Privacy Policy

1. Introduction

Contracting.App ("we," "us," or "our"), operated by Custom Kleins LLC, provides construction project-coordination workflows (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit contracting.app and use the currently available Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information You Provide

When you register for an account or use our Service, we may collect:

Identity Data: First name, last name, username, company name, and job title/position.
Contact Data: Email address, phone number(s), company address, and mailing address.
Project and collaboration data: Information you enter into enabled project workspaces, such as participants, project records, tasks, schedules, and communications.
Unavailable financial and on-chain data: The current Service does not collect bank-account credentials, tax identifiers for payment processing, payment instructions, private keys, or blockchain transaction data through an active financial or on-chain workflow.
Authentication Data: Password hash (we never store plaintext passwords), multi-factor authentication preferences, and OAuth provider identifiers (e.g., Google account ID if you use "Sign in with Google").
Professional Data: Contractor licenses, insurance documentation, certifications, and compliance records.

2.2 Information Collected Automatically

When you access the Service, we automatically collect:

Log Data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visits, and time spent on pages.
Security Data: Login attempts, authentication events, and security-related audit records used to protect accounts and investigate suspicious activity.
Session Data: Cookies and session tokens necessary to maintain your authenticated state.

2.3 Information from Third Parties

Google OAuth: If you sign in with Google, we receive your Google account ID, email address, name, and profile picture URL. We do not receive your Google password.

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Management: To create, maintain, and secure your account.
Service Delivery: To provide the enabled project-coordination, membership, collaboration, and operational-record workflows shown in the Service.
Communication: To send you service-related notifications, security alerts, and account updates.
Security: To detect fraud, prevent unauthorized access, monitor for suspicious activity, and enforce rate limits.
Legal obligations: To meet applicable legal and regulatory obligations for the Service as operated.
Improvement: To analyze usage patterns, diagnose technical issues, and improve the Service.

4. Data Storage and Security

4.1 Data Storage

Service data is stored in the application database and supporting infrastructure needed to operate the currently available Service. The current Service does not operate a payment or custody workflow or collect payment credentials through an active financial workflow.

4.2 Financial and On-Chain Workflows

The current Service does not submit payment instructions, custody funds, execute smart-contract transactions, or create permanent blockchain records. Do not provide private keys or payment information to the Service for those purposes.

4.3 Security Measures

We implement comprehensive security measures including:

HTTPS/TLS encryption for all data in transit
Content Security Policy (CSP) headers to prevent cross-site scripting
CSRF protection on all form submissions
Rate limiting on authentication endpoints
Multi-factor authentication (MFA/2FA) support
PKCE-protected OAuth2 flows for third-party authentication
Authorization checks for enabled project and account workflows

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Project Participants: Your name, company, and contact information may be shared with other parties on construction projects you participate in (e.g., general contractors, subcontractors, clients).
Service Providers: We use third-party services for cloud hosting, email delivery, and infrastructure management. These providers are contractually bound to protect your data.
Legal Requirements: We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Cookies and Tracking

We use essential cookies to:

Maintain your authenticated session
Store CSRF tokens for form security
Remember your theme and display preferences

We do not use advertising cookies, third-party tracking pixels, or analytics cookies that track you across other websites.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete personal data.
Deletion: Request deletion of personal data, subject to applicable legal and operational retention requirements.
Data Portability: Request your data in a structured, machine-readable format.
Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
Opt-Out: Unsubscribe from non-essential communications at any time.

To exercise any of these rights, please contact us at privacy@contracting.app.

8. Data Retention

We retain personal, project, and security data only for as long as needed to operate the Service, protect accounts, resolve disputes, and meet applicable legal obligations. Retention periods can vary by record type and are reviewed as the Service evolves.

Account-deletion and data-rights requests are reviewed through privacy@contracting.app.
We will publish any material retention-policy change before applying it to newly collected data where required by law.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal information, we will take steps to delete that information.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information.

11. International Data Transfers

Our servers are located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.