Privacy Policy

This Privacy Policy explains what personal information ContractorRise collects, how we use it, who we share it with and the choices you have. It covers our website at contractorrise.app and the ContractorRise service: the business software that contractor companies use to manage leads, estimates, contracts and invoices.

1. Who we are

ContractorRise is operated by US Construction & Remodeling Corp (“ContractorRise”, “we”, “us”). You can reach us at info@contractorrise.app or by mail at 4424 Freeport Blvd, Ste 4, Sacramento, CA 95822.

We handle personal information in two roles:

For our own website and accounts (for example, the Start free form, sign-in and billing), we decide how the information is used. This policy describes that use.
For the records our customers keep in ContractorRise (their leads, customers, estimates, contracts and invoices), we act on the customer company’s behalf. The customer decides what is stored and why. Section 6 explains how we handle that data.

2. Information we collect

When you ask to start ContractorRise. The Start free form asks for your company name, your name, your work email, your phone number (optional), the company address you would like (yourcompany.contractorrise.app) and your trade. We email a 6-digit code to confirm the email address. We keep the request, with the time you accepted these terms, so we can set up your company and contact you.

When you sign in. You type your work email and we look it up in our directory of companies to find the company you belong to. We then open that company’s own sign-in page with your email filled in; your password is typed there, never on our website. Only a few tries an hour are allowed for each email and each network. The directory does not hold email addresses in readable form: it holds a keyed one-way code (a hash) made from each address. The sign-in form does not store the email you type in plain text.

IP addresses. We use your IP address briefly to limit abuse of our forms, such as too many requests from one network. We keep only a keyed one-way code made from it, never the address itself. For a confirmed Start free request, that code is kept with the request. Like most websites, our hosting provider’s servers may also record standard technical information (such as IP address, browser type and the page requested) for security and operations.

Accounts and users. When your company uses ContractorRise, we hold the details of its users (such as name, work email and role) and the information needed to sign them in and to run, secure and support the service.

Billing. Paid plans are billed by Stripe. Stripe collects your card or other payment details directly; we do not receive or store full card numbers. We receive limited billing information from Stripe, such as the company name, billing email, plan and payment status.

Messages you send us. If you email us, we keep the message and your contact details so we can answer and keep a record of support.

In the iPhone and Apple Watch app. The ContractorRise app shows your company’s ContractorRise service and asks for a device permission only when you use the feature that needs it: the camera to take job photos you choose to save, the microphone for calls and when you speak to the Assistant, and notifications to tell you about new leads, messages and calls. To deliver notifications we keep a device token that Apple issues for your device. The home screen widget and the Apple Watch app keep a small copy of today’s information on your device, such as your next appointment and how many calls are waiting, so they can show it; it is replaced as your day changes.

In the Android app. The ContractorRise Android app also shows your company’s ContractorRise service. Android asks for a device permission only when a page of the service needs it: the camera for job photos you choose to take and the microphone for calls and when you speak to the Assistant. Files you open from the service, such as estimate and invoice PDFs, are saved only in the app’s own temporary storage so your phone can show them, and the app clears files older than a day each time it starts. The app remembers the address of the company you signed in to, so it can open that company next time. Android asks before the app shows notifications, which tell you about new leads, messages and team calls. To deliver them we keep a device token that Google’s Firebase Cloud Messaging issues for the app on your phone. The home screen widget and the clocked-in notification keep a small copy of today’s information on your phone, such as how many calls are waiting, your next appointment and whether you are clocked in; it is replaced as your day changes. The Android app does not use your location or read your contacts.

3. How we use information

To set up your company, confirm your email address and take you to your company’s sign-in page.
To provide, maintain and secure the ContractorRise service, including backups.
To bill paid plans and keep billing records.
To answer questions and give support.
To send messages about your account and the service, such as setup notices, security notices and changes to these terms.
To prevent spam, fraud and abuse, and to protect our users and our systems.
To act on reports of objectionable team chat messages. When a user reports a message, a copy of it goes to their company’s administrators and to ContractorRise support.
To comply with the law and enforce our Terms of Service.

