Privacy Policy

Beta Notice: This service is currently in Beta testing, and Platform features and privacy terms may be adjusted as testing progresses. All Platform Credits are currently granted free of charge, have no cash value, and cannot be withdrawn; we currently do not charge users or accept top-up payments.

Version: 2026-10-23-beta1

Effective Date: 2026-10-23

Operator: SU International LLC, California, United States

Contact Email: info@22lights.com

Summary

Purpose-Limited Collection: We collect only the personal and business information needed for local repair matching, merchant and handyman onboarding review, technician dispatch, en-route live location display, service report records, and Platform safety. During the current Beta period, we do not charge fees, do not accept top-ups, and do not collect payment card or bank account details.
Address and Live Location Protection: Before a homeowner selects a merchant, the public request map displays only a blurred location and city. Technicians report their latest location only on the day of service after actively tapping “En Route” and granting permission, and that location point is deleted upon marking arrival or completion, with no attendance clock-in or movement history tracking.
Handyman Identity Document Confidentiality: Identity document photographs submitted by handyman merchants during onboarding are visible only to Platform administrators for verification review, are never public or shown to homeowners, and are kept in private storage accessible only to administrators; you may email info@22lights.com at any time to request deletion, which we handle through a manual process (except where a dispute or legal obligation requires retention).
Third-Party Providers and No-Sale Commitment: We use Supabase (database and login), Vercel (hosting), Mapbox (maps, which send anonymous usage events), and Google Workspace (email). The app contains no advertising, standalone analytics, or crash-reporting SDKs, and we never sell personal information.
Self-Service Deletion and Retention Rules: You can delete your account yourself on the Account page in the app (after resolving any ongoing requests, services, or frozen funds). Upon deletion, personal profile details are anonymized, while ledger records and consent records are retained for at least 7 years and report and other records are retained under our retention rules.

1. Scope and Sources of Information

This Privacy Policy applies to the local home repair matching and management features of the 22 “万家灯火” (domain: 22lights.com) website and mobile application operated by SU International LLC (California, United States) for the Apple Valley, Victorville, and Hesperia area of California. We collect information that you provide directly when registering an adult account (18+), posting requests, onboarding as a merchant, dispatching or performing services, or submitting reports and objections; information from homeowners, merchants, and technicians involved in your appointments; and necessary technical and business records generated during Platform operations and map loading. The specific information collected depends on the roles and features you use.

2. Information We Collect and Purposes

Account and Profile Information: Email address, name, phone number, optional avatar, account identifier, interface language, and active role settings. Passwords are encrypted and handled by our authentication provider (we never store plaintext passwords) for login, role switching, in-app notifications, and security verification.
Homeowner Request and Address Information: Saved and service street addresses, city, state, ZIP code, precise coordinates, blurred coordinates for public map display, and contact name and phone number; request titles, problem descriptions, industry category, language preference, appointment scheduling, rescheduling, and direct rebooking records, used for local merchant matching, appointment contact, and on-site service fulfillment.
Service Reports and Equipment Records: Equipment name, brand, model, on-site findings, work performed, replaced parts and quantities, service duration, recommended next check date, notes, report revision snapshots, and homeowner objection reasons submitted within 7 days after a report is filed, used for equipment maintenance history, check reminders, and reviewing report objections. Service reports do not include repair photos or repair fee fields.
Merchant, Team, and Handyman Enrollment Information: Company name, contact phone, optional website, branch addresses and coordinates, service radius, business licenses and industry qualification files, review status, and optional commercial insurance and bond information and files; team invitations, role assignments, dispatch records, customer service history, and company-isolated private customer notes, as well as upfront inspection-fee and rebooking quote snapshots, used for qualification review, radius matching, team dispatch, and customer management. Handyman merchant onboarding requires a photograph of the applicant's identity document for administrator identity review (the Platform does not verify contractor licenses or commercial insurance for handymen); this identity document photograph is not public and is not shown to homeowners.
Technician Jobs and En-Route Location: Assigned appointment jobs, optional public contact phone, departure, arrival, and completion status and timestamps, and—when location sharing is enabled and device permission is granted on the day of service—the latest latitude, longitude, accuracy, and update timestamp, used to display en-route arrival status to the homeowner for that appointment as described in Section 3.
Wallet and Credit Ledger: Separate balances for promotional and purchased Credits, coupon redemptions, holds, captures, releases, merchant fee waivers, and transaction records, used for Platform Credit accounting and reconciliation. During the current Beta period, top-ups are disabled, we do not charge users, we do not collect credit card numbers, bank account numbers, or billing addresses, and we do not obtain or settle the total offline repair price.
Reports, Blocks, and Administrative Records: Reporter and reported-target identifiers, report reasons, optional supplementary explanations of up to 500 characters, resolution status, and administrator notes, as well as blocked-party identifiers and timestamps, in-app notifications, and administrator audit records, used for handling violation reports, preventing abuse, enforcing blocks, and maintaining Platform safety.
Consent Records: Account identifier, document type, version number, text hash (a digest used to verify text consistency, not a password), acceptance timestamp, language, display context, and necessary related request or company identifiers, used to establish which version a user accepted and when, and to prevent duplicate records.

