1.Who this policy is from
EasyContractor is operated by Easy Contractor, LLC ("we", "us"), of P.O. Box 481, Laceys Spring, AL 35754-0481. This policy covers our website at easycontractor.app, the EasyContractor web application, and the field application used by crews.
It does not cover any third-party website you reach from ours. Those sites have their own policies, and we have no control over them.
2.Two different roles — read this first
Almost every question about your privacy rights here depends on which of two roles we are in, so it is worth being clear about them before anything else.
2.1Information about our own customers
When a contracting business signs up, we decide what account information we need and how we use it. For that information we are the controller, and this policy is the full description of what we do with it.
2.2Information a customer puts into the service
Most of the personal information in EasyContractor is not about our customers. It is about their clients and their employees: homeowners' names and addresses, crew members' hours, GPS positions recorded when someone clocks in.
We did not choose to collect any of that and we do not decide what it is used for. The contracting business does. For this information we are a processor — a service provider acting on their instructions — and they are the controller.
If you are a crew member or a customer of a contractor
We hold information about you because the business you work for, or hired, put it here. We cannot change it or delete it on your instruction, because it is not ours to decide about — ask them first. If you cannot reach them, write to us at privacy@easycontractor.app and we will help you identify who to contact and pass your request on.
3.What we collect
3.1Account information
- Your name, email address and mobile phone number.
- Your company name, and the role you hold in it.
- A password, stored only as a cryptographic hash — we cannot read it and cannot tell you what it is.
- Your organisation's logo, if you upload one.
The email address is confirmed by a link and the phone number by a one-time code before an account becomes usable. Both exist to keep automated sign-ups out, and the phone number is not used for marketing.
3.2Billing information
Subscriptions are processed by Stripe. Card numbers are entered on Stripe's own payment page and are never sent to or stored on our servers. We keep the subscription's status, plan, renewal date and Stripe identifiers — enough to know whether an account is paid up, and nothing more.
3.3Information you enter about other people
- Your clients: name, business or site address, email address, phone number, and any notes you record about a job.
- Your team: name, email address, role, permissions, and the hours they work.
- Jobs, schedules, equipment, products and the activity log of who changed what.
3.4Location information
When a crew member clocks in or out, or starts or ends a job, the field application asks the device for a GPS position and records it against that punch, with an accuracy figure where the device provides one.
How location works, precisely
- A position is recorded only at the moment of a punch. There is no continuous tracking, no background collection, and nothing is recorded while the application is closed.
- If the device refuses permission, the punch is recorded without a position. Clocking in still works.
- Positions are visible to the employing business, not to us for any purpose of our own, and never to other businesses using the service.
Whether to use this feature, and whether the crew have agreed to it, is the employing business's decision and responsibility — see section 5 of our Terms and Conditions.
3.5Information collected automatically
- Session records: the IP address and browser user-agent for each signed-in session, so you can see and revoke your own devices and so we can rate-limit sign-in attempts.
- Server logs, containing request paths, timestamps and error details. These deliberately exclude session cookies and query strings, because those carry credentials and customer data.
- Files you upload, stored on our own servers rather than a third-party service.
3.6Marketing enquiries
If you fill in a contact, demo, early-access, distributor or survey form, we keep what you submitted so we can reply. If nothing comes of it, we delete it.
4.Cookies, and what we do not do
We use cookies for one purpose: keeping you signed in. There are no advertising cookies, no tracking pixels, and no third-party marketing tags anywhere in the product.
Traffic statistics for the public marketing pages come from Simple Analytics, which is cookie-free and collects no personal data and no cross-site identifiers. That is why you are not asked to dismiss a cookie banner.
We do not sell your information
We have never sold or shared personal information for money or for cross-context behavioural advertising, as those terms are defined under California law, and we do not do so now. We do not use customer data to train machine-learning models. We do not combine one customer's data with another's.
5.Why we use it
- To provide the service — to show you your jobs, your customers and your hours, and to let your team sign in.
- To take payment, and to tell you when a trial or a card is about to expire.
- To verify an email address and a phone number at sign-up, which is how we keep automated sign-ups out.
- To send messages the service depends on: password resets, team invitations, billing notices. These are not marketing and cannot be unsubscribed from while an account is open.
- To keep the service secure — rate-limiting sign-in attempts, investigating abuse, and keeping an activity log of changes to time records.
- To fix faults. Error reports are generated automatically and deliberately strip session cookies and query strings before they leave the server.
- To provide AI assistance, only where your company's owner has switched it on: the text a feature needs — such as one material request — is sent to OpenAI to be read, and the suggestions come back to the person who asked. Nothing else about your jobs, customers or team is sent with it, and nothing is acted on without a person deciding.