We do not sell personal information, we do not show advertising and we do not use personal information to profile you for advertising.

AI features. ContractorRise has two AI features: the AI Estimate Builder, which suggests estimate lines from a job description, and, where a company uses it, the Assistant, which answers questions and prepares work in the service from what a user types or says. They use outside AI providers, OpenAI and Anthropic, as our service providers. When a user uses an AI feature, we send the provider what that request needs: the text they type or the recording of what they say, photos they add to the request, and the records involved, such as customer names, addresses, job details and estimate lines. The providers use this data to produce the answer and return it to ContractorRise; under their business terms they do not use it to train their models. Each user is asked for permission the first time they use an AI feature, nothing is sent before they allow it, and they can withdraw it at any time in My Preferences > AI features. Users should leave out personal details that a request does not need.

4. Cookies and similar technologies

Our website uses no advertising trackers and no tracking pixels. Besides what the site needs to work, we use Google Analytics to count visits and see which pages are read:

Google Analytics cookies (_ga and _ga_ followed by an ID) that tell repeat visits apart and record the pages viewed, the page you came from and general device information. Google signals and ad personalization are turned off. They expire after up to two years. Google Analytics is not loaded when your browser sends a Global Privacy Control signal, and you can also block it with Google’s opt-out browser add-on.
WordPress cookies that our website software sets when they are needed, for example when a site administrator signs in.
A Start free progress cookie (cro_su) that keeps your place in the form while you confirm your email. It holds a random value, cannot be read by scripts on the page and expires after 30 minutes.
A Start free status cookie (cro_st), set once your email is confirmed, so the Start free page can show how far the setup of your company has got. It holds a random value, cannot be read by scripts on the page and expires after 30 days.
Short-lived records on our server that count requests to our forms to stop abuse. They are keyed by one-way codes, not by your email or IP address, and expire within a day.
The remembered company on the sign-in page. After you sign in this way, your browser’s local storage keeps that company’s address and name so the page can offer “Continue to” it next time. It stays on your device; “Use another email” removes it.

Inside the ContractorRise service, cookies keep users signed in. We do not use cookies for advertising.

We share personal information only with service providers that help us run ContractorRise, under contracts that limit their use of it to providing their services to us:

Stripe: payments and billing for paid plans.
Hostinger: hosting of the ContractorRise service, our website and our email.
OpenAI: AI features (the AI Estimate Builder, and the Assistant’s text, speech and photo processing), with the user’s permission as described in section 3.
Anthropic: the Assistant (what a user asks it and the records involved), with the user’s permission as described in section 3.
Apple: notifications to the iPhone and Apple Watch app (the Apple Push Notification service receives a device token and the notification text).
Google: address suggestions in ContractorRise (the part of an address a user has typed), roof and solar measurements where a company turns them on (the property address), notifications to the Android app (Firebase Cloud Messaging receives a device token and the notification text), and visit statistics for our website (Google Analytics).

Twilio. Calls and texts in ContractorRise work only when a customer connects its own Twilio account. Calls and messages then go through the customer’s Twilio account, under the customer’s own agreement with Twilio, and Twilio bills the customer directly.

We may also disclose information when the law requires it (for example, in response to a valid court order), to protect the rights, safety and property of our users, the public or ContractorRise, or as part of a merger, acquisition or sale of our business, in which case this policy will continue to apply to the information transferred. We may share information for other purposes with your consent.

6. Customer data in the service

Customer companies use ContractorRise to keep records about their own leads and customers, such as names, phone numbers, addresses, job details, estimates, contracts, invoices, messages and files (“Customer Data”). The customer company owns its Customer Data and decides what to collect and why. For Customer Data, the customer is the controller (a “business” under the California Consumer Privacy Act, as amended by the CPRA) and ContractorRise is its processor (a “service provider”). When we process Customer Data, we:

process it only to provide, secure and support the service, and as the customer instructs through the service or in writing;
do not sell or share it, and do not use it for advertising or for any purpose outside our relationship with the customer;
do not combine it with personal information from other sources, except as the law allows for a service provider;
limit access to personnel who need it and who are bound to keep it confidential;
use only the service providers listed in section 5, under written terms that protect the data;
help the customer answer requests from the people whose data it holds;
notify the customer of a security breach affecting its Customer Data, as described in section 9;
return the data on request and delete it after the account is closed, as described in section 8.

If you are a homeowner or other customer of a company that uses ContractorRise and you want to see, correct or delete your information, please contact that company directly. If you contact us, we will pass your request to the company.

If a customer has signed a separate data processing agreement with us, that agreement governs our handling of its Customer Data.

7. Where data is stored and how we protect it

ContractorRise runs on servers that we operate in the United States, rented from our hosting provider, Hostinger. Each customer company gets its own database and its own copy of the program, so one company’s records are kept apart from every other company’s.

Connections to our website and the service are encrypted in transit (TLS).
Backups are taken daily, encrypted and kept off the server they protect.
Access to production systems and Customer Data is limited to the people who need it to run and support the service.

No system is perfectly secure, but we work to protect personal information and to improve our safeguards over time.

8. How long we keep information

Customer Data and account information: for as long as the account is open. A customer can ask for an export of its Customer Data at any time. After an account is closed, we delete its Customer Data from our active systems within 30 days; copies in our encrypted backups are deleted as those backups expire on their regular schedule.
Deleting your user account: in the ContractorRise app or on the web, open your user menu (your photo or initials), choose Delete account and confirm with your password. Your sign-in ends at once, and your name, email address, phone numbers, address, photo and email signature are erased from your user. Records you made for your company, such as estimates, invoices and messages, stay with the company, which may be required to keep them, and show “Deleted user”. A company’s owner account cannot be deleted on its own; the owner closes the company instead.
Closing a company: the company’s owner opens the user menu, chooses Delete company and confirms with the company name and their password. The company closes at once and nobody can sign in to it. Its Customer Data is deleted from our active systems 30 days later and from our encrypted backups as they expire on their regular schedule. Billing records are kept as described below.
Start free requests: while we set up the company and answer you. Once a request is finished (the company is set up, or the request is declined), we remove your name, email address and phone number from it after 180 days; the name and address of a company that was set up stay with its account. You can ask us to delete a request sooner.
Start free progress: 30 minutes. Abuse-prevention counters: up to one day.
Billing records: for as long as tax and accounting laws require.

9. Security incidents

If we learn of a security breach that affects personal information or Customer Data we hold, we will notify the affected customers without undue delay, and notify individuals and authorities where the law requires. We will tell customers what we know, what we are doing about it and how to reach us, so they can meet any notice duties they have to their own customers.

10. Your privacy rights

Depending on where you live, including in California, you may have the right to:

know what personal information we have collected about you, and get a copy of it;
correct inaccurate personal information;
delete personal information we hold about you, with some exceptions (for example, records we must keep by law);
opt out of the sale or sharing of personal information (we do not sell or share it);
not be treated differently for using any of these rights.

Users of ContractorRise can delete their own account at any time from their user menu, as described in section 8. To make a request, email info@contractorrise.app with “Privacy request” in the subject. We will confirm your request by asking you to reply from, or confirm a code sent to, the email address we hold, and we will answer within 45 days. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity. For Customer Data, see section 6.

What we collected in the last 12 months. Identifiers (such as name, email address, phone number and one-way codes made from IP addresses), professional information (company name and trade), commercial information (plan and payment status) and limited technical information about website use. We collect it from you, from your company and from our service providers, for the purposes in section 3, and disclose it only to the service providers in section 5. Account sign-in credentials are used only to sign users in.

11. Do Not Sell or Share

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing; because we do neither, nothing further changes.

12. Children

ContractorRise is a business service and is not meant for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. When we do, we change the “Last updated” date at the top. If a change is material, we will tell customers by email or in the service before it takes effect.

14. Contact us

For questions or requests about privacy, email info@contractorrise.app or write to US Construction & Remodeling Corp, 4424 Freeport Blvd, Ste 4, Sacramento, CA 95822.