ReadyForward Privacy Policy

This Privacy Policy forms Part II of the ReadyForward Terms of Service and is also published there in full.

This Privacy Policy explains how ReadyForward handles personal data. It applies to Movers whose data is processed through the service and to Platforms. It is incorporated into the Terms above. Where ReadyForward acts as a processor for a Platform (Section 4.1), this Policy describes ReadyForward's own practices; the Platform remains responsible for its own notice to Movers.

P.1 The trust promise, in one line

We never sell and never share Mover or move data, and we purge move data on the retention schedule below. This is a product principle, not just a policy.

P.2 Who is responsible for your data (controller / processor)

• The Platform that sent us your move information is the controller and decides why the data was collected.
• ReadyForward is the processor / service provider acting on the Platform's instructions to help you update your address.
• For the Handoff Link we show directly to you, ReadyForward may act as an independent controller of the limited processing needed to present that page and guide you.

P.3 Notice at the point of collection

When you interact with a Handoff Link, ReadyForward displays a short, plain-English notice telling you what data is shown, why, that we never sell or share it, and how long we keep it, with a link to this full Policy and to your rights (Section P.7). The Platform is separately responsible for its own notice to you at the time it collected your data.

P.4 What we collect, sources, purposes, and recipients

We practice strict data minimization. The table maps each category to the U.S. consumer-privacy categories, its source, why we use it, and who may receive it.

We do not collect or store: Social Security numbers, dates of birth, driver's-license or other government ID numbers, financial or payment/card data (Platform billing lives only at the Platform level in Stripe, never per Mover), account passwords or Mover login credentials, free-form notes, IP address / device / geolocation tracking fields, marketing or consent flags, or individual household-member names.

P.5 How long we keep it (retention) and how we delete it

• Standard retention: move data is purged approximately 90 days after the move's effective date.
• Billing exception: if a record still needs to be metered for billing at the 90-day mark, its deletion may be held back for up to about 30 additional days (about 120 days after the effective date) so the pending charge can be captured before deletion. If a record reaches the end of that extended window still unbilled, it is deleted anyway — the retention promise wins and the revenue is forfeited.
• Deletion method: on purge, the move record and its associated reminder logs are permanently deleted from our production database.
• Exceptions: we may retain data longer only where required by law or to resolve a legal claim (legal hold), and only for as long as necessary.

P.6 Sensitive data and children

• No sale, no share. We do not sell personal information and do not share it for cross-context behavioral advertising, as those terms are used under the CCPA/CPRA. Because we never sell or share, no "Do Not Sell or Share My Personal Information" action is required to stop it; you may still contact us to confirm (Section P.12).
• No sensitive PI processing. We do not intentionally collect or process CPRA "sensitive personal information." If sensitive identifiers (e.g., SSN, DOB, government ID, or card data) reach us in error, we delete them upon discovery and do not use them.
• Children. The service is not directed to children. We do not knowingly collect personal data from children under 13 (COPPA), and we treat data of individuals aged 13–16 consistently with GDPR consent rules. If we learn we have received a child's data, we delete it. Move records concern the person moving; we do not enumerate household-member names.
• No automated decision-making. ReadyForward does not engage in automated decision-making or profiling that produces legal or similarly significant effects about you. Generating a personalized guidance page is a simple presentation of the data the Platform provided; it does not make decisions about you.

P.7 Your rights

Depending on where you live, you may have some or all of the following rights. These rights are available to Movers even though Movers are not parties to the Terms.

Under the GDPR/UK GDPR (Arts. 15–22): access, rectification, erasure, restriction of processing, data portability, objection to processing, and rights related to automated decision-making.

Under the CCPA/CPRA: the right to know/access, to delete, to correct, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and to non-discrimination for exercising your rights. (As noted in P.6, we do not sell or share, and we do not process sensitive PI.)

Where ReadyForward is a processor for a Platform, we will either honor your verified request directly or forward it to the responsible Platform and assist them in responding.

P.8 How to exercise your rights

• Channel: email privacy@readyforward.io or use the request link surfaced on your Handoff Link.
• Verification: to protect you, we will verify your request by confirming details tied to your move record (for example, the email address on file); we will not use the information you provide for any purpose other than verifying and handling the request.
• Timing: we respond within one month for GDPR requests (extendable by two further months for complex requests, with notice) and within 45 days for CCPA/CPRA requests (extendable once by 45 days with notice).
• Appeals / complaints: if we deny a request, you may appeal by replying to our response. You may also lodge a complaint with your EU/UK supervisory authority or your state Attorney General (for California residents, the California Privacy Protection Agency).
• No fee: we do not charge to handle requests, except where the law permits a fee for excessive or repetitive requests.

P.9 Security

We take reasonable technical and organizational measures to protect personal data, appropriate to its sensitivity and to the minimal data set we hold:

• Encryption in transit: data moving between systems is protected with TLS.
• Encryption of platform secrets at rest: Platform API secrets are encrypted at rest when a server encryption key is configured in the environment.
• Access controls and data minimization: access to production data is limited, and we store only the minimum fields needed (Section P.4).
• Per-platform separation: each Platform's move data is logically isolated from other Platforms'.
• Vendor vetting: we use a small set of established subprocessors (Section P.10) and disable each one's data flow by default until it is deliberately configured.

We do not claim any certification (such as SOC 2, ISO, or HIPAA), "bank-level" security, or that all data is encrypted at rest. We describe only what the service actually does.

Breach notification: if a personal-data breach affecting Mover or Platform data occurs, we will notify affected Platforms without undue delay and cooperate so that affected individuals and regulators can be notified within the timelines required by applicable law (including GDPR Arts. 33–34).

P.10 Subprocessors

We use the following subprocessors. Each SaaS subprocessor is optional and off by default; data leaves ReadyForward to that vendor only if the vendor's credentials are configured, and otherwise the service falls back to a local, no-network mode.

We require our subprocessors to protect data consistent with this Policy. We will make the current subprocessor list available and will notify Platforms of any new subprocessor before it begins processing Mover data, giving the Platform a reasonable opportunity to object.

P.11 International data transfers, representative, and DPO

ReadyForward is US-based, and processing occurs in the United States. If personal data of individuals in the EU/UK is processed, transfers rely on appropriate transfer safeguards, such as the EU/UK Standard Contractual Clauses, together with any supplementary measures required. Because ReadyForward is directed to U.S. residents and U.S. mailing addresses, we do not believe a GDPR Art. 27 representative or Art. 37 Data Protection Officer is required; we will appoint one if and where the law requires.

P.12 Privacy contact

• Privacy / data-rights contact: privacy@readyforward.io
• Operator: MirrorEdge, LLC — a limited liability company
• Postal address: MirrorEdge, LLC, Attn: Privacy — 1423 Hamilton St., Conway, AR 72032