Privacy policy

2. Information we collect

2.1 Information you provide

We collect information when you voluntarily submit it through one of our forms:

• Corrections form. Name, email, message body, and the URL of the page you are correcting.
• Lead-request form (on directory and town pages). Name, email, phone (optional), project type, timeline (optional), message body, and the URL of the page you submitted from.
• Partner-inquiry form (/featured-partners). Business name, contact name, email, phone, categories and towns of interest, tier of interest, marketing-budget range, and any additional notes you provide.
• Quiz submissions. If you use our project-match quiz, we collect your category, town, project-scope selections, timeline, priority, name, and email. See Section 4 for how we use quiz data.
• Unsubscribe form.Email address, used solely to opt a contractor’s address out of proposal emails.

2.2 Information collected automatically

• Analytics. We use Google Analytics 4 (GA4) to measure aggregate traffic. GA4 collects approximate geolocation (country and region), device type, browser, referring source, page paths visited, and session timing. IP addresses are anonymized at collection by the provider.
• Click and event tracking.When you click a contractor’s phone number or website link on a directory card, we log the contractor slug, the event type, and the page URL to our internal Events database. We do not tie these events to your identity; they are used to measure which listings are useful.
• Server logs. Our hosting provider (Vercel) may retain standard request logs (IP, user agent, path, timestamp) for a short period for abuse detection and debugging.

2.3 Cookies and similar technologies

We use a minimal set of cookies:

• Strictly necessary. An admin-session cookie for the editorial admin routes, which most visitors never encounter.
• Analytics. GA4 sets cookies to measure unique sessions and returning visitors. You may opt out of GA4 by installing the Google Analytics Opt-out Browser Add-on or by using browser-level privacy controls.

We do not use third-party advertising cookies, retargeting pixels, or social-media trackers.

3. How we use your information

We use the information we collect to:

• Respond to your inquiries (corrections, lead requests, partner applications, quiz matches).
• Route lead-request and quiz submissions to the matched contractor or active Featured Partner for the relevant page, as described in Section 4.
• Measure aggregate site usage to improve editorial content, prioritize town and category coverage, and maintain data accuracy.
• Maintain an audit trail for corrections submissions (which helps us defend the accuracy of directory data).
• Detect and prevent spam, fraud, and abuse.
• Comply with legal obligations.

We do not use your contact information for unrelated marketing, newsletters, or product pitches. We will never add you to a mailing list without an explicit opt-in.

4. How we share information

4.1 With matched contractors

When you submit a lead-request or complete our project-match quiz, we share your submission with the contractor associated with the directory page you submitted from, or with the active Featured Partner for that page and category. The shared content includes the fields you provided and the source page URL; nothing more.

We do not share your submission with any other contractor or third-party network. We do not sell lead data.

4.2 With service providers

We use a small number of trusted service providers to operate the Site. These processors act on our instructions, are bound by written data-processing terms, and do not use your data for their own marketing:

• Vercel– hosting and request logging.
• Notion– storage of editorial records (contractors, Featured Partner status, leads, corrections, events, quiz submissions).
• Supabase– relational database for leads and directory data (where provisioned).
• Resend– transactional email delivery (corrections responses, lead notifications, proposal emails to contractors).
• Google Analytics 4– aggregate site measurement.
• Anthropic– quality scoring of quiz submissions using Anthropic’s Claude API. Submitted text is transmitted to Anthropic for scoring; per Anthropic’s terms for API usage, inputs are not used to train their models.

4.3 Legal requests

We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business transfers

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you on the Site before your information becomes subject to a different privacy policy.

5. Data retention

• Corrections submissions:retained indefinitely as part of our editorial audit trail. We may anonymize the submitter’s contact details upon written request.
• Lead submissions and quiz submissions: retained for up to 24 months for fraud detection and correction follow-up.
• Partner-inquiry submissions: retained for up to 36 months to manage the sales pipeline and renewals.
• Click/event tracking: retained for up to 24 months in aggregate form.
• GA4 analytics:retained per the provider’s default (currently 14 months).
• Server logs: typically retained by the hosting provider for 30 days.

6. Your rights

Regardless of where you reside, you may contact us at our corrections form to:

• Request a copy of personal data we hold about you.
• Request correction of inaccurate personal data (the same process applies to directory corrections).
• Request deletion of personal data, subject to legal and audit retention obligations.
• Opt out of any future marketing email (we do not currently send marketing email).

We verify deletion and access requests by confirming the requesting email address and matching it to a submission in our records. We respond within 30 days. We do not charge a fee for reasonable requests.

6.1 Massachusetts residents

Massachusetts law (M.G.L. c. 93H) provides rights related to data breach notification and security. We maintain reasonable administrative, technical, and physical safeguards consistent with that law and will notify affected residents of any security breach involving personal information as required.

6.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we have collected about you in the past 12 months, to request deletion of that information, to correct inaccurate information, and to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise these rights, contact our corrections form.

6.3 EU/UK residents

If you are in the EU or UK, our lawful bases for processing are (a) your consent for analytics cookies, (b) legitimate interests in providing and improving the Site and preventing abuse, and (c) contractual necessity for responding to form submissions you initiate. You have rights of access, rectification, erasure, restriction, portability, and objection. To exercise any of these, contact our corrections form. You may also lodge a complaint with your national supervisory authority.

7. Children’s privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact our corrections form and we will delete it promptly.

8. Security

We take reasonable measures to protect the information we collect, including encryption in transit (HTTPS on every page), encryption at rest with our service providers, admin-route session gating, and least-privilege access to editorial systems. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. If we become aware of a breach that materially affects your personal information, we will notify you in accordance with applicable law.

9. Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. Because there is no consensus on how websites should respond to DNT signals, we currently do not respond to them. You may limit analytics via browser privacy controls or the GA4 opt-out add-on (see Section 2.3).

10. International transfers

We operate from the United States. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S. (and, through our service providers, in other regions where they operate). By using the Site, you consent to this transfer.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective date” at the top reflects the current version. Material changes will be announced on this page. If a change substantively affects how we use information you have already provided, we will take reasonable steps to notify you.

12. Contact

Privacy questions and rights requests: our corrections form. General contact: our corrections form.