Privacy & location notice

1. What we collect

When you sign in, Supabase authentication provides a verified user identifier, email, and an optional name. When you submit a booking, we store your name, phone, service address, ZIP, preferred date and time, service choices, notes, estimate, offer use, terms version, and request status. Professional applications include your business description, phone, service categories, boroughs, and review status.

Support requests store your signed-in identity, contact email, topic, message, the business’s reply, status, and timestamps. Replies appear in your account; booking and support notifications are not sent by this application; sign-in links are sent by the authentication service. We do not ask for your Social Security number, bank account number, payment-card number, or Google password. Please do not enter those details into a message or booking note.

2. Optional location

Location access starts only after you choose “Use my location” and grant your browser’s permission. Coordinates are used on your device to suggest an approximate nearby borough. They are not sent to our server or saved by this feature. The suggestion is not a precise geocode, boundary determination, or guarantee of coverage.

Enter the service ZIP code to confirm the intended area, or decline location permission and type a ZIP manually. Browser permission can be revoked in browser settings. Your submitted service address and ZIP are stored separately so the crew can review your booking.

3. Why and with whom

We use information to manage accounts, review bookings and professional applications, answer requests, prevent misuse, and keep service-request records. Approved professional profiles display only the business name, service description, categories, and boroughs, not the applicant’s private phone or email.

The current implementation makes booking details available to the customer and authorized business administrators. A professional receives the service information needed for an accepted job through the business’s operational process. Access should be limited to people who need it.

This version is prepared for external hosting such as Vercel and uses Supabase for authentication and PostgreSQL storage. When payments are enabled, Stripe receives the customer’s name, email, service address for tax calculation, booking reference, and transaction details. Stripe separately collects card data and professional identity, tax, and bank details through hosted pages. We store processor identifiers, amounts, status, refunds, commission acceptance, and management audit records; we do not store card or bank-account numbers. These providers also process information under their own terms and privacy policies. We may disclose information where legally required or needed to protect lawful rights.

4. Cookies, marketing, and sale of information

This site does not add advertising trackers or sell personal information. Authentication and hosting may use necessary cookies or equivalent session mechanisms. This application adds no advertising or behavioral analytics service; infrastructure providers may maintain operational and security logs. No marketing email or SMS subscription is created by submitting a booking. Future optional marketing requires separate choices and an unsubscribe process.

5. Security, retention, and requests

Accounts and record access are checked on the server; database queries use parameters. Access controls and encryption in transit reduce risk, but no service can guarantee absolute security. The New York SHIELD Act can require reasonable administrative, technical, and physical safeguards for covered private information. A website privacy statement alone does not satisfy those duties.

Proposed retention: retain service and support records for legal, tax, accounting, fraud prevention, and dispute needs; review inactive applications and support records periodically and delete or anonymize data no longer needed. Automated retention and self-service deletion are not yet implemented. A final schedule and responsible operator must be approved before launch.

Ask Mr. White by phone or through the contact form to access, correct, or request deletion of your information. We will verify identity and assess applicable rights and lawful retention requirements. Do not send identity documents until a secure verification method is arranged. This service is not directed to children under 18.