Privacy Policy

Revised draft for counsel review · Effective date: [EFFECTIVE DATE]

Published webpage-copy version: privacy-2026-09-30-revised-packet-v2

1. Information we collect

• Information you provide: job description, municipality or approximate location, urgency, photos/files, preferences, messages, name, phone, email, and other information you choose to provide.
• WhatsApp and communications data: phone number, profile name or other channel-provided metadata, conversation content, delivery status, and consent/opt-out records.
• Contractor information: personal or business name, contacts, categories, service areas, quotes, availability, registrations, licenses, insurance, bonds, documents, and credential-check results.
• Technical data: IP address, browser/device type, security logs, timestamps, session identifiers, pages/actions used, and data needed for fraud prevention, auditing, and reliability.
• Derived data: request classifications, summaries, labels, category/municipality matches, and other outputs generated to operate the service.

2. How we use information

• Receive, understand, and complete service requests.
• Find candidates and verify or review contractor information.
• Request, receive, normalize, and display quotes.
• Share customer contact details only after the applicable consent.
• Administer accounts, consent, opt-outs, security, fraud prevention, support, and auditing.
• Comply with law and respond to valid legal process.
• Improve the service, subject to this policy and applicable controls.

3. Automated tools and artificial intelligence

The current workflow uses deterministic Worker rules to classify requests, identify missing information, and process replies. The deployed Worker does not send personal information to an external artificial-intelligence provider. If one is introduced, this policy will be updated before it is enabled. Do not use the service to transmit unnecessary highly sensitive information.

4. Who we share information with

• Selected contractors: information needed to quote and, after affirmative consent, the customer contact details authorized for disclosure.
• Service providers: vendors that host, store, secure, transmit, or process data to operate the service, including categories such as hosting/database, WhatsApp/Meta, email, security, analytics if enabled, and automation/AI. They must process information for the contracted function subject to applicable controls.
• Authorities and protection: when required by law or valid process, or to prevent fraud, protect safety, or protect rights.
• Corporate transactions: in a merger, financing, acquisition, reorganization, or sale of assets, subject to reasonable measures and applicable law.

Technical configuration observed on the current site

The site and API use Cloudflare Workers; operational data uses Cloudflare D1, Assets, and Queue. Email delivery and inbound-email processing use Resend. The WhatsApp integration uses Meta Cloud API. General WhatsApp/email sending is disabled, and inbound WhatsApp is blocked until its signing secret is configured. The deployed Worker does not call Jev/TypeSafe or an external artificial-intelligence provider.

5. Customer contact disclosure to contractors

By default, the customer's name and phone number remain hidden. Before disclosure, we will identify the contractor or contractors that will receive the details and request an affirmative action. If the customer declines, does not respond, or withdraws consent before disclosure, the information will not be released through that flow. Once lawfully shared, the contractor is responsible for its own handling under applicable legal and contractual duties.

6. WhatsApp and other third parties

Messages sent through WhatsApp are transported and processed under Meta/WhatsApp terms and policies in addition to this policy. Other providers may process information in the United States or other places where they operate. Before launch, the business must maintain an up-to-date internal list of production vendors and functions.

7. Cookies, analytics, and Do Not Track

A review of application code and tested responses on September 30, 2026 found no analytics tags, advertising pixels, session recording, or cross-site tracking code, and no application logic that reads the browser Do Not Track signal. The responses tested did not include a Set-Cookie header. Cloudflare adds Network Error Logging/report-to headers. Cloudflare account-level settings have not been verified; they must be checked before commercial publication.

8. Retention

We retain information for as long as reasonably necessary to operate the service, complete requests, maintain security and audit records, resolve disputes, and meet legal obligations. Consent, opt-out, and outreach records subject to specific requirements are retained for the required period. When information is no longer reasonably necessary, it will be deleted, anonymized, or retained only where a legal obligation or applicable legitimate need remains.

9. Security

We use reasonable administrative, technical, and organizational safeguards, including data minimization, access controls, secret separation, audit logs, and masking where appropriate. No system can guarantee absolute security.

10. Security incidents and breach notice

If a security breach covered by law occurs, we will evaluate and contain the incident and notify affected individuals, DACO, or other authorities as required by applicable law. Operations must maintain an incident-response plan capable of meeting applicable legal deadlines.

11. Your choices and privacy requests

You may stop using the service and may request access, correction, or deletion where applicable. To protect accounts and third parties, we may verify identity and authority before completing a request. Send requests to [PRIVACY EMAIL] or the official WhatsApp channel and identify the message as a privacy request. Some requests may be limited by legal obligations, security, fraud prevention, disputes, or the need to retain an opt-out record.

12. Communications and opt-out

Promotional messages or service opportunities will be sent only consistent with applicable consent and channel rules. You may withdraw WhatsApp or email consent using the instructions in the message. We will maintain a suppression record reasonably necessary to honor the opt-out.

13. Minors and legal capacity

The service is designed for people with legal capacity to request or contract for services and is not directed to children. If we learn that we collected personal information from a person without sufficient legal capacity in circumstances requiring authorization, we will take reasonable steps to delete it or manage the required consent.

14. Changes to this policy

We will publish the updated policy on the same site and show the new effective date. For material changes, we will use a reasonable notice method appropriate to the relationship and information affected. We will not describe future practices as current: the policy must match actual operations.

15. Business contact

[LEGAL ENTITY NAME] d/b/a Cuanto Sale PR | [PHYSICAL POSTAL ADDRESS] | [PRIVACY EMAIL] | [SUPPORT EMAIL].