Privacy Policy

This Privacy Policy explains how [ContractToCozy Legal Entity Name] ("ContractToCozy," "we," "us," or "our") collects, uses, shares, and protects information when you use our website, dashboard, and related applications (the "Service"). It applies to homeowners and service providers who create an account.

1. Information We Collect

• Account information: name, email, phone number, password (stored as a salted hash, never in plain text), and role (homeowner or provider).
• Property information: address, purchase price, appraised value, mortgage details, inventory items, photos, and documents you upload or connect for maintenance, risk, and financial-planning features.
• Financial-planning inputs: reserve fund contributions, coverage and insurance details, and similar figures you enter for budgeting and risk tools. We do not collect full payment card numbers directly — payment processing, if and when introduced, is handled by a PCI-compliant third-party processor.
• Usage and device data:pages viewed, features used, timestamps, IP address, browser/device type, and similar analytics collected via our product-analytics system and, where you've consented, Grafana Faro real-user-monitoring.
• Cookies: essential cookies required for sign-in, and optional analytics cookies you can accept or decline via the cookie banner. See our Cookie Policy for details.
• Communications: messages you send us (e.g. support requests, in-app feedback) and the content of those messages.

2. How We Use Information

• To provide, maintain, and personalize the Service, including guidance, risk, and financial tools;
• To operate the marketplace connecting you with Providers, where applicable;
• To send transactional communications (account, security, and service-related notices) and, where permitted, product updates;
• To detect, prevent, and respond to fraud, abuse, and security incidents;
• To analyze product usage and improve the Service; and
• To comply with legal obligations.

3. AI Processing

Certain features send relevant portions of your property, inventory, and account data to Google Gemini (a third-party AI provider) to generate guidance, cost estimates, and analysis. This data is transmitted securely and used to generate a response to your request; it is subject to Google's applicable API data-handling terms in addition to this Policy. Do not upload content to AI-powered features that you are not comfortable having processed by a third-party AI model.

4. How We Share Information

We do not sell your personal information. We share information only:

• With Providers,when you request a quote or booking, limited to what's needed to fulfill that request;
• With service providers we use to operate the Service (e.g. cloud hosting, email delivery, error monitoring, AI processing), under contractual confidentiality obligations;
• For legal reasons, if required by law, subpoena, or to protect the rights, safety, or property of ContractToCozy, our users, or the public; and
• In a business transfer, such as a merger, acquisition, or asset sale, in which case we will provide notice before your information becomes subject to a different privacy policy.

5. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we are required to retain it for legal, accounting, or security purposes (e.g. fraud prevention records).

6. Data Security

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit (TLS), access controls, and authenticated, rate-limited APIs. As a pilot-stage product, our security program is still maturing — notably, database encryption at rest is on our roadmap but not yet implemented. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

You can access and update most of your information directly from your account settings. You can delete or deactivate your account at any time from your profile page's Danger Zone, which permanently removes or anonymizes your data subject to Section 5 above. Depending on where you live, you may have additional rights (such as access, correction, deletion, portability, or objection to processing) under laws like the CCPA or GDPR. To exercise these rights, email [email protected].

8. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.

9. International Users

The Service is currently operated for a pilot audience primarily located in the United States, and your information is processed and stored in the United States. [Cross-border transfer mechanism, if the pilot expands internationally, to be finalized with counsel.]

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, by email or an in-app notice) before they take effect.

11. Contact

Questions about this Policy, or requests regarding your information, can be sent to [email protected].