Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account & Profile Data — business name, contact name, email address, phone number, business address, tax identifier (EIN/Tax ID) if you choose to enter it, and payment details you enter into the workspace.
• Client & Project Data — client names, billing addresses, project details, milestones, work logs, invoices, and expenses that you create inside the Service. In our default configuration, this data remains on your device.
• Communications — messages you send to our support email, feedback, or responses to surveys.

1.2 Information Collected Automatically

• Server Logs (Portal only) — when you or your clients access the optional Client Portal, our server records standard HTTP request data (IP address, user agent, timestamp) for security and abuse prevention.
• License & Subscription Data — if you subscribe to Contractor Pro, our payment processor (Paddle) collects and processes payment information. We receive only a license key and subscription status, not your full card details.

1.3 Information We Do NOT Collect

• We do not sell your personal information.
• We do not track you across other websites.
• We do not collect the content of your local workspace unless you explicitly enable cloud sync or client portal sharing.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process subscription payments (via Paddle) and verify license keys.
• Respond to your support requests and inquiries.
• Send service-related announcements (e.g., security updates) when necessary.
• Detect, prevent, and address technical issues, fraud, or abuse.
• Comply with legal obligations.

We do not use your data for advertising, and we do not sell it to third parties.

3. Local-First Architecture

ContractPulse is designed as a local-first application. This means:

• Your core workspace data — clients, projects, work logs, invoices, expenses, and settings — is stored in your browser's local storage (IndexedDB / localStorage) on your own device.
• By default, this data is never transmitted to our servers.
• You can export your data at any time as JSON or CSV.
• If you clear your browser data, you will lose your local workspace unless you have previously exported a backup.

4. Sharing & Third Parties

We share information only with the following categories of service providers, and only as necessary to operate the Service:

• Paddle.com — Merchant of Record for all subscription payments. Paddle handles payment processing, tax compliance, and refunds. See Paddle's privacy policy at paddle.com/legal/privacy.
• Cloudflare, Inc. — hosting and infrastructure for the optional Client Portal, and for DNS. See cloudflare.com/privacypolicy.
• Brevo (Sendinblue SAS) — transactional email delivery (e.g., license key emails). See brevo.com/legal/privacypolicy.

We may also disclose information when required by law, subpoena, or to protect our rights or the safety of our users.

5. Cookies & Local Storage

ContractPulse uses browser localStorage and IndexedDB to store your workspace data, application state, and theme preference. This data stays on your device.

We do not use third-party tracking cookies, advertising cookies, or cross-site tracking technologies.

If you disable localStorage in your browser, the Service may not function correctly.

6. Data Retention

• Local workspace data — retained on your device until you delete it or clear your browser data.
• Portal data — client portal snapshots and messages are retained while the portal share is active. You can revoke a portal at any time, which deletes the associated server data.
• Payment & license data — retained by Paddle in accordance with their policies and applicable tax law.
• Support communications — retained for as long as needed to resolve your issue, then archived or deleted.

7. Your Rights (CCPA / GDPR)

7.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Access a copy of the personal information we hold about you.
• Delete personal information we hold about you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information — note that we do not sell or share your personal information as defined by CCPA.
• Non-discrimination — we will not discriminate against you for exercising your privacy rights.

7.2 EU/EEA/UK Residents (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access, correct, or delete your personal data.
• Restrict or object to processing.
• Data portability.
• Lodge a complaint with your local data protection authority.

Our legal basis for processing is typically contract performance (for providing the Service) or legitimate interest (for security and abuse prevention).

7.3 How to Exercise Your Rights

Email us at asktobepictured@gmail.com with the subject line "Privacy Request". We will respond within 45 days as required by law.

8. Do Not Sell My Personal Information

If you are a California resident and wish to submit a formal request regarding the sale of personal information, you may email asktobepictured@gmail.com with the subject "Do Not Sell Request". We will confirm in writing that your information has not been sold.

You may also use the Global Privacy Control (GPC) signal in your browser to indicate your preference. We honor GPC signals.

9. Security

We take reasonable technical and organizational measures to protect your information, including:

• HTTPS/TLS encryption in transit for all server communications.
• Cloudflare's security infrastructure for the optional Client Portal.
• No storage of your local workspace data on our servers.
• Access controls limiting who at ContractPulse can view server-side data.

No method of transmission or storage is 100% secure. You use the Service at your own risk. If you believe your data has been compromised, contact us immediately.

10. Children's Privacy

ContractPulse is not intended for children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you via the Service or email.

Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

12. Contact Us