Privacy & Data Protection Commitment

Privacy Policy

Last Updated & Effective Date: September 24, 2026

1. Introduction & Scope

This Privacy Policy describes how BullParkIt Software Inc.(“BullParkIt”, “we”, “us”, or “our”) collects, processes, stores, protects, and discloses personal information when you access our contractor administrative dashboard, utilize our embeddable estimation calculators on contractor websites, interact with our APIs, or visit bullparkit.com (collectively, the “Service”).

This policy applies to both:

Contractors / Subscribers: Trade professionals and businesses who open accounts and configure pricing rates.
Homeowners / End-Users: Property owners and consumers who interact with an embedded BullParkIt calculator on a contractor’s website to request a project estimate.

2. Data Processing Roles (GDPR, PIPEDA, CCPA/CPRA)

Under international, Canadian, and United States privacy jurisprudence:

Contractor as “Data Controller” (or “Business”): The contractor determines what information to capture from prospective clients, controls the customer relationship, sets pricing parameters, and directs how leads are contacted.
BullParkIt as “Data Processor” (or “Service Provider”):BullParkIt acts strictly on behalf of and pursuant to the documented instructions of the contractor. We compute mathematical ballpark estimates and securely route the homeowner’s project details directly to the contractor’s dashboard or webhook endpoint.

3. Granular Categories of Information We Collect

We collect only the minimum data necessary to calculate project estimates and route leads efficiently:

A. Contractor Account & Configuration Data:

When a contractor creates an account, we collect business email address, company name, contact phone number, billing address, company branding assets (logos, primary brand color, tagline), custom square-foot pricing formulas, minimum job trip fees, substrate repair markups, and preferred CRM webhook endpoints.

B. Homeowner & Estimate Inquiry Data:

When a homeowner requests an estimate via an embedded calculator, we collect:

Contact Identifiers: First name, last name, phone number, and email address;
Project Location: Street address, city, state/province, and postal/ZIP code;
Project Specifications: Room or area type (e.g. 2-car garage, basement, patio, commercial warehouse), square footage, selected coating system (flake, metallic, solid color, quartz), and topcoat preferences;
Substrate Condition: Current floor state (smooth new concrete, minor cracks, heavy spalling, moisture damage, existing peeling paint/epoxy).

C. Project Photos & Media Uploads:

Homeowners may voluntarily upload floor condition photos to assist the contractor in evaluating concrete prep requirements. These photos are encrypted and governed by our strict automated purging schedule (see Section 8).

D. Payment & Billing Data:

Subscription billing is processed directly by Stripe, Inc. BullParkIt servers never touch, handle, or store raw credit card numbers, expiration dates, or CVVs. Stripe maintains all billing data in compliance with PCI-DSS Level 1 standards.

E. Technical Telemetry & Security Logs:

For security, rate limiting, and fraud prevention, we automatically log IP addresses, browser user-agent strings, device screen dimensions, and interaction timestamps. This data is used solely to maintain platform integrity and prevent denial-of-service or bot submissions.

4. How We Use Information & Legal Bases for Processing

We process information solely for the following lawful business purposes:

Contractual Performance: To calculate ballpark pricing in real-time based on the contractor’s configured rules and transmit the project estimate summary to the homeowner and contractor;
Lead Dispatch: To transmit inquiries directly to the contractor’s administrative dashboard, email inbox, or connected CRM platform (Jobber, Workiz, Housecall Pro, Zapier, etc.);
Account Administration: To authenticate contractors via passwordless cryptographic magic links, manage subscription lifecycles, and deliver service updates;
Legitimate Interests: To detect, investigate, and prevent fraudulent inquiries, web scraper attacks, spam submissions, and infrastructure security breaches;
Legal Compliance: To comply with applicable tax, financial, and regulatory reporting obligations.

5. Technical Multi-Tenant Isolation & Row-Level Security

BullParkIt enforces database-level multi-tenancy using PostgreSQL Row Level Security (RLS) policies. Every database query executed by our application strictly requires tenant-specific cryptographic session claims. It is mathematically and architecturally impossible for one contractor to query, access, or view lead inquiries, pricing schedules, or customer records belonging to another contractor.

6. Aggregated Regional Benchmarks, Price Spreads & Anonymized Industry Statistics

To educate homeowners on realistic market pricing expectations, deter unrealistic price shopping, promote trade transparency, and highlight platform availability, BullParkIt compiles and displays aggregated, de-identified regional industry statistics. This includes broad regional pricing spectrums (such as regional low, high, and average square-foot rates) and general platform metrics (such as the number of active contractor accounts operating within specific geographic territories, states, provinces, or metropolitan areas).

Strict Non-Attribution & Confidentiality Guarantees:

Zero Individual Identification for Pricing: Public market benchmarks and regional price spreads displayed on BullParkIt web properties shall never identify any specific contractor by company name, branding, contact details, or individual price card;
Non-Attributable High/Low Spreads: BullParkIt will only display generalized regional low-to-high pricing spreads and statistical medians. Individual proprietary formulas or contractor-specific line items remain strictly confidential and will never be published or attributed;
Public Business Identifiers & Directory Listings: Publicly available business information (such as Contractor’s company name, public website link, and verified service regions) may be referenced in platform directories or coverage maps to verify active service presence, while private lead records and proprietary backend pricing formulas remain strictly confidential;
Exclusion from Data Brokerage: BullParkIt does not sell, rent, license, or broker contractor pricing datasets or homeowner lead records to third-party data aggregators, lead brokers, or marketing networks;
Non-Personal Information Classification: Under PIPEDA, CCPA/CPRA, and GDPR, aggregated and mathematically de-identified statistical datasets do not constitute personal data or personally identifiable information (PII), as they cannot be linked, directly or indirectly, to any identifiable individual or business.

7. Third-Party Sub-Processors & Infrastructure

We do not sell personal data to advertisers or data brokers. To deliver an enterprise-grade cloud service, we transmit data to audited, world-class infrastructure sub-processors under strict Data Protection Agreements:

Supabase Inc.

Managed PostgreSQL database, RLS security policies, authentication, and encrypted AWS storage (us-east-1).

Stripe, Inc.

PCI-DSS Level 1 compliant subscription processing, customer portal, and financial transaction management.

Vercel Inc.

Serverless edge cloud execution, global CDN routing, and TLS 1.3 encryption certificate delivery.

Resend, Inc.

Transactional email delivery for instant contractor lead alerts and magic link login tokens.

Contractor-Configured Destinations: If a contractor configures a custom webhook (such as Zapier, Make, Jobber, Housecall Pro, or Workiz), BullParkIt dispatches lead data directly to that contractor-selected destination upon instruction. Contractor is solely responsible for ensuring the privacy compliance of their destination endpoint.

8. Automated Photo Purge & Data Retention Schedule

To avoid unnecessary storage of personal property photos and safeguard consumer privacy, project photos uploaded by homeowners are automatically and permanently purged from our cloud storage:

Basic Plan: Uploaded floor photos are permanently deleted after 3 days (72 hours).
Pro Plan: Uploaded floor photos are forwarded to your connected CRM (if enabled) and permanently deleted after 7 days (168 hours).

Once purged, floor photos are completely irretrievable from our systems. Text-based lead records (customer name, contact details, project specifications) are retained in the contractor dashboard until deleted by the contractor or upon account termination.

9. Cookies, Local Storage & Tracking Technologies

BullParkIt maintains a clean, privacy-respecting technology stack. We do not use third-party advertising cookies, retargeting pixels, or behavioral cross-site tracking scripts.

Strictly Necessary Cookies: We use secure, HTTP-only authentication tokens to keep contractors logged in to their administrative dashboard.
Functional Local Storage: We store contractor UI preferences (such as light mode or dark mode theme selection) in your local browser storage.
No Advertising Trackers on Embeds: The calculator widget embedded on contractor websites does not place marketing cookies or ad-network beacons on homeowner devices.

10. Comprehensive Regional Privacy Rights

Depending on your jurisdiction, you possess specific statutory rights regarding personal data:

10.1 Canada (PIPEDA & Provincial Privacy Laws):

In accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), individuals have the right to access their personal information, challenge its accuracy, request corrections, and withdraw consent to further processing.

10.2 United States (California CCPA/CPRA, VCDPA, CPA, etc.):

Residents of California and other states with comprehensive consumer privacy laws have the right to:

Right to Know / Access: Request disclosure of categories and specific pieces of personal information collected;
Right to Delete: Request deletion of personal information, subject to statutory exceptions;
Right to Correct: Request correction of inaccurate personal information;
Right to Non-Discrimination: We will never discriminate against you for exercising your privacy rights;
Affirmative Declaration on Selling / Sharing: BullParkIt has NOT sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months.

10.3 European Economic Area & United Kingdom (GDPR / UK GDPR):

Data subjects in the EEA and UK possess rights of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, and the right to object to processing. Where BullParkIt processes data on behalf of a contractor, homeowners should direct access requests directly to the contractor (the Data Controller).

11. Lead Communications & TCPA / CASL Consent Notice

When a homeowner enters their contact information and clicks “Get My Ballpark Estimate”, they provide express consent to be contacted by that specific contractor regarding their concrete coating project. Contractors are strictly obligated under our Terms of Service to comply with the US Telephone Consumer Protection Act (TCPA) and Canada’s Anti-Spam Legislation (CASL). BullParkIt does not initiate outbound telemarketing calls or marketing text blasts.

12. Data Security & Encryption Standards

BullParkIt implements comprehensive administrative, physical, and technical safeguards to secure personal information:

Encryption in Transit: All data transmitted between browsers, calculator widgets, and our APIs is encrypted using Transport Layer Security (TLS 1.3).
Encryption at Rest: Database records, encrypted object storage, and backups are encrypted at rest using AES-256 encryption.
Passwordless Authentication: Contractor access is protected via time-limited, cryptographic magic link tokens, eliminating password spray and credential stuffing attacks.
Access Control: Administrative access to production databases is strictly restricted on a least-privilege, multi-factor authenticated basis.

13. Children’s Privacy (COPPA)

The Service is strictly a business-to-business platform and adult consumer estimating tool. The Service is not directed to individuals under the age of 18 (or 16 where applicable). BullParkIt does not knowingly collect or solicit personal information from children. If we discover that personal information from a minor has been collected, we will immediately delete such data.

14. Data Breach Response & Notification Protocol

In the event of a confirmed security incident involving unauthorized access to personal data, BullParkIt maintains a formal incident response procedure. We will notify affected contractor accounts and applicable regulatory authorities (including the Office of the Privacy Commissioner of Canada and state attorneys general) without undue delay and within the 72-hour timeframe prescribed under modern data protection statutes.

15. Data Portability, Export, & Account Erasure

Contractors retain complete sovereignty over their data:

Self-Service CSV Export: You may export your entire lead database to a standard CSV format at any time directly from the Leads tab in your dashboard.
Complete Account Erasure: Upon account cancellation, you may request permanent eradication of your account profile, pricing matrices, and lead records by contacting support@bullparkit.com. Data will be permanently purged within thirty (30) days.

16. Changes to this Privacy Policy

We reserve the right to update or modify this Privacy Policy periodically to reflect technological changes, new features, or evolving legal frameworks. When changes occur, we will update the “Last Updated” date at the top of this document. Continued use of the Service following notice of updates constitutes acceptance of the revised policy.

17. Privacy Officer & Regulatory Inquiries

For questions regarding this Privacy Policy, data subject access requests, or privacy compliance inquiries, please contact our designated Privacy Officer:

BullParkIt Software Inc. — Privacy & Data Protection Officer
Corporate Website: https://www.bullparkit.com
Customer Support, Legal & Privacy Inquiries: support@bullparkit.com