LEGAL

Privacy Policy

Last updated November 2, 2026

ContractorLicenseAlert (“we”, “us”) helps contractors keep track of licenses, permits, insurance and other dated documents, and reminds the right people before they expire. This policy explains, in plain English, what information we handle when you use our website and app, what we do with it, and the choices you have. If anything here is unclear, email support@contractorlicensealert.com.

What we collect

Your account. Your name, work email address and password (stored only as a secure hash, never in readable form). If you sign in with Google, we receive your name, email address and Google account ID — nothing else from your Google account. If you turn on two-step sign-in, we keep the encrypted secret for your authenticator app and hashed recovery codes.

Your workspace. Your business name, time zone and reminder settings, and everything you add: license and permit records (holder, number, issuing authority, dates, notes, custom fields), the people you add (name, email, phone, job title, location, notes) and who should be reminded about what.

Documents. Files you upload — photos and PDFs of licenses, certificates and the like — and the details read from them. If you send someone an upload link, we collect the document they send plus the name, email address and note they enter.

Support requests. The messages and screenshots you send us through Help & support.

Billing. Whether your workspace is on a trial or a paid plan, and the customer and subscription IDs our payment provider gives us. Card details are entered on the payment provider’s own page; they never reach our servers.

How the app is used. Inside the signed-in app we record which pages are opened, for how long, and which named buttons are pressed, together with your browser, operating system and device type. We do not record what you type or what is on the screen. We use this to see which parts of the product are used and where people get stuck.

Security information. The IP address and browser of each sign-in session, and of each change recorded in your workspace’s activity log; failed sign-in attempts, so that an account can be locked after repeated failures.

How you found us. On your first visit to our public website we keep, in a cookie, the site that linked to us, any campaign tags in the link, the first page you opened and your country (worked out from your connection, not your exact location). If you then create an account, that is saved with it.

Blog reading. When someone reads an article on our blog we count the visit, how they arrived, their country and roughly how long they read, against a random ID in a cookie. This is not linked to an account.

Email delivery. For the emails we send, our email provider tells us whether each one was delivered, opened, clicked, bounced or marked as spam, so that reminders that are not getting through can be spotted.

How we use it

To run the service: store your records, read the documents you upload, and send the reminders you set up.
To keep accounts secure: sign-in, two-step codes, locking out repeated failed attempts, and the activity log.
To answer support requests and tell you about your account, trial and billing.
To understand how the product is used and improve it.

We do not sell your information, share it for advertising, or use it to build advertising profiles. Our website and app carry no third-party advertising or analytics trackers.

Who helps us run the service

We use a small number of service providers, who handle information only to do their job for us:

Google Cloud Vision and Google Gemini read the documents you upload, to find dates, license numbers and other details. The file is sent to Google to be read and the result comes back to us.
Resend sends our emails: reminders, sign-in codes, invitations and account messages.
Our payment provider (Kelviq, or Stripe) takes payment, issues invoices and manages your subscription. It receives your workspace’s ID and the billing email address you use.
Cloud hosting, database and file-storage providers run our servers, hold the database and store uploaded files privately. Nightly backups of the database are kept with the same kind of provider.
Google Sign-In, if you choose “Continue with Google”, confirms who you are. We ask Google only for your name and email address.

We may also disclose information if the law requires it, to protect people from harm, or as part of a sale or merger of the business — in which case this policy would continue to apply to it.

Emails to people you add

The people you add to your workspace — team members, license holders, supervisors — may receive reminder emails from us, and the people you send an upload link to receive that request. Please only add people you have a business reason to contact. We do not send anyone marketing email.

Cookies

We use a few cookies of our own, and none from advertisers:

Signing in — keeps you signed in (for up to 30 days), and remembers a sign-in or sign-up that is halfway through (minutes, or until you close the browser).
Light or dark theme — remembers your choice for a year.
How you found us — described above; kept for 90 days.
Blog reading — a random ID, described above; kept for a year.

You can delete cookies in your browser at any time; you will then need to sign in again.

How long we keep it

Your workspace, records, people and documents: for as long as your account exists.
If a trial ends or you cancel, nothing is deleted automatically — the workspace pauses so you can come back or export your licenses. Ask us and we will delete it.
A document you delete is removed from storage at once.
Sign-in sessions: up to 30 days. Sign-in and reset codes: minutes to a few days, then they stop working.
App usage records and blog reading records: about 13 months (400 days).
Your workspace’s activity log: for as long as the workspace exists, so it stays a complete history.
Database backups: about 60 days, after which anything deleted is gone from backups too.

Your choices

You can see and correct your account and workspace details in the app at any time.
You can export your licenses and people from the app.
You can delete individual records, people and documents yourself.
To get a copy of your information, or to have your account or whole workspace deleted, email support@contractorlicensealert.com from the account’s address. We will confirm it is you and reply within 30 days.

Depending on the state you live in, you may have further rights over your personal information. Email us and we will help, whatever your state.

Security

Accounts are protected with hashed passwords, optional two-step sign-in and lockouts after repeated failures; every workspace’s data is kept separate; and files are stored privately and opened only through links that expire within minutes. Our Security page has the details. No system is perfectly secure, but if we ever learn of a breach affecting your information we will tell you.

Children

ContractorLicenseAlert is a tool for businesses and is not meant for children. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we change how we handle your information, we will update this page and the date at the top. If a change is significant we will also tell account owners by email before it takes effect.

Contact

Questions or requests about your information: support@contractorlicensealert.com. See also our Terms of Service.