Privacy Policy

Construction Guy CRM, operated by Whithouz LLC ("we", "us"), is a customer-relationship and job-management application for contractors and builders, operated from Lutz, Florida, USA. This policy explains what information we collect when you use the service at constructionguycrm.com and in our mobile apps, how we use it, and the choices you have.

1. Information we collect

• Account information — your name, email address, password (stored only as a hash by our authentication provider), company name and the edition you chose.
• Business data you enter — contacts, leads, quotes, contracts, invoices, payments you record, crews, jobs, photos, documents, bids and notes. This data belongs to your company; we process it only to provide the service.
• Customer signatures and images — when your customers sign a contract or completion form electronically, we store the signature image, the signer's name, IP address and timestamp as the signed record. When you record a check payment you may upload images of the check; those are stored in a restricted bucket visible only to your company's administrators.
• Billing information — for Builder-edition subscriptions, payment is collected by Stripe. We receive your Stripe customer id, subscription status and invoice history. We never receive or store card numbers.
• Email connection — if you connect a Gmail account to send quotes, contracts and invoices from your own address, we store the OAuth tokens needed to send mail on your behalf. We only use the Gmail send permission to deliver documents you explicitly choose to send; we do not read your mailbox.
• Technical data — server logs (IP address, browser, timestamps, request outcome) kept for security and troubleshooting.

2. How we use information

• To operate the service: authenticate you, store and display your company's data, generate PDFs, send documents and reminders you initiate.
• To bill Builder-edition subscriptions and, for Field-edition companies that connect Stripe, to facilitate card payments from your customers to you.
• To send transactional emails (verification, invitations, password resets, billing notices). We do not send marketing email without your consent.
• To keep the service secure, prevent abuse and comply with law.

We do not sell personal information and we do not use your business data to train AI models.

3. Service providers

We share data only with providers needed to run the service, each bound by their own privacy and security terms:

• Supabase — database, authentication and file storage (hosted in the United States).
• Netlify — web hosting and serverless functions.
• Stripe — payment processing and subscription billing. Stripe's privacy policy is at stripe.com/privacy.
• Resend — delivery of account emails (verification, invitations, password resets).
• Google — only if you connect Gmail. Whithouz's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Your customers' information

When you enter a customer's details, send them a document or collect their signature, you are the controller of that information and Whithouz processes it on your behalf. You are responsible for having a lawful basis to collect it and for honoring your customers' requests about it; we will assist you with access or deletion requests that reach us.

5. Data retention and deletion

• Your company's data is kept for as long as your account is active.
• You can delete individual records at any time inside the app. You can request deletion of your account or your entire company workspace from Company Profile or by emailing us; we remove the data within 30 days, except records we must retain for legal, tax or dispute reasons (for example signed contracts and payment records, kept up to 7 years).
• Check images and signature images are retained only as long as needed to evidence the payment or agreement and are then removed on a scheduled basis.
• Server logs are kept for up to 90 days.

6. Security

All traffic is encrypted in transit (HTTPS). Data is isolated per company with database row-level security, so one company can never read another's records. Files are stored in private buckets and are reachable only through short-lived signed links. Secrets are held server-side and never sent to the browser. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

7. Your rights

You can access, correct or export your data inside the app, and you can ask us to delete it. Residents of certain jurisdictions (including the EU/UK and California) have additional rights to access, portability, restriction and non-discrimination; to exercise them, email us at the address below. We do not knowingly collect information from children under 13, and the service is not directed at them.

8. Cookies and local storage

We use only the storage needed to keep you signed in and remember your in-app preferences. We do not use advertising cookies or third-party trackers.

9. Changes

We may update this policy as the service evolves. Material changes will be announced in the app or by email before they take effect. The effective date at the top shows the current version.

10. Contact

Construction Guy CRM · Lutz, Florida, USA · hello@constructionguycrm.com