and installation details, so they can look after your well. You can ask us to end that access at any time.

We may also share your information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Business partners. We may share your information with our business partners to improve our products or services.

4. Do We Use Cookies and Other Tracking Technologies?

In short: our website uses cookies and similar technologies. The Apps do not.

On our website, we use cookies and similar technologies to keep you signed in, maintain the security of the Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. We also use:

• Google reCAPTCHA on our sign-in, registration, and contact forms, to protect them from spam and abuse. reCAPTCHA collects hardware and software information and sends it to Google, subject to Google’s privacy policy and terms of service.
• Website analytics (such as PostHog), to understand how visitors use our public website.
• Meta Pixel on our public home page, to measure the effectiveness of our advertising.

In the Apps, we do not use cookies, advertising, analytics, or tracking technologies, and we do not track you across other companies’ apps or websites.

5. Do We Offer Artificial Intelligence-Based Products?

In short: we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, “AI Products”), such as machine learning models that interpret Monitor measurements. These tools are designed to enhance your experience and provide useful insights. All personal information processed using our AI Products is handled in line with this Privacy Policy and our agreements with third parties.

6. How Long Do We Keep Your Information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this policy, unless otherwise required by law.

We keep your personal information only for as long as it is necessary for the purposes set out in this policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this policy requires us to keep your personal information for longer than you have an account with us.

App sign-ins. Each phone you sign in on has its own session. A session stays signed in while the App is used and ends if it is not used for 60 days; signing out ends it at once, and you can see and end your signed-in devices from your account. Push notification tokens are removed when their session ends or when Apple or Google report them as no longer valid.

Monitor measurements. Measurements belong to the Monitor that recorded them and are kept with it, including after an account is deleted (see section 14), so the Monitor’s history remains available to whoever uses it next and for the operation and improvement of the Services.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymize it or, if that is not possible (for example, because it is stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

7. How Do We Keep Your Information Safe?

In short: we aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process. The Apps and Monitors communicate with our servers over encrypted connections, and each Monitor uses its own security certificate. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. Do We Collect Information from Minors?

In short: we do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@imbrr.com.

9. What Are Your Privacy Rights?

In short: you may review, change, or delete your account at any time.

Withdrawing your consent. If we are relying on your consent to process your personal information, which may be express or implied consent depending on the applicable law, you have the right to withdraw it at any time by contacting us using the details in section 13 or by updating your preferences. This will not affect the lawfulness of the processing before its withdrawal, nor, when applicable law allows, processing conducted in reliance on lawful grounds other than consent.

Push notifications. You can turn push notifications off at any time in the App or in your phone’s settings.

Account information. To review or change the information in your account, sign in to the dashboard or the App and update your account. To delete your account, see section 14. When an account is deleted, we may keep some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.

If you have questions or comments about your privacy rights, email us at support@imbrr.com.

10. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will tell you about that practice in a revised version of this policy. California law requires us to let you know how we respond to web browser DNT signals; because there is currently no industry or legal standard for recognizing or honoring them, we do not respond to them at this time.

11. Do United States Residents Have Specific Privacy Rights?

In short: if you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

We may also collect other personal information outside of these categories when you interact with us in person, online, or by phone or mail in the context of receiving help through our customer support channels, participating in customer surveys, and the delivery of our Services and responses to your inquiries.

We will use and retain the collected personal information as needed to provide the Services, or for: Category A, as long as the user has an account with us; Category B, as long as the user has an account with us; and Category H, as long as the user has an account with us, except that Monitor measurements stay with the Monitor as described in section 6.

Sources of personal information

Learn more about the sources of personal information we collect in “What information do we collect?”

How do we use and share your personal information?

Learn about how we use your personal information in “How do we process your information?”

Will your information be shared with anyone else?

We may disclose your personal information to our service providers under a written contract between us and each service provider. Learn more in “When and with whom do we share your personal information?”

We may use your personal information for our own business purposes, such as internal research for technological development and demonstration. This is not considered to be “selling” your personal information. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months.

Your rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:

• the right to know whether or not we are processing your personal data;
• the right to access your personal data;
• the right to correct inaccuracies in your personal data;
• the right to request deletion of your personal data;
• the right to obtain a copy of the personal data you previously shared with us;
• the right to non-discrimination for exercising your rights; and
• the right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”).

Depending on the state where you live, you may also have the right to access the categories of personal data being processed (for example, in Minnesota); to obtain a list of the categories of third parties to which we have disclosed personal data (for example, in California, Delaware, and Maryland); to obtain a list of the specific third parties to which we have disclosed personal data (for example, in Minnesota and Oregon); to review, understand, question, and correct how personal data has been profiled (for example, in Minnesota); to limit the use and disclosure of sensitive personal data (for example, in California); and to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (for example, in Florida).

How to exercise your rights

To exercise these rights, email us at support@imbrr.com or use the contact details at the end of this policy. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request verification

When we receive your request, we will need to verify your identity to determine that you are the same person about whom we have the information in our system. We may ask you to provide information so that we can match it with information you have previously provided, or we may contact you through a communication method (such as email or phone) that you have previously provided. We may also use other verification methods as the circumstances dictate. We will only use personal information provided in your request to verify your identity or authority to make the request, and we will delete any additional information you provide for verification as soon as we finish verifying you.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at support@imbrr.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing using the contact details in section 13.

12. Do We Make Updates to This Policy?

In short: yes, we will update this policy as necessary to stay compliant with relevant laws and to reflect changes to the Services.

We may update this policy from time to time. The updated version will be indicated by an updated “Last Updated” date and will be effective as soon as it is accessible. If we make material changes, we may notify you by prominently posting a notice of the changes or by sending you a notification directly. We encourage you to review this policy frequently to be informed of how we are protecting your information.

13. How Can You Contact Us About This Policy?

If you have questions or comments about this policy, contact us at:

14. How Can You Review, Update, or Delete the Data We Collect from You?

Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, change that information, or delete it.

• Review and update: sign in to the dashboard or the App to see and change your account details, Monitor nicknames, and alert settings, or email support@imbrr.com.
• Delete your account in the App: open Account, then Delete account, and confirm with your password.
• Delete your account on the web: sign in at imbrr.com/delete-account and confirm with your password.
• Or ask us: email support@imbrr.com from the address on your account.

What deleting your account removes: your name, email address, password, and other account details; your preferences, alert settings, and alert history; your App sign-ins and push notification tokens. Your Monitors are released from your account so they can be set up again.

What is kept: the measurements your Monitors recorded stay with the Monitors and are no longer linked to your account. We may also keep limited information as described in section 9.

Accounts used by well professionals to manage other people’s Monitors cannot be deleted in the App or on the web; email support@imbrr.com and we will close them.