- To meet our legal and tax obligations.
Where the UK GDPR or EU GDPR applies, our lawful bases are performance of a contract (to provide and bill for the service), legitimate interests (security, fault diagnosis, and replying to enquiries) and legal obligation (tax and accounting records).
6.Who else can see it
We use a small number of service providers, each for one job. They may only process data on our instructions and may not use it for their own purposes. This is the complete list.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Hostinger | Virtual server hosting. The application, its database and uploaded files all run here. | All service data | United States |
| Stripe | Payment processing and subscription billing. | Billing contact, payment card details (held by Stripe, never by us) | United States |
| Resend | Transactional email — sign-up confirmation, password resets, team invitations. | Name, email address, message content | United States |
| Twilio | SMS one-time passcode, used once to verify a phone number at sign-up. | Mobile number | United States |
| Simple Analytics | Aggregate traffic statistics for the public marketing pages only. | No cookies, no personal data, no cross-site tracking | European Union |
| OpenAI | AI assistance, only for companies whose owner has switched it on — for example, reading a material request and suggesting the lines in it. It suggests; it decides nothing. | The text being read (such as a material request, exactly as it was typed, which may include anything the writer put in it) and the date it was written. Not used to train OpenAI's models; kept by OpenAI for up to 30 days for abuse monitoring. | United States |
Apart from those, we disclose personal information only:
- When you tell us to.
- When the law requires it — a court order, a subpoena, or a binding request from a public authority. Where we are permitted to tell you, we will.
- To establish or defend a legal claim, or to prevent harm.
- To a buyer, if the business is sold or merged. You would be told before your information became subject to a different policy.
7.Where it is kept
The application, its database and every uploaded file run on servers we control in the United States. Data is not distributed across a content network or replicated to other regions.
If you use the service from outside the United States, your information is transferred there. Where UK or EU data protection law applies to that transfer, we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum, as appropriate.
8.How long we keep it
- While your account is open — your data stays as long as you want it. We do not delete records on our own schedule.
- After you delete your organisation — nothing is destroyed immediately. The account is locked but fully recoverable for 30 days, during which you can restore it or download a complete export. After that a scheduled job permanently deletes it and everything it contained.
- Backups — encrypted database backups are kept for 14 days and then destroyed. A deleted record can persist in a backup until it ages out, which is why deletion is not instantaneous everywhere.
- Marketing enquiries — kept while we are in contact, then deleted.
- Billing records — kept as long as tax and accounting law requires, even after an account closes.
9.How it is protected
- Traffic is encrypted in transit with TLS. Certificates are renewed automatically.
- Passwords are stored as salted hashes and are never recoverable in readable form.
- Sign-in attempts are rate-limited by IP address, and changing your password signs out every other session — so a password change actually ends someone else's access.
- Every query touching customer data is scoped to a single organisation, which is the boundary that keeps one business's records from ever reaching another's.
- Permissions are per-member, so a crew member does not see the back office and cannot alter someone else's timesheet.
- Backups are taken nightly and test-restored weekly, because a backup nobody has restored is a file rather than a backup.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you, and any regulator we are required to notify, without undue delay.
10.Your rights
Depending on where you live, you may have some or all of the following rights.
- To know what personal information we hold about you and why.
- To get a copy of it. Account owners can download a complete export of their organisation at any time from the application, without asking us.
- To correct information that is wrong.
- To have it deleted, subject to records we must keep by law.
- To object to or restrict certain processing.
- Not to be discriminated against for exercising any of these rights. We will not degrade the service or change your price because you asked.
Write to privacy@easycontractor.app. We will verify who you are before acting — usually by replying to the address on the account — and respond within the period the applicable law allows, which is 30 days in most cases and 45 in California.
California residents may use an authorised agent. Because we do not sell or share personal information, there is no "Do Not Sell or Share My Personal Information" mechanism to operate; the statement in section 4 is our disclosure.
If you are in the UK or the EEA you may also complain to your data protection authority. We would rather you came to us first, but that right does not depend on it.
If your information reached us because a contracting business put it here, please read section 2.2 — your request goes to them, and we will help you find them.
11.Children
EasyContractor is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, write to privacy@easycontractor.app and we will delete it.
12.Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we handle personal information, we will tell account holders by email before it takes effect, rather than relying on you to notice a new date.
13.Contact
Privacy questions and rights requests: privacy@easycontractor.app
Everything else: support@easycontractor.app
Post: Easy Contractor, LLC, P.O. Box 481, Laceys Spring, AL 35754-0481