Privacy Policy

Stillpoint Builders LLC ("Stillpoint Builders", "we", "us", or "our") is a construction company organised under the laws of the State of North Carolina, United States, operating as NC General Contractor License #109043. For the purposes of the EU and UK General Data Protection Regulation, Stillpoint Builders LLC is the data controller for the personal information described in this policy.

This policy explains what personal information we collect, why we collect it, who we disclose it to, how long we keep it, how we secure it, and the rights you have over it. It applies to:

• our public website and any subdomain we operate;
• the client portal, where homeowners view their estimate, project status, documents, and photographs;
• the trade and vendor portal, where subcontractors, suppliers, and design partners receive assignments, submit documentation, and are paid;
• our internal operations portal, used only by authorised Stillpoint Builders personnel; and
• the connected business systems described in sections 7 through 9, including QuickBooks Online, JobTread, and Google Workspace.

The table below itemises every category of personal information we collect, in the terms used by the California Consumer Privacy Act and by Apple's App Store privacy disclosure. Where a category does not apply to you, we do not collect it — a homeowner requesting an estimate, for example, generates no payroll or insurance records.

Sensitive personal information. We do not intentionally collect sensitive personal information as the CCPA defines it, and we do not collect special-category data under Article 9 of the GDPR. We do not collect racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data, health data, or data about sex life or sexual orientation. Government identification numbers appear only where a vendor supplies a taxpayer identification number on a W-9 for tax-reporting purposes, and that record is stored encrypted and restricted to the finance role.

We do not knowingly collect information from children. See section 18.

• Directly from you — when you request an estimate, book a consultation, create a portal account, apply for a job, upload a document or photograph, or write to us.
• Automatically from your device — sign-in, security, and diagnostic events described in section 11.
• From your authentication provider — if you sign in with Google or Apple, we receive your name, email address, and a provider subject identifier. We receive no password.
• From our construction-management platform, JobTread — the customer, vendor, job, document, and scheduling records our team maintains there (section 8).
• From our accounting system, QuickBooks Online — invoices, bills, payments, and the chart of accounts needed to reconcile a job (section 7).
• From our own Google Workspace mailbox — project correspondence sent to or from our authorised business address (section 9).
• From your employer or trade company — when a trade partner admin invites a foreman or crew member to a project.
• From public and licensing records — contractor licence and insurance verification for trade partners.

We use personal information only for the business purposes listed here. We do not use it for any purpose materially different from, or incompatible with, the purpose it was collected for without telling you first.

• Preparing and delivering estimates, proposals, and change orders.
• Performing the construction contract: scheduling, ordering, site coordination, inspection, and close-out.
• Operating the client and trade portals, including authentication, session security, and permission enforcement.
• Invoicing, collecting payment, paying subcontractors and suppliers, and reconciling our books.
• Documenting the work with photographs, daily logs, and inspection records.
• Honouring the workmanship warranty and responding to warranty claims.
• Responding to your questions and keeping an accurate record of what was agreed.
• Meeting legal obligations: tax reporting, lien and contract law, licensing, insurance, and health-and-safety requirements.
• Securing our systems — detecting and investigating unauthorised access, fraud, and abuse.
• Evaluating job applications.
• With your separate, revocable written consent, and never otherwise: showing photographs of completed work in our gallery or marketing.

We never use your personal information to build advertising profiles of our own, to train machine-learning models offered to third parties, or for any purpose unrelated to building and servicing your project. If you allow ad measurement on our website (section 11), Meta may use what its tools receive to measure and deliver our Facebook and Instagram ads, under Meta's own terms.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following lawful bases under Article 6 of the GDPR.

We disclose personal information only to the recipients below, only for the purpose stated, and only under a written contract that requires them to protect it to at least the standard set out in this policy and forbids them from using it for their own purposes. We do not authorise any of them to sell it.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Your mobile number and text-message opt-in data are shared only with the message-delivery providers that send our texts on our behalf (HighLevel/LeadConnector and the mobile carriers), solely to deliver those texts.

Meta is the one exception to the contract terms above: it receives information under Meta's Business Tools Terms rather than a contract we write, and may use it to measure and deliver ads and to improve its products, as its own terms and privacy policy describe. That is why nothing is sent to Meta unless you allow it (section 11).

We may also disclose personal information where we are legally compelled to do so by valid legal process, where disclosure is necessary to establish or defend a legal claim, or where it is necessary to protect the safety of any person. If our business is transferred, personal information may transfer with it; we will tell you before your information becomes subject to a different privacy policy.

When an authorised Stillpoint Builders administrator connects our QuickBooks Online company through Intuit's OAuth 2.0 flow, our application reads and writes accounting records so that jobs, invoices, bills, and payments reconcile against a single set of books.

What we access. Only the following, and only for the connected company:

• customers, vendors, and their contact details;
• invoices, estimates, bills, credit memos, and payments;
• the chart of accounts, items, classes, and tax codes; and
• company and preference metadata needed to map our jobs to your accounts.

• Why. Solely to reconcile construction jobs to accounting records, to avoid duplicate data entry, and to produce accurate financial reporting for our own business.
• Where it is stored. In our Supabase database, hosted in the United States, encrypted in transit with TLS 1.2 or higher and encrypted at rest.
• How credentials are held. Intuit access and refresh tokens are stored encrypted, are never written to logs, are never exposed to a browser, and are usable only by server-side code.
• How long. QuickBooks-derived records are retained for the period in section 12 and are deleted within 30 days of disconnection, except where tax or accounting law requires us to keep a copy.

We do not sell, rent, license, or trade QuickBooks data, and we do not use it for advertising, profiling, or any purpose other than the accounting purpose above. We do not share it with any party other than the service providers listed in section 6.

Disconnecting. An administrator may disconnect QuickBooks at any time from Settings → Integrations, or from within QuickBooks Online under Apps → Manage. Disconnection immediately revokes our tokens and stops all further access. To have the previously synchronised data deleted, write to david@stillpointbuilders.com and we will complete deletion within 30 days.

JobTread is the construction-management platform our team uses to run projects. Our portal maintains a read-oriented mirror of the JobTread records that belong to our own organisation so that customers and trade partners can see their project without us granting them access to our internal system.

• What we mirror. Customer and vendor accounts and contacts, jobs and their schedules, documents, daily logs, photographs, cost records, and the memberships and roles that determine who may see what.
• Why. To render your project in the portal accurately, to enforce access control, and to keep one authoritative record of the work.
• Authorisation. The connection is authorised by a Stillpoint Builders administrator using a scoped grant. Portal users never receive JobTread credentials.
• Access control. A person can only ever see the JobTread records linked to their own verified identity. A homeowner sees their own project; a trade partner sees only the scopes assigned to them; neither sees our cost or margin data.

We do not sell JobTread data and we do not disclose it outside the recipients in section 6.

Google sign-in. If you choose to continue with Google, Google asserts your identity to us and we receive your name, email address, profile picture where you have one, and a stable subject identifier. We never receive your Google password. You can sign in with an email address and password instead; Google sign-in is always optional.

Google Workspace. Our own authorised business mailbox and file storage are synchronised into our operations portal so that project correspondence and documents are attached to the right job. This concerns Stillpoint Builders' own Google account, authorised by an administrator — it never reaches into a customer's or a trade partner's Google account, and connecting Google for sign-in grants us no access to your mail or files.

You may revoke our access to your Google account at any time at myaccount.google.com/permissions. Revoking Google access does not delete your portal account; to ask us to delete that, see section 14.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the twelve months preceding the effective date of this policy. We do not sell personal information, and we never sell or share the personal information of consumers under 16 years of age, because we do not knowingly collect it at all.

Sharing only with your permission. If you allow ad measurement on our website, what Meta receives (section 6) may count as "sharing" for cross-context behavioural advertising under some state privacy laws. We do it only after you choose "Allow", never when your browser sends a Global Privacy Control signal (which we treat as a request to opt out), and you can withdraw at any time from "Ad preferences" at the bottom of every page. Withdrawing stops any further sharing from that browser. When your browser sends a Global Privacy Control signal, we also do not set the advertising-attribution cookie described in section 11.

We do not offer financial incentives in exchange for personal information, and we will not discriminate against you for exercising any privacy right.

Without your permission, we do not track you across other companies' apps or websites. We use no data brokers, and no advertising tools other than Google Ads measurement (below) and Meta's ad-measurement tools, which run only if you allow them. If we distribute a mobile application, it does not request permission under Apple's App Tracking Transparency framework, because it does not track.

Advertising measurement. If you reach our site by clicking one of our Google ads, the link carries a click identifier. We keep it in a first-party cookie on your device and, if you then send us an enquiry, store it with that enquiry. Our CRM later tells Google Ads whether the enquiry became a project, so we can see which ads work. Google receives only that identifier, the outcome and, where Google's enhanced conversions apply, a one-way hashed copy of the email address you gave us. We never send Google Ads, or any other advertising platform, your phone number in any form or any text-message opt-in data or consent. We do not use this information to build a profile of you or to show you ads on other sites.

Meta ad measurement (only if you allow it). On your first visit we ask whether we may use Meta's tools to see whether our Facebook and Instagram ads lead to enquiries, and nothing from Meta loads until you choose "Allow". If you do, the Meta Pixel records the pages you view on our marketing site and sets Meta's own cookies; if you then send us an enquiry, our server also tells Meta about it through the Conversions API, with your name and email address as one-way hashes and never your phone number. Meta receives nothing from our client portal, trade portal, sign-in or careers pages. If your browser sends a Global Privacy Control signal we treat it as a "no" and do not ask. You can change your choice at any time from "Ad preferences" at the bottom of every page.

We use the following cookies and similar technologies:

Strictly necessary cookies do not require consent, and disabling them will prevent you from signing in. Meta's ad-measurement tools are the only technology we use that is not strictly necessary; they run only with your consent, and you may withdraw it at any time. We will ask the same way before introducing anything else that is not strictly necessary.

We keep personal information only as long as we need it for the purpose it was collected for, plus the period any law requires. Construction records are kept longer than most, because a workmanship warranty and North Carolina's statutes of limitation and repose can be invoked years after completion.

When a retention period ends, we delete the record or irreversibly de-identify it. Backups are cycled out on a rolling basis and any residual copy is deleted within 90 days of the primary deletion.

• Encryption in transit. All traffic is served over TLS 1.2 or higher with HTTP Strict Transport Security.
• Encryption at rest. Databases, file storage, and backups are encrypted at rest.
• Least privilege. Access is governed by role- and project-scoped permissions enforced in the database itself with row-level security, so a person cannot read a project they are not a member of even if the application were at fault.
• Multi-factor authentication. Required for every Stillpoint Builders internal account with access to customer data.
• Credential isolation. Third-party tokens are stored encrypted, never exposed to a browser, and never written to logs.
• Audit logging. Privileged actions are recorded to an append-only audit trail.
• Separation of environments. Production data is never copied into development or test environments.
• Vendor diligence. Every service provider in section 6 is contractually bound to confidentiality and security obligations.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information we will notify you and the relevant regulators without undue delay, and within 72 hours of becoming aware where the GDPR requires it.

To report a vulnerability, write to david@stillpointbuilders.com. We will acknowledge your report and we will not pursue legal action against good-faith security research.

How to ask us to delete your account. Write to david@stillpointbuilders.com with the subject line "Delete my account", or submit the contact form at /contact. You do not need to explain why.

Deletion is carried out by a person, not by a self-service button. We acknowledge your request within 10 business days, tell you what will be removed and what we are required to keep, and complete the deletion within 30 days of your request. We will write to you to confirm when it is done.

When we complete the deletion, it:

• removes your sign-in identity, profile, portal preferences, and portal access;
• unlinks any Google or Apple identity from us;
• deletes the content you uploaded, unless it is part of the executed contract record; and
• revokes every project membership you held.

What we must keep. We are required to retain the executed contract, change orders, invoices, payment records, permit filings, and the photographic record of the work for the periods in section 12. Those records are retained under a legal obligation, are removed from active portal use, and are restricted to the finance and legal roles. We will tell you exactly what was retained and why when we confirm your deletion.

If you are a resident of California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, or Virginia, you have the rights below. We extend them to every user regardless of where you live.

• Right to know what personal information we have collected, the categories of sources, the business purpose, and the categories of third parties it was disclosed to.
• Right to access a copy of the specific pieces of personal information we hold about you.
• Right to delete the personal information we hold about you, subject to the legal exceptions in section 14.
• Right to correct inaccurate personal information.
• Right to data portability — to receive your information in a portable, machine-readable format.
• Right to opt out of sale, sharing, or targeted advertising. We do not sell, and we share for ad measurement only with your consent, which you can withdraw from "Ad preferences" or by sending a Global Privacy Control signal (section 10).
• Right to limit the use of sensitive personal information. We do not collect it for any secondary purpose.
• Right against discrimination for exercising any of these rights.
• Right to appeal a decision we make on your request.

How to exercise them. Email david@stillpointbuilders.com with the subject line "Privacy Request", or submit the contact form at /contact. We will acknowledge your request within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where we tell you why. We will verify your identity against the account you are asking about before we act. An authorised agent may act for you with written permission that we can verify.

If we deny your request, you may appeal by replying to our decision with the word "Appeal". We will respond to the appeal within 45 days. If we deny the appeal, you may complain to your state Attorney General.

Under the GDPR and the UK GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• rectify inaccurate or incomplete personal data;
• erase your personal data ("right to be forgotten"), subject to the legal-obligation exceptions in section 14;
• restrict processing while a dispute about accuracy or legitimate interest is resolved;
• object to processing based on legitimate interests, including at any time and for any reason where the processing is for direct marketing;
• data portability — to receive the data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
• lodge a complaint with your supervisory authority.

Write to david@stillpointbuilders.com to exercise any of these. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are in the EEA you may complain to the supervisory authority in your country of residence, work, or the place of the alleged infringement. In the United Kingdom you may complain to the Information Commissioner's Office at ico.org.uk. Complaining to us first is welcome but never required.

We are a United States company and our service providers process personal information in the United States. If you are in the EEA, the United Kingdom, or Switzerland, your personal information will be transferred to the United States.

For those transfers we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the transfer originates in the United Kingdom, incorporated into our contracts with each provider. We carry out a transfer risk assessment and apply supplementary technical measures — encryption in transit and at rest, and access controls that keep data readable only to authorised staff.

You may request a copy of the safeguards we rely on by writing to david@stillpointbuilders.com.

Our services are for adults entering into construction contracts. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, write to us and we will delete it promptly. We do not sell or share the personal information of anyone under 16 under any circumstances.

We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not profile you for that purpose. Our software may sort a work queue or flag a record for review, but a person decides every estimate, engagement, and payment.

If you give us your mobile number and tick the optional text-message box on our contact form, estimate form, or booking calendar, or text our business line first, we text you about your enquiry, appointment scheduling and reminders, and updates on your project. We do not send marketing promotions. Message frequency varies. Message and data rates may apply.

• Opt out at any time by replying STOP. You will receive one confirmation and no further messages. Reply START to resubscribe, or HELP for help. Carriers are not liable for delayed or undelivered messages.
• Consent is not a condition of purchase. Every service we offer is available without agreeing to texts.
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. (The categories are the recipients listed in section 6.) Your mobile number and text-message opt-in data are shared only with the message-delivery providers that send our texts on our behalf, HighLevel (LeadConnector) and the mobile carriers, and only to deliver those texts. We never send your phone number to Google Ads or any other advertising platform.
• We keep a record of when and how you consented, and of any opt-out, for the period in section 12.

The full programme terms are in our SMS Terms.

This policy is versioned. The current version is 2026.10.21, effective October 21, 2026. When we change it we update the version and the effective date at the top of this page.

If a change materially affects how we use information we already hold about you, we will notify you by email and, where the change requires it, ask for your consent before it applies to you. We will never apply a materially different use to information already collected without telling you first.

Stillpoint Builders LLC, Durham, North Carolina, United States, is the data controller for the information in this policy. Email david@stillpointbuilders.com for any privacy question, request, or complaint, or call or text us at (984) 254-2131. For anything about text messages, reply HELP to any message from us. If you would rather write to us by post, ask and we will give you our mailing address.

We have not appointed a Data Protection Officer because we are not required to; privacy requests are handled by the company's owner, who is reachable at the contacts above.

See also our License Agreement, which governs your use of our portals and software.