Privacy Policy

Hi! This policy explains what information Patch collects, what we do with it, who we share it with, and the choices you have. We've tried to keep it plain and honest.

Patch (heypatch.ai) is a client portal made by elefox studio LLC, a Florida limited liability company based in Coral Springs, Florida. When this policy says "Patch," "we," "us," or "our," it means elefox studio LLC.

This policy covers the Patch website (heypatch.ai) and the Patch app.

Who this policy is for

Patch has two kinds of users:

Businesses. Service businesses (and the people who run them) sign up for Patch and pay us for it. We call them "businesses" or "owners."
Clients. A business invites its own clients into a portal that carries the business's name and logo, or sends them a link to pay, review, or fill out a form.

If you're a client, here's the important part. The business you're working with decides what goes into its portal and how it uses your information. For your information, that business is in charge (the "controller," in privacy terms). Patch handles your information on the business's behalf and follows its instructions (as its "processor" or "service provider"). The business's own privacy policy covers how it uses your information. If you have a question or a request, please start with that business. If you can't reach them, email us and we'll help point you in the right direction.

What we collect

From businesses

Account details: your name, your business name, your email address, and your password. We store passwords in a scrambled form (a hash), so we can't read them.
Business setup: the industry you pick, your logo, your brand color, your workflows, and the contract details you enter for the built-in agreement (legal business name, type of entity, location, governing state, and where disputes are handled).
Payment setup: when you connect Stripe to accept payments, you give your identity, business, and bank details to Stripe directly, on Stripe's own pages. We keep your Stripe account ID and whether your account is ready to take payments. We don't receive or store your bank account number or tax ID.
Your Patch subscription: when you choose a paid plan, Stripe processes your payment. We keep your plan, its status and billing dates, Stripe's reference numbers, and how many AI lead actions you've used. We never see your full card number.
Agreeing to our Terms: which version of our Terms you agreed to, when, and the IP address and browser you used.
When you contact us: your messages and anything you send along with them.

What businesses put into Patch

Businesses use Patch to run their client work, so their accounts hold things like:

client records: names, companies, email addresses, phone numbers, websites, mailing addresses, logos, time zones, and the business's private notes
projects, workflows, and project timelines
quotes, contracts, amendments, invoices, deposits, and payment records
files, folders, file comments, preview links, and embedded content
messages and message attachments
guided reviews, approvals, and change requests
testimonial requests and testimonials
leads (people and companies the business might work with) and intake form answers

We call all of this "Customer Data." It belongs to the business.

From clients, on behalf of the business

Your account: your name, email address, password (stored as a hash), and company name if you add one. If you agree to our Terms when you set up your account, we keep which version, when, and the IP address and browser you used.
What you do in the portal: approving or declining quotes, approving files or asking for changes, answering guided reviews, sending messages and files, commenting on files, filling out intake forms, and writing testimonials (including any star rating, and whether you said the business may share it).
E-signatures: when you sign a contract or amendment, Patch records the name you type, the email address on your account, your IP address, your browser and device information (called a "user agent"), and the date and time. This record stays with the contract, so there's a trail of who signed and when.
Payments: when you pay an invoice, you type your card or bank details into a payment form provided by Stripe. Those details go straight to Stripe. Patch never sees your full card number or full bank account number. We keep the amount, the date, the status, any card fee, and Stripe's reference number. The business emails you a receipt through Patch.
Activity: Patch notes some activity so the business knows where things stand. That includes when you've read a message, when you first open a testimonial request and which review sites you click through to, and a history of actions like signing and approving.

Leads and AI features

Patch has a Leads area where a business can keep track of people and companies it might work with. A lead record can include a name, company, job title, email, phone, website, location, social links, where they met, notes, intake answers, research notes, and a fit score. Leads can be typed in, imported from a file, scanned from a business card, or found with AI.

Some optional features send information to outside AI services to do their work:

Business card scan: the photo of the card goes to Google (Gemini), which reads the contact details.
Lead import: the contents of the uploaded file (a spreadsheet, document, or PDF) go to Google (Gemini), which pulls out the leads.
Research: Patch visits the lead's public website, then sends what it finds, along with the lead's name, company, title, and location, to Google (Gemini) for a short summary and a fit score.
Finding new leads: Patch asks Google (Gemini, using Google Search) to look for businesses that match the location and industries the business has chosen.
Follow-up drafts: the lead's details and the business's notes about its writing style go to Google (Gemini), which writes a draft. Drafts are never sent automatically. The business reviews and sends anything itself.

For businesses on Patch, these features run only on Google's paid Gemini service, under terms that say Google won't use what we send to train or improve its models. We don't train AI models on Customer Data either.

Collected automatically

Cookies: just a few, described in the Cookies section below.
Server logs: like most websites, our hosting provider keeps standard logs, including IP addresses, browser type, the pages requested, and when. We use them to keep Patch secure, limit repeated sign-in attempts, and fix problems. Patch doesn't use advertising cookies or third-party analytics tools, and our emails don't track opens or clicks.

How we use information

to run Patch, like showing portals, sending quotes and invoices, and recording signatures and payments
to send emails for each business: quotes, contracts, invoices, receipts, guided reviews, testimonial requests, intake forms, messages, and alerts to the owner when a client does something. These emails carry the business's name and logo, and replies go to the business.
to send owners account emails, like security notices, billing, and important changes to Patch
to help when you ask for support
to keep Patch safe by preventing fraud, abuse, and unauthorized access
to bill businesses for Patch
to fix bugs and make Patch better
to follow the law and enforce our Terms of Service

We don't sell personal information. We don't share it for targeted advertising. We don't use a business's client information to market our own services to those clients.