We do not integrate third-party advertising SDKs, standalone behavioral analytics SDKs, or crash-reporting SDKs, do not access advertising identifiers (IDFA), and do not conduct cross-app tracking. However, the Mapbox map component sends anonymous map usage events and stores a random anonymous identifier locally for the operation and improvement of its mapping services; we do not link that identifier to your Platform account, and map performance metrics collection is disabled, as detailed in Section 5.

3. Address Protection and Technician Location Rules

When a homeowner saves an address or posts a public request, property coordinates are recorded to match merchants within the service radius. Before the homeowner selects a merchant, the public request map and list show only a blurred location and city and never disclose the exact street number, contact name, or phone number to unselected merchants. Because merchants with access can read public request descriptions, please do not write personal phone numbers or street numbers in public titles or descriptions.

Technicians report live en-route location only on the scheduled day of service after actively tapping “En Route,” enabling location sharing, and granting device location permission, and reporting pauses whenever the page is hidden or in the background. We do not perform attendance clock-in tracking or off-duty location monitoring, and we do not keep a movement history; each appointment stores only the single latest location point, overwriting the previous point. Only the homeowner for that appointment and Platform administrators can read the location while sharing is enabled, the job status is en route, and the location point was updated within the last 5 minutes; company administrators cannot read live technician coordinates through this feature.

Marking “Arrived” or “Completed” immediately stops location sharing and deletes that latest location point. A location point older than 5 minutes stops being displayed to the homeowner; that does not automatically delete the point, which is cleared upon marking arrival or completion or during account deletion processing. You can revoke location permission at any time in your device settings to stop future collection; denying location permission does not prevent manual job status updates, though live location display will be unavailable.

4. Information Sharing and Visibility

Service Sharing Among Homeowners, Merchants, and Technicians: Once a homeowner selects a merchant or a merchant accepts a direct rebooking, the request's exact address, contact name, phone number, and details are unlocked only for that merchant's managers; the assigned technician can view only the service address and request details needed to fulfill that job. Homeowners can view the selected merchant's name, assigned technician's name and public phone, verified Insured or Bonded badges, and relevant service reports. Merchant customer records and private customer notes are strictly isolated by company.
Merchant Qualifications and Insurance or Bond Credentials: Business licenses and ordinary industry qualification files submitted by licensed merchants can be previewed only by authorized managers of the submitting company and Platform administrators. Original commercial insurance and bond files can be previewed only by Platform administrators; company managers can view submitted credential details and review status, while homeowners see only the verified and unexpired Insured or Bonded badge without original files.
Handyman Identity Document Photographs: Identity document photographs submitted by handyman merchants during onboarding are visible only to Platform administrators for verification review, are never public, and are never displayed to homeowners. Merchants must submit identity materials only through the designated private upload channel.
Confidentiality of Reports and Blocks: Report contents and administrator notes are reviewed only by Platform administrators; our reporting interface never discloses the reporter's identity to the reported party, and sends only a general status notification to the reporter after review (legally required disclosures remain subject to Section 6). Blocking does not actively notify the other party; on the blocked list in the Account page, merchants see only masked short codes for homeowners and homeowners see blocked company names.

5. Third-Party Service Providers and Map Data

Supabase: Provides database hosting, user login authentication, and private file storage to store and process account data, business records, and private merchant uploads needed to run the Platform.
Vercel: Provides website and application hosting and content delivery to serve the application and process network requests.
Mapbox: Provides map rendering and address geocoding. When homeowners search for addresses or merchants configure branch street addresses and ZIP codes, our server sends the address text to Mapbox to look up coordinates; when loading maps, the Mapbox component requests map resources, sends anonymous map usage events to Mapbox, and stores a random anonymous identifier locally. We do not intentionally attach your Platform account identifier, phone number, or email address to geocoding requests, and drawing map markers does not upload all underlying business records to Mapbox. For details on how Mapbox handles data it receives, see the Mapbox Privacy Policy.
Google Workspace: Provides business email services (info@22lights.com) used to receive and respond to customer support inquiries, report communications, and privacy rights requests.

The application uses cookies and local storage necessary to maintain login sessions, remember your language preference, and remember that you dismissed the install prompt, plus the Mapbox local identifier, without advertising tracking storage. You may manage device permissions and local storage in your device or browser settings (clearing login storage may sign you out, and clearing map local storage does not delete historical technical records held by third parties). These third-party providers may process requests and data in the regions where their infrastructure operates.

6. Legal Disclosures and Data Security

We never sell or rent your personal information to any third party, and we do not share your personal information for cross-context behavioral advertising. We may disclose information only when required by applicable law or valid legal process, or as necessary and lawful to protect the safety of users, the public, or the Platform, or to investigate fraud or violations. In the event of a merger, acquisition, or business asset transfer involving the operator, relevant information may be transferred subject to this Policy and applicable legal protections, with notice provided as required by law.

We use security measures including transport encryption, access controls, private file storage, and server-side permission checks to protect your data. However, no internet transmission or electronic storage system can guarantee absolute security. Please do not enter unrelated identification numbers, payment card details, or others' sensitive information in request descriptions, service reports, objections, report explanations, or customer notes.

