Effective October 13, 2026
Last updated October 13, 2026
Ethos Agency LLC, a Utah limited liability company doing business as Turn One ("we" or "us"), provides hosted software for US flooring businesses. Turn One was formerly known as Rollwise. This policy explains how we handle personal information in our websites, Service, account administration, and communications.
Contact: [email protected]. Business mailing address: Ethos Agency LLC d/b/a Turn One, 1367 East Miller Ave, A701, Millcreek, UT 84106.
1. Our role and the customer's role
For account administration, billing, security, support, our own marketing, and our website operations, we decide how personal information is used. Privacy laws may call us a "controller" or "business" for these purposes.
For information that a flooring business puts into Turn One about its customers, residents, employees, installers, and vendors, that business decides the purposes of use. We process that information on its behalf under our Terms and any signed data processing addendum. Privacy laws may call us a "processor" or "service provider" for that work. A company's administrator controls access within its account.
If your information is held by a flooring business using Turn One, contact that business first about its use of your information. You may also contact us. We will help direct the request and assist the business as required. Its own privacy notice applies to its choices.
2. Information we collect and its sources
- Account and business contacts: names, work email addresses, phone numbers, company details, business and billing addresses, roles, and branch access. You, your employer, or an account administrator provide these details.
- Customer business records: customer and vendor contacts, property and installation addresses, Job records, schedules, estimates, invoices, accounting entries, payment records, inventory records, documents, photos, messages, and related personnel or tax records. Customers and their authorized users provide or import these records.
- Subscription and payment information: seat counts, subscription status, discounts, invoices, payment status, tax information, and limited payment-method details. Stripe collects subscription payment credentials directly. We receive provider references, status, and limited details such as card brand, last four digits, and expiry date. This is separate from financial records a customer stores in its own ERP account.
- Device, usage, and security information: IP address, browser, device type, page and feature use, timestamps, errors, authentication records, and audit events. These come from your device and use of the Service. Optional product analytics can be linked to a user identifier, company, role, and branch, subject to the choices in section 7. We do not use session replay at launch.
- Contract and support records: document acceptances and versions, requests, emails, feedback, and records of authorized support access. These come from you, your administrators, and our work on your requests.
Some business records can contain sensitive information, such as tax identifiers or financial details. Submit only information needed for the supported business function. Do not send account passwords or payment-card security codes in support messages. We do not seek unrelated health records, biometric identifiers, or precise device location for this Service.
3. Why we use personal information
We use personal information to create accounts, authenticate users, enforce permissions, store and process business records, provide exports, and support the Service. We also use it to bill subscriptions, process payment and tax administration, prevent fraud, investigate errors and security events, and maintain audit records.
We use account and usage information to understand feature use and improve the Service, subject to section 7. We use contact details to answer requests and send service, billing, security, and legal notices. We will send marketing emails at launch to US business contacts under the opt-out basis in section 10. We keep marketing separate from service and transactional notices. We also use records to meet legal duties, resolve disputes, and enforce agreements.
The commercial use of aggregated, de-identified data is described in section 6. That permission is not permission to sell identifiable customer records. Any new personal-data purpose remains subject to applicable notice, consent, and contract requirements.
4. When we disclose information
- Within a customer account: to authorized users under the permissions set by the customer. Recipients of documents and messages receive information when an authorized user sends it to them.
- To service providers: for the functions in section 5, with access limited to the work they perform. Professional advisers may receive information needed for legal, tax, accounting, or similar services under applicable confidentiality duties.
- At your direction: to a connection, recipient, or other service that you or your company chooses.
- For legal and security purposes: when required by law or reasonably needed to address fraud, protect rights and safety, enforce agreements, or respond to a lawful request. We limit disclosures to the purpose involved.
- In a business transaction: to advisers or a prospective or actual successor during a merger, financing, reorganization, or sale, under appropriate protections. A successor must honor applicable data protection duties. We give notice of material changes as required.
The data-sale permission in our Terms is limited to data that meets section 6. It does not authorize sale of identifiable personal information or disclosure for cross-context behavioral advertising. A future change in personal-data practices would require legal review and any required notice, choice, or consent before it begins.
5. Service providers and subprocessors
These providers support the Service. A "subprocessor" processes personal information for us when we act for a customer. A provider may also have a separate legal role for some activities.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Database, authentication, and file storage | Account information, sign-in records, Customer Data, and stored files |
| Cloudflare | Application hosting, content delivery, network protection, and related storage | Network and request data, content handled by the application, and files or backups placed in its storage |
| Stripe | Subscription billing, payment processing, tax, and fraud checks | Billing contacts, subscription and tax records, payment credentials supplied directly to Stripe, and payment status |
| Resend | Email delivery | Recipient addresses, message content, attachments when sent, and delivery records |
| PostHog | Optional product analytics and error investigation, subject to section 7; no session replay at launch | Usage events, user and company identifiers, and device data |
Stripe may process some information for its own payment, fraud, and legal duties. A customer-selected external service is also governed by that service's notice. We update this list when providers change. The notice and objection process for Customer Data subprocessors is in Terms section 8.
6. Aggregated and de-identified data
We may use, share, license, and sell information that is both aggregated and de-identified. This can include industry statistics, operating trends, benchmarks, and information used for research, product improvement, or automated analysis and model development.
The information must not identify, or reasonably permit identification of, a person, household, or customer business. We use reasonable safeguards to prevent re-identification. We publicly commit to maintain and use it in de-identified form and not attempt to re-identify it. We contractually require recipients to do the same. Removing a name or substituting an identifier alone does not make data de-identified.
Information that still permits identification remains subject to the personal-information and confidentiality rules. Data that meets this section may remain after an account closes or source records are deleted.
7. Cookies, analytics, and website choices
The Service uses browser storage and cookies for sign-in, security, and preferences. Nonessential product analytics, including optional PostHog analytics, stays off until required notices and consent or opt-out controls are implemented and verified. We do not use session replay at launch. Required sign-in and security storage is separate from optional product analytics.
The static getturnone.com pages contain no analytics scripts, advertising pixels, forms, or cookies set by the page code. Fonts are hosted with the pages. A hosting provider can still process network requests and logs when a site is served. This website statement does not describe the separate app.
You can manage cookies and local storage through your browser. Blocking required storage can prevent sign-in or other functions. Contact us about analytics choices. These static pages perform no personal-information sale or targeted-advertising activity. They have no such activity to switch off in response to Global Privacy Control or a Do Not Track signal. Any app or future website tracking must honor legally required opt-out signals and choices.
8. Retention, export, and deletion
Customers own their business data. They can export it while active and during the 12 months after cancellation takes effect. After that access window, they can contact us to request an export. Expiry of setup, cancellation, or expiry of the access window does not automatically delete Customer Data.
An authorized customer representative can send a written deletion request to [email protected]. We verify authority, check legal holds and required retention, and explain the scope and expected schedule. A request being recorded or approved does not mean deletion is complete. Applicable legal deadlines still apply. We confirm completion. Protected backup copies may remain until the backup cycle ends.
We retain account, billing, tax, acceptance, and support records as needed for their purposes and legal duties. Usage and security records are retained as needed for service operation, investigation, and protection. We consider the information's sensitivity, the account relationship, legal record duties, and active disputes when setting retention. We do not promise a fixed retention or backup-erasure period in this Privacy Policy. Retained personal information remains protected and limited to lawful purposes.
9. Security and processing locations
We use reasonable safeguards intended to protect information. These include access controls, separation of customer accounts, secure connections, and activity records. No system can guarantee complete security. We notify affected customers and others of security incidents as applicable law requires. This policy does not claim a security certification or independent audit.
We offer the Service to US businesses. That customer restriction is not a promise that every provider, staff member, network route, or processing activity is located in the United States. Providers may process information in other locations subject to applicable protections. Contact us about location requirements before submitting data that has such a restriction.
10. Privacy requests and communication choices
Contact [email protected] to ask to access, correct, delete, or receive a copy of personal information, or to raise a privacy concern. State your request and your relationship to Turn One. Do not include passwords or unnecessary sensitive records. We may ask for information needed to verify identity or authority. An authorized agent may submit a request with proof of authority where law permits it.
Depending on your state and the law's application, you may have rights to know what personal information is collected and disclosed; access, correct, delete, or obtain a portable copy; opt out of sale, targeted advertising, or certain profiling; or limit certain uses of sensitive information. We honor applicable rights and required opt-out signals. We do not discriminate for exercising a protected right. Exceptions may apply, including records needed for legal duties or security.
We respond within the time applicable law requires. If we deny a request, we explain the reason where required. You may ask us to review that decision by emailing with the subject "Privacy appeal." We will explain any further appeal or regulator complaint route required by your state's law. For Customer Data, we work with the customer that controls it. A company's administrator cannot waive an individual's legal rights through these Terms.
We will send marketing emails at launch to US business contacts on an opt-out basis under CAN-SPAM. Prior express consent is not required under that law. This basis does not mean you gave express consent. We obtain consent before sending where another applicable law requires it.
Every marketing email will include an unsubscribe link and our physical mailing address: 1367 East Miller Ave, A701, Millcreek, UT 84106. You may use the link or ask [email protected] to stop marketing emails. We will honor unsubscribe requests within 10 business days.
We keep marketing emails separate from service and transactional notices. Unsubscribing from marketing does not stop necessary account, billing, security, or legal notices. Receiving marketing is not required to use the Service. Your administrator can help with account details and access. You may contact us directly if that route is not suitable.
11. Children
The Service is for business use and is not directed to children under 16. We do not knowingly collect their personal information for our own account or marketing purposes. Do not create an account for a child under 16. If you believe a child has supplied information to us, contact us so we can review and take appropriate action. Customers remain responsible for lawful handling of any information about minors in their business records.
12. Policy changes and contact
We will post an approved policy with its effective date and identify later changes by date. We will give administrators at least 30 days' notice of material changes by email or in the Service. Required acceptance is tracked separately from the Terms. New uses of previously collected information remain subject to any notice and consent required by law.
For privacy questions or requests, write to [email protected] or Ethos Agency LLC d/b/a Turn One, 1367 East Miller Ave, A701, Millcreek, UT 84106.