We only look at a business's Customer Data when we need to: to give support the business asked for, to fix a problem, to keep Patch secure, or when the law requires it.

The business you work with. If you're a client, the business can see what you do in its portal, including your messages, uploads, approvals, review answers, signatures, payments, and testimonials.
Service providers that help us run Patch. They may only use information to provide their service to us.
- Railway: hosting and database
- Cloudflare: file storage
- Resend: email delivery
- Stripe: payments and Patch subscription billing
- Google: AI features (Gemini) and our own email inbox
Stripe, for payments. When a client pays a business, the payment goes through the business's own Stripe account, and Stripe handles that information under its own privacy policy.
Embedded content. A business can add Figma, Loom, YouTube, Vimeo, or Calendly content to a project. That content loads from those companies, and they may collect information like your IP address or set their own cookies under their own policies. YouTube videos use YouTube's privacy-enhanced mode.
Public testimonials. If a client checks the box saying the business may share their testimonial, and the business approves it, the quote, name, role, and rating may appear on the business's website. Without that checkbox, it's never published.
Legal reasons. When the law requires it, or to protect the rights, safety, or property of our users, the public, or us.
If our business changes hands. If elefox studio LLC or Patch is sold, merged, or reorganized, information may move to the new owner, who'll have to honor this policy.
With your permission.

Cookies

Patch only uses the cookies it needs to work:

Sign-in: keeps you signed in. Your session ends after 14 days without activity. Our sign-in system also sets short-lived security cookies that protect forms and remember where to send you after you sign in.
patch_ws: remembers which business's portal this browser last signed in to, so the sign-in page can show that business's name and logo. It lasts up to a year.
patch-theme: remembers whether you picked light or dark mode. It lasts up to a year.
Payment pages: Stripe's payment form may set its own cookies to help prevent fraud.
Embedded content may set cookies too (see above).

Because these cookies are needed for Patch to work, there's no cookie banner. You can clear or block cookies in your browser, but then you won't be able to stay signed in.

Do Not Track. Patch doesn't track you across other websites, so nothing changes when your browser sends a Do Not Track signal. Stripe and embedded content providers may collect information about your activity over time and across sites under their own policies.

How long we keep it

We keep a business's account and Customer Data while the account is open, including while it's read-only after a trial or plan ends.
If an account stays read-only for 90 days, we may delete its data. We email the owner at least a week before that happens, so there's time to pick a plan or ask for a copy.
When a business closes its account, we delete its Customer Data within 30 days, including stored files. We keep what the law requires us to keep (like our own billing records), what we need to resolve disputes or enforce our Terms, and copies in backups until they're overwritten on their normal schedule.
When a business deletes a client, that client's records and stored files are deleted too.
Inside Patch, signed contracts, invoices that were sent or paid, and payment records can't be deleted while the account is open, because they're the record of what was agreed and paid.
Server logs are kept by our hosting provider for a limited time, then deleted automatically.

Keeping it safe

We take reasonable steps to protect information, including:

encrypted connections (HTTPS)
passwords stored as hashes, never in plain text
limits on repeated sign-in attempts
a setup built to keep each business's data separate from every other business's data
project files and message attachments shared through private links that expire within minutes (business and client logos are public, so they can show up in emails)
card and bank details handled by Stripe, not stored by us

No system is perfectly secure, so we can't promise nothing will ever go wrong. If a security incident affects your information, we'll notify affected businesses, and anyone else the law requires us to notify.

Information Patch isn't built for

Please don't put these in Patch: protected health information (Patch isn't set up to hold it, and we don't sign business associate agreements), Social Security numbers, driver's license or passport numbers, full card or bank account numbers (outside Stripe's payment form), passwords for other services, or information about children under 13.

Your choices

Businesses

Update your account, business details, and branding in Settings anytime.
Email hello@elefoxstudio.com to get a copy of your data (we'll send it within 30 days) or to close your account.
Account emails about security and billing can't be turned off while you have an account. If we ever send product news, every one of those emails will have an unsubscribe link.

Clients

Update your name, email, company, and password in your portal settings.
For anything else, like getting a copy of your information, correcting it, or deleting it, contact the business you work with, since they control your information in Patch. If you can't reach them, email us and we'll help.
Emails about your project come from the business. To stop them, contact the business.

Privacy rights where you live

Some state laws give people rights over their personal information, like the right to see it, correct it, delete it, or get a copy. If a law like that applies to you, email hello@elefoxstudio.com and we'll respond as that law requires. If your information is in a business's portal, we may pass your request along to that business, since they're in charge of it. We won't treat you differently for asking.

Children

Patch is for businesses and their clients. It isn't meant for anyone under 18, and we don't knowingly collect information from children under 13. If you think a child's information is in Patch, email us and we'll take care of it.

Where information is processed

Patch is run from the United States. Your information is stored and processed in the US and wherever our service providers operate.

Changes to this policy

If we update this policy, we'll post the new version here and change the effective date. If a change is significant, we'll email business owners at least 30 days before it takes effect.

Contact us

Questions, requests, or worries? Email hello@elefoxstudio.com.

elefox studio LLC Coral Springs, Florida