Privacy Policy

This policy explains how Sleeves Up. Builders handles personal information on sleevesup.builders. The business responsible for your information is [OWNER TO CONFIRM: registered legal entity name and address]. Privacy contact: privacy@sleevesup.builders [OWNER TO CONFIRM: confirm this mailbox exists and is monitored].

Information you give us:

• Account: email address, password (handled by our authentication provider; we never see it in plain text), display name, and optionally a phone number. If you sign in with Google, we receive your email address and name from Google.
• Business application and listing: legal business name, business category, listing name, tagline, description, website, public phone and email, city, state, service ZIP and radius, services, years in business, employee range, specialties, logo and cover images, and the application answers you submit (such as ownership details and attestations).
• Verification evidence: documents you upload to support a badge — for example a licence, a certificate of insurance, or veteran-ownership evidence — and the details our reviewers record about them, such as licence number, issuing state, and expiry date.
• Membership requests: which plan you asked for, the price shown at the time, who asked, and when. No payment card details are collected.
• Project requests (homeowners): trade, ZIP, city and state, description, budget range, timeline, contact name, optional phone, and any attachments.
• Messages between a homeowner and a business about a request, and any attachments.
• Reviews: rating, title, text, the display name shown with the review, business responses, and reports you make about a review.
• Review invitations: the e-mail address (and, if the business adds one, the first name) a Member Business enters to invite a customer to leave a review, the date the invitation was sent and whether it was used. We use it only to send that invitation and to stop a customer from being invited or reviewing more than once.
• Saved businesses and agreements you accept.

Information created as you use the platform:

• Status history for applications, verifications, requests, and leads (for example when a request was viewed or answered), in-app notifications, and a record of emails queued to you.
• A security and audit log of significant actions (for example an application decision or a membership request), including which account took the action and when.
• Short-lived rate-limit counters used to prevent abuse.
• Technical information your browser sends to our hosting provider when you load a page, such as IP address and browser type. [OWNER TO CONFIRM: hosting log retention]

• to create and secure your account and sign you in;
• to review applications and verification evidence and decide which badges to show;
• to publish approved listings in the directory;
• to record membership requests and contact you about them;
• to deliver project requests to the businesses you choose and run messaging;
• to publish and moderate reviews;
• to send service emails and notifications;
• to prevent abuse, keep an audit trail, and meet legal obligations.

Legal bases or notice requirements for each use [COUNSEL TO REVIEW: notice-at-collection and lawful-basis wording for the jurisdictions served]

We do not sell personal information. We do not use it for targeted advertising.

• The public sees only live listing information: business name, tagline, description, website, public phone and email, city, state, service area, services, logo and cover images, badges (with the date verified, expiry, and issuing state where relevant), and published reviews with the reviewer’s chosen display name. Homeowner profiles are not public.
• A business you send a request to sees the request. Your contact details are shared with that business once you reply to it in the conversation. Other businesses do not see your request.
• Members of your business account see that business’s application, documents, requests, and messages.
• Our administrators can see applications, verification evidence, membership requests, and the audit log to run the platform. Administrator access is set to require multi-factor authentication.

Uploaded documents and images are stored in private storage. Files are served only through short-lived links issued after an access check; listing logos and cover images are shown publicly once a listing is live.

We use these providers to run the platform. They process data on our behalf.

• Supabase — database, authentication, and file storage. Data location: [OWNER TO CONFIRM: Supabase project region].
• Vercel — website hosting. [OWNER TO CONFIRM: Vercel region / data location]
• Resend — delivery of service emails, when email delivery is enabled. [OWNER TO CONFIRM: confirm Resend is the production email provider]
• Sentry — error monitoring. When a page fails, technical details of the error (browser, page address without its query string, and the error itself) are sent so we can fix it. No session recording and no account details are sent. Data location: EU (Germany).
• YouTube (Google) and Vimeo — school videos. Nothing is loaded from them until you press play on a video; the player then loads from youtube-nocookie.com or player.vimeo.com, which receive your IP address and may store data on your device under their own privacy policies.
• Google — web fonts are loaded from Google’s servers, which receive your IP address when a page loads; and Google sign-in, if you choose it.
• Google Analytics — only if enabled. [OWNER TO CONFIRM: confirm whether Google Analytics will be enabled in production]

Payment and background-screening providers are not in use. No card details are collected and no background checks are run through the platform. If that changes, this policy will be updated first.

We may disclose information where required by law or to protect the platform and its users. [COUNSEL TO DRAFT: legal-disclosure and business-transfer wording]

We store a sign-in session in your browser so you stay signed in. Details are in the Cookie & local storage notice.

[OