Privacy Policy

1. Overview

FindingList ("we", "us", "our") operates a directory website at findinglist.com (the "Service") that connects homeowners with local home improvement contractors. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use the Service.

2. Information we collect

2.1 Information you provide directly

We collect information you voluntarily provide when you:

• Submit a quote request: Your name, email address, phone number, project description, timeline, and budget range.
• List or claim a business: Business name, address, phone, email, website, logo, services, hours, license number, insurance info, year established, specialties, and social media links.
• Create an account: Your email address (used as login identifier) and name. If you sign in with Google or GitHub, we receive your verified email and profile name from the provider.
• Use the contact form: Your name, email, reason for contact, subject, and message.
• Make a payment: Billing details processed securely through PayPal. We do not store your credit card number — PayPal handles all payment processing.

2.2 Information we collect automatically

• Usage data: Pages visited, time spent, referring URLs, browser type, and IP address (used for analytics and abuse prevention).
• Cookies and local storage: Session tokens for authentication, preference cookies for UI state.
• Lead source data: When you submit a quote request, we record the page URL, page type (e.g. business detail, city page), and approximate geographic location derived from the page context. This helps us route leads to the right contractors.

2.3 Information from third parties

• Google reviews: We display Google reviews for listed businesses. These reviews are public and provided by Google's API.
• OAuth providers: When you sign in with Google or GitHub, we receive your verified email and basic profile info.
• Public records: Some business listings are pre-populated from publicly available sources (state contractor registries, business directories, business websites). If your business is listed and you'd like to update or remove it, please contact us or claim the listing to manage it directly.

3. How we use your information

We use the information we collect for the following purposes:

• To provide the Service: Process quote requests, route leads to contractors, display business listings, and enable account features.
• To communicate with you: Respond to your inquiries, send service notifications (e.g. lead alerts, payment receipts), and provide customer support.
• To process payments: Verify transactions, issue receipts, and handle refund requests.
• To improve the Service: Analyze usage patterns, identify bugs, and develop new features.
• To prevent fraud and abuse: Detect spam, fake reviews, fraudulent listings, and abusive behavior.
• To comply with legal obligations: Respond to lawful requests from public authorities, enforce our Terms of Service, and protect our rights.

4. How we share your information

4.1 With contractors (for lead routing)

When you submit a quote request, your contact details (name, email, phone) and project description are shared with up to three contractors who serve your area. This is the core function of our Service — without it, we cannot connect you with contractors.

Contractors who receive your lead have agreed to our Terms of Service and are prohibited from using your information for any purpose other than responding to your quote request. If a contractor misuses your information, please report it immediately.

4.2 With service providers

• Supabase: Database hosting (business listings, leads, accounts).
• Vercel: Web hosting and deployment.
• PayPal: Payment processing for lead credits and subscriptions.
• Brevo / Resend: Email delivery for OTP codes, lead notifications, and contact form submissions.
• Google: OAuth login provider and Google Reviews API.

These providers have access to your information only to perform services on our behalf and are obligated not to disclose or use it for other purposes.

4.3 Legal disclosures

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g. court orders, subpoenas). We may also disclose information to protect our rights, property, safety, or that of our users.

4.4 Business transfers

If FindingList is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Service of any change in ownership or control of your personal information.

5. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• Lead data: Retained indefinitely for analytics and dispute resolution. Lead contact information (name, email, phone) is removed only if the lead requests deletion via our contact form.
• Business listings: Retained as long as the business is listed. Suspended or rejected listings may be retained for up to 12 months for record-keeping before deletion.
• Payment records: Retained for 7 years as required by financial regulations.
• Contact form submissions: Delivered via email and not stored in our database beyond standard email retention.
• Account data: Retained until you request account deletion. Email us to delete your account and associated data.

6. Your rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information (subject to legal retention requirements).
• Restriction: Request that we limit the processing of your information.
• Portability: Receive your personal information in a structured, machine-readable format.
• Objection: Object to our processing of your personal information.
• Withdraw consent: Withdraw consent at any time where we rely on consent to process your information.

To exercise any of these rights, please contact us. We will respond to your request within 30 days.

7. Security

We take reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers.
• Encrypted storage for sensitive environment variables (API keys, database credentials).
• Authentication required for all account and contractor portal actions.
• Server-side verification for all lead routing and payment processing.
• Regular security reviews of our codebase and infrastructure.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

8. Cookies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier.

• Session cookies: Required for authentication (logging in, claiming businesses, processing payments).
• Preference cookies: Remember your UI preferences (e.g. search filters, mobile menu state).
• Analytics cookies: Help us understand how visitors use our Service so we can improve it.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of the Service (e.g. logging in, submitting quote requests).

9. Children's privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete such information.

10. International data transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States (where our primary infrastructure is hosted). We take steps to ensure your data is protected in accordance with this Privacy Policy regardless of where it is processed.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top. You are advised to review this Privacy Policy periodically for any changes.

12. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us or email us directly. We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy.