Privacy Policy

1. Information We Collect

From Contractors

• Account info: company name, owner or contact name, email, phone number, license number, team member emails, and for agencies, the subaccounts they manage.
• Preferences: service area (base ZIP code and radius, ZIP lists or states), project types, desired volume and daily caps.
• Availability and calendar: your weekly hours, sit-down length, buffer, minimum notice and time zone. If you connect Google Calendar or Outlook, we also store the email address of the connected account and the access credentials (OAuth tokens) the provider gives us, and we read the busy or free status of your calendar (see Section 7).
• Payment info: card or bank account details are collected and processed by our payment processor (Whop). We store only a tokenized identifier and the last 4 digits of the card or bank account, never full card or bank account numbers. We also keep a record of each charge.
• Agreement: your acceptance of our Terms of Service and payment authorization, with the IP address and timestamp of acceptance.
• Usage and communications: login records, dashboard activity, CRM integrations you connect, support-chat messages, and your replies to our emails.
• Business contact information for outreach: if we contact your business before you sign up, we use business contact details (name, company, work email or phone) from publicly available sources and business data providers.

From Homeowners

• Contact info: name, phone and email, entered on our estimate or inspection request forms or on a Facebook or Instagram lead form.
• Property and project info: the street address of the home (on our website forms), ZIP code and city, the project (for example roof replacement, roof inspection, kitchen or bath), scope, budget range, timeline, whether you own the home, property type, and anything you add in your own words.
• Meta lead forms: when you submit a lead form in a Facebook or Instagram ad, Meta sends us what you entered on the form (such as name, phone, email, ZIP and your answers), the consent you gave on the form, and the ad, campaign and form it came from. Meta's own privacy policy covers what Meta does with your information.
• Consent records: IP address, user agent, page URL, referrer, UTM parameters, ad click IDs (fbclid/gclid/msclkid), language, time zone, screen size, a device fingerprint and timestamps, captured as part of our TCPA consent certificate.
• Booking info: if you book a free estimate, the time you choose and the street address for the visit, plus any change or cancellation you make to it. The booking page asks for nothing else and does not need an account.
• Calls and texts: if we call or text you about your request, the calls may be made by an automated or AI voice assistant and may be recorded and transcribed, and we keep the texts you send us and any opt-out request.
• Verification results: only where a form asks for and you give your authorization, the results of an identity, address and soft credit check (see Section 6).

Automatically, From Your Browser or Device

Cookies, pixels and similar technologies collect your IP address, browser and device type, pages viewed, referring page, and ad click identifiers (see Section 9).

2. How We Use Information, and Our Legal Bases

We use personal information for the purposes below. For people in the EEA, UK or Switzerland, the legal basis for each use under the GDPR is shown in brackets.

• Route each homeowner request to one matched contractor, let the homeowner book a time, and deliver the request or lead to that contractor. [Performance of a contract or steps you ask us to take]
• Run contractor accounts, bill per booked visit or per lead, and provide support. [Performance of a contract]
• Call, text and email homeowners about their request, including automated calls and texts. [Consent, which you can withdraw at any time]
• Send operational messages to contractors (booking and lead alerts, billing, account updates). [Performance of a contract]
• Keep TCPA consent certificates and opt-out records. [Legal obligation and legitimate interests in showing consent]
• Verify a homeowner's identity, address and credit-based eligibility when the homeowner authorizes it. [Consent]
• Measure and improve our ads, including through the Meta Pixel, Meta's Conversions API and the Whop pixel. [Legitimate interests, or consent where the law requires it]
• Contact businesses about our service. [Legitimate interests]
• Keep the service secure, prevent fraud and spam, and improve matching and quality. [Legitimate interests]
• Comply with tax, accounting and other legal obligations, and respond to lawful requests. [Legal obligation]

Matching a request to a contractor is automated (by ZIP code, project type and the contractor's availability). It decides which contractor gets the request; it does not produce decisions with legal or similarly significant effects on you.

3. How We Share Information

• With the one matched contractor, at the homeowner's direction: a homeowner's contact info, project details, any chosen appointment time and visit address, and any verification results are shared only with the one contractor whose service area covers the homeowner's ZIP code and who is assigned that request. We never send a request to a list of contractors. Contractors pay us for the requests and bookings we send them.
• With service providers who process information for us under contract: payment processing (Whop), email delivery (Resend), calls and texts (Twilio, Retell AI, and GoHighLevel where a contractor uses it), cold-email delivery to businesses, AI services that help us sort email replies, CRM sync (as configured by the contractor), the calendar provider a contractor connects (Google or Microsoft), internal notifications (Slack), analytics, and hosting and databases (Vercel, Supabase).
• With advertising partners: Meta (Facebook and Instagram) and Whop receive data from their pixels on our marketing and request pages, and we send Meta conversion events (such as a completed request or a booking) with hashed email and phone, ZIP, state, IP address, user agent and click IDs, so we can measure our ads and reach similar people. See Section 5.
• When legally required or to protect rights and safety: to comply with subpoenas, court orders or legal process, and to enforce our terms.
• In a business transfer: if we are involved in a merger, acquisition or sale of assets, information may transfer to the new owner under this policy.

4. Sale of Personal Information

We send a homeowner's request to one contractor only because the homeowner asked us to connect them with a local contractor, and the consent on our forms says so. Under the CCPA, a disclosure the consumer directs is not a “sale.” We do not sell homeowner or contractor information to data brokers or to anyone else, and we do not send a request to more than one contractor.

5. “Sharing” for Advertising, and How to Opt Out (Do Not Sell or Share)

Using the Meta Pixel, Meta's Conversions API and the Whop pixel for ads counts as “sharing” personal information for cross-context behavioral advertising under California law, and may be treated as a “sale” or “targeted advertising” under other state laws. You can opt out at any time:

• Global Privacy Control (GPC): if your browser sends the GPC signal, we treat it as a request to opt out of sale and sharing for that browser. We don't load the Meta or Whop pixels, and we don't send a request you make from that browser to Meta's Conversions API.
• Email: write to operations@cliniclydistribution.com with the subject “Do Not Sell or Share” and the email and phone number you used. We will stop sending your information to advertising partners.
• Cookies: you can also block or delete cookies in your browser, and adjust your ad preferences in your Meta account.

To stop calls, texts or emails (a separate choice), reply STOP to any text or use the opt-out page.

6. Identity, Address and Credit Verification (FCRA)

Some homeowner request forms include a step that verifies your identity and address and runs a soft credit inquiry, so the contractor knows whether financing may be an option. Where a form includes it:

• Only with your written authorization. The form shows a separate authorization checkbox that explains the check, and we run it only if you check that box and submit the form.
• Soft inquiry. The check is done through a third-party verification provider, which uses a consumer reporting agency (such as Equifax). It is a soft inquiry and does not affect your credit score.
• Results, not your credit report. We receive verification results (whether your identity and address were confirmed, and a summary of credit-based eligibility). We do not receive or share your full credit report.
• Shared with one contractor, for your request only. The results go only to the one contractor matched to your request, for the transaction you started (your estimate and any financing options). They are not used for employment, insurance or any other purpose, and are not sold or shared for advertising.

Your rights under the FCRA. You can ask us for the name, address and phone number of the consumer reporting agency that supplied information about you. You have the right to get a free copy of your file from that agency and to dispute any information you believe is inaccurate or incomplete directly with it. If a contractor or lender takes an adverse action (such as denying financing) based in whole or in part on information in a consumer report, it must give you an adverse action notice where the FCRA requires one. For a summary of your rights, see consumerfinance.gov/learnmore. To the extent this information is covered by the FCRA, it is governed by the FCRA rather than the CCPA.

7. Calendar Data

Connecting a calendar is optional and is done by the contractor through Google or Microsoft's own sign-in screen. When a contractor connects one:

• We read only whether each time on the calendar is busy or free (the start and end times of events). We do not read event titles, descriptions or attendees.
• We create an event for each sit-down we book, containing the homeowner's name, phone, email, the project and the visit address, and we update or delete that event if the sit-down is moved or canceled. We do not change any other event.
• The OAuth tokens the provider gives us are stored encrypted, and are used only for the two things above.
• A contractor can disconnect the calendar at any time in Settings, or revoke our access from their Google or Microsoft account. We then stop reading it and delete the stored tokens. Events already created stay on the calendar.
• Homeowners are never shown what is on a contractor's calendar, only the open times.

8. Calls, Texts and TCPA Consent

We and the matched contractor call, text or email a homeowner only with the homeowner's consent, given on the request form. Calls and texts may use automated technology or an artificial or prerecorded voice, including an AI voice assistant, and calls may be recorded and transcribed. Consent is not a condition of buying anything. Message frequency varies, and message and data rates may apply.

Every homeowner request we route carries a consent certificate documenting the homeowner's agreement to be contacted. The receiving contractor can view it at a unique URL, and it serves as a record of consent under the Telephone Consumer Protection Act.

Opting out. Reply STOP to any text, or use the opt-out page to stop calls, texts, emails, or all of them. We honor a request right away. Contractors who receive a homeowner request must honor it too, consistent with the TCPA and applicable state laws. We keep records of each consent and each opt-out for five years.

9. Cookies, Pixels and Similar Technologies

• Essential cookies keep you signed in and keep the service secure.
• Analytics help us understand how the service is used.
• Advertising pixels: the Meta Pixel runs on our marketing, sign-up and request pages and on the contractor onboarding page, and the Whop pixel runs on our marketing, sign-up and request pages. Neither runs inside the contractor dashboard. They set cookies such as Meta's _fbp and _fbc and tell those partners which pages you visited and whether you completed a request, so we can measure and improve our ads.

You can block or delete cookies in your browser settings, though some features may stop working. Turning on Global Privacy Control stops the advertising pixels for that browser (see Section 5).

10. Data Retention

We keep personal information only as long as we need it for the purposes in this policy:

• Consent certificates and opt-out records: five years, to show compliance with the TCPA.
• Homeowner requests, bookings, leads, call recordings and transcripts, and verification results: for as long as needed to deliver the request, handle billing and disputes, and comply with the law, generally up to five years after the request.
• Contractor account data: while the account is open. After cancellation we keep it for 30 days so you can export it, after which it may be deleted or anonymized, except billing and tax records we must keep longer (generally up to seven years).
• Cookies: for the period the cookie is set for (Meta's _fbp cookie lasts up to 90 days unless you clear it).

11. Data Security

We use encryption in transit (TLS), encryption at rest for sensitive fields such as calendar tokens, hashed passwords and tokens, and role-based access controls. Full card and bank account numbers are held by our payment processor, not by us. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where the law requires.

12. Your Privacy Rights

Depending on where you live, you may have the right to know what personal information we hold about you, get a copy of it, correct it, delete it, and opt out of its sale, sharing or use for targeted advertising. These rights come from laws such as the CCPA, the GDPR, other U.S. state privacy laws (including those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon), and Canada's PIPEDA. Email operations@cliniclydistribution.com to make a request. We will not discriminate against you for exercising any of these rights.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing us with the subject “Privacy appeal.” We will respond within the time your state law allows, and if you disagree with the result you may contact your state attorney general.

13. California Privacy Rights (CCPA/CPRA)

This section applies to California residents, including homeowners and contractor contacts. In the last 12 months we collected the categories of personal information below, for the purposes in Section 2.

Sale and sharing. In the last 12 months we have not sold personal information, as explained in Section 4. We have “shared” identifiers, internet activity, approximate geolocation and inferences with advertising partners (Meta and Whop) for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.

Sensitive personal information. We use it only to provide the service you asked for (signing in, and verification you authorize), to keep the service secure, and as the law otherwise permits. We do not use it to infer characteristics about you, so there is no need to ask us to limit it.

Your rights

• Know and access: the categories and specific pieces of personal information we collected about you, the sources, the purposes, and the categories of third parties we disclosed it to.
• Delete: personal information we collected from you, subject to legal exceptions (for example, records we must keep to show TCPA consent or for tax).
• Correct: inaccurate personal information.
• Opt out of sale and sharing: see Section 5. We honor Global Privacy Control.
• Limit use of sensitive personal information: see above.
• Non-discrimination: we won't deny you service, charge you a different price or give you a different level of service because you used these rights.

How to make a request

Email operations@cliniclydistribution.com and tell us which right you are using. We operate online only, so email is our designated method. To protect you, we verify a request by matching the email address or phone number you give us with what we have on file, and we may send a one-time code to that email or phone. We will confirm receipt within 10 business days and respond within 45 days (we may extend this by another 45 days and will tell you if we do).

Authorized agents. You may use an authorized agent. We will ask for written permission signed by you, and we may still ask you to verify your identity with us directly, unless the agent has a power of attorney.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

14. EEA, UK and Swiss Residents (GDPR)

Our service is offered in the United States, but if the GDPR or UK GDPR applies to you:

• Controller: Clinicly Inc., operating STALLION, Mississauga, Ontario, Canada. Contact us at operations@cliniclydistribution.com.
• Legal bases: listed for each purpose in Section 2.
• International transfers: we are based in Canada, and our service providers process data mainly in the United States. Where the law requires, we rely on the European Commission's adequacy decision for Canada, the Standard Contractual Clauses (with the UK Addendum), or another lawful transfer mechanism.
• Your rights: access, correction, deletion, restriction, data portability, and objection to processing based on legitimate interests (including direct marketing, which you can always refuse). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
• Complaints: you can lodge a complaint with the data protection supervisory authority where you live or work, or where an alleged breach happened. We would appreciate the chance to resolve it with you first.
• Retention: see Section 10.

15. Children

Our services are not directed to individuals under 18, and we do not knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If we learn that a minor's information has been submitted, we will delete it and will not deliver it to a contractor.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The “Last updated” date at the top shows the latest revision. If we make a material change to how we use personal information we already have, we will tell you before it takes effect and, where the law requires, ask for your consent.

17. Contact

Questions about this Privacy Policy, or a privacy request? Email us at operations@cliniclydistribution.com.