Privacy Policy

1. Introduction

Contracting.App ("we," "us," or "our"), operated by Custom Kleins LLC, provides a construction project management platform with integrated blockchain technology, smart contracts, and compliance tracking ("the Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website contracting.app and use our platform.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information You Provide

When you register for an account or use our Service, we may collect:

Identity Data: First name, last name, username, company name, and job title/position.
Contact Data: Email address, phone number(s), company address, and mailing address.
Financial Data: Bank account details (account number, routing number, bank name), EIN or Tax ID (stored encrypted), and payment information necessary to process transactions.
Blockchain Data: Ethereum wallet address(es) used for smart contract interactions, transaction hashes, and digital signatures.
Authentication Data: Password hash (we never store plaintext passwords), multi-factor authentication preferences, and OAuth provider identifiers (e.g., Google account ID if you use "Sign in with Google").
Professional Data: Contractor licenses, insurance documentation, certifications, and compliance records.

2.2 Information Collected Automatically

When you access the Service, we automatically collect:

Log Data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visits, and time spent on pages.
Device Data: Device type, unique device identifiers, and mobile network information.
Security Data: Login attempts, authentication events, and security-related audit logs to protect your account and detect suspicious activity.
Session Data: Cookies and session tokens necessary to maintain your authenticated state.

2.3 Information from Third Parties

Google OAuth: If you sign in with Google, we receive your Google account ID, email address, name, and profile picture URL. We do not receive your Google password.
Blockchain Networks: Transaction data, smart contract events, and wallet balances from public blockchain networks (e.g., Sei Network).

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Management: To create, maintain, and secure your account.
Service Delivery: To provide construction project management features, including contract creation, milestone tracking, payment processing, change orders, lien waivers, and dispute resolution.
Blockchain Operations: To execute and record smart contract transactions, verify digital signatures, and maintain immutable audit trails on the blockchain.
Payment Processing: To facilitate eChecks, split payments, and other financial transactions between contracting parties.
Communication: To send you service-related notifications, security alerts, and account updates.
Security: To detect fraud, prevent unauthorized access, monitor for suspicious activity, and enforce rate limits.
Compliance: To meet legal and regulatory obligations, including tax reporting and construction industry compliance requirements.
Improvement: To analyze usage patterns, diagnose technical issues, and improve the Service.

4. Data Storage and Security

4.1 Data Storage

Your data is stored in secure PostgreSQL databases hosted on dedicated servers. Sensitive financial information (bank details, tax IDs) is encrypted at rest using industry-standard encryption algorithms.

4.2 Blockchain Immutability

Certain transaction data, contract events, and audit logs are recorded on public blockchain networks. Blockchain records are immutable and cannot be deleted or modified once written. This is a core security feature that provides tamper-proof record keeping for construction transactions.

4.3 Security Measures

We implement comprehensive security measures including:

HTTPS/TLS encryption for all data in transit
Content Security Policy (CSP) headers to prevent cross-site scripting
CSRF protection on all form submissions
Rate limiting on authentication endpoints
Multi-factor authentication (MFA/2FA) support
PKCE-protected OAuth2 flows for third-party authentication
Encrypted storage for sensitive financial data
Regular security audits and automated monitoring

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Project Participants: Your name, company, and contact information may be shared with other parties on construction projects you participate in (e.g., general contractors, subcontractors, clients).
Blockchain Networks: Transaction data written to public blockchains is publicly visible by design. Wallet addresses and transaction details are accessible to anyone.
Service Providers: We use third-party services for cloud hosting, email delivery, and infrastructure management. These providers are contractually bound to protect your data.
Legal Requirements: We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Cookies and Tracking

We use essential cookies to:

Maintain your authenticated session
Store CSRF tokens for form security
Remember your theme and display preferences

We do not use advertising cookies, third-party tracking pixels, or analytics cookies that track you across other websites.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete personal data.
Deletion: Request deletion of your personal data, subject to legal retention requirements and blockchain immutability.
Data Portability: Request your data in a structured, machine-readable format.
Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
Opt-Out: Unsubscribe from non-essential communications at any time.

To exercise any of these rights, please contact us at privacy@contracting.app.

Note: Data recorded on the blockchain cannot be deleted due to the immutable nature of blockchain technology. This includes transaction hashes, smart contract events, and on-chain audit logs.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion:

Account data is removed from our databases within 30 days.
Financial records may be retained for up to 7 years for tax and regulatory compliance.
Blockchain records remain permanently on-chain.
Security audit logs are retained for 1 year.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete that information.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

11. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.