7. Self-Service Account Deletion and Scope

You may request self-service account deletion at any time at the bottom of the Account page in the app (by confirming your login password) or email info@22lights.com for assistance. If your account has ongoing homeowner requests, incomplete technician service assignments, sole ownership of a company that has not been closed, frozen funds in your personal wallet, pending orders, or platform administrator status, you must resolve those matters first before deleting your account. Deleting an individual account does not close a merchant company.

Once account deletion is confirmed, there is no recovery grace period; the account is deactivated and remaining promotional Credits are forfeited. Upon deletion, your personal profile information is anonymized or cleared, including clearing or replacing your email address, name, phone number, avatar, saved addresses, personal in-app notifications, merchant customer notes about that homeowner, technician public phone, exact street addresses, precise coordinates, and contact details in closed requests, closed request descriptions, homeowner report objection reasons, the latest live location point, and personal blocking records involving that user; display names in accepted team invitations are replaced and membership is deactivated; and supplementary explanations in reports submitted by that user are cleared.

Account deletion does not erase all historical business records or irreversibly anonymize every retained record. Request titles, cities and ZIP codes, appointment records, service reports and revision snapshots, primary report records and administrator notes, audit records, and ledger transaction links are retained under the rules in Section 8, and counterparties see “Deleted User” in historical records. Where free-form text in retained records contains personal information, we handle it according to lawful necessity, and you may email us with specific access or deletion requests.

8. Data Retention Rules

Active Accounts and Routine Business Records: While your account remains active, we retain your profile, saved addresses, requests, appointments, service reports, and necessary business records to provide our services; information is retained for the period necessary and deleted or anonymized when no longer needed.
Credit Ledger Records (Retained for at Least 7 Years): Platform ledger and transaction records are retained for at least 7 years from the date of each transaction for financial reconciliation, auditing, fraud prevention, and compliance. After account deletion, ledger records retain links to the de-identified account identifier and transactions, and are deleted or anonymized when the retention period ends and they are no longer needed.
Consent Records (Retained for at Least 7 Years): Consent records—including registration acceptance, Handyman Merchant Declaration acceptance, and homeowner handyman notice acknowledgments—are retained for at least 7 years from each acceptance to establish the accepted document version, hash, and timestamp. After account deletion, unnecessary request or company context is cleared, while the account identifier, document type, version, text hash, acceptance time, language, display context, and duplicate-prevention marker are retained and linked to the anonymized account.
Handyman Identity Document Photographs: Identity document photographs submitted by handyman merchants during onboarding are visible only to Platform administrators for review, are not public, are not displayed to homeowners, and are deleted when no longer needed after verification is approved.
Merchant Qualifications and Insurance or Bond Files: Business licenses, industry qualification files, and optional insurance and bond credential files submitted by merchants are retained for the period necessary for qualification verification, handling complaints, and compliance, and are deleted or anonymized when no longer needed.
Report Records, Technical Logs, and Backups: Report and resolution records (target, reason category, status, administrator notes, and link to the anonymized reporter), administrative audit records, and security and troubleshooting logs are retained for the period necessary for safety review, preventing repeat abuse, troubleshooting, resolving open disputes, and fulfilling legal obligations, and are deleted or anonymized when no longer needed. System backups rotate and are overwritten on our infrastructure providers' rolling cycles.

9. Your Privacy Rights and California Residents Notice

You may edit available profile fields or use self-service account deletion on the Account page in the app, or email info@22lights.com to request access to, a copy of, correction of, or deletion of your personal information, or to ask about data retention. We verify your control of the registered email address and necessary account details proportionate to the risk of the request (without asking for unrelated sensitive documents) and respond within applicable legal timeframes. If you use an authorized agent, we will verify written proof of authorization and your confirmation as permitted by law. You will not face discrimination for exercising your lawful privacy rights.

Our service area is in California, United States. To the extent the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) apply, California residents have the rights to know and access, delete, correct, limit certain uses of sensitive personal information, and receive non-discriminatory treatment, subject to statutory conditions and exceptions. We do not sell personal information and do not share personal information for cross-context behavioral advertising; precise technician en-route location and merchant qualification or identity materials are used strictly to provide requested features, onboarding verification, and lawful safety purposes, and never to infer personal characteristics. See Sections 2 through 8 for the categories of information we collect, sources, purposes, disclosures, and retention rules.

10. Minors, Policy Updates, and Contact Information

The Platform is strictly for adults aged 18 and older and is not directed to minors under 18 or to children. If we learn that a minor under 18 has registered an account or submitted personal information, we will promptly investigate and take steps to deactivate the account and delete the information (or retain only what law strictly requires). Please report any such concerns to info@22lights.com.

When we make material updates to this Privacy Policy, we will update the version number and effective date and notify you via in-app notification, prominent notice, or email, and obtain renewed consent where required by law. Accepting this Privacy Policy does not replace device-level location permission prompts or waive any statutory privacy rights.

Operator: SU International LLC, California, United States; Contact Email: info@22lights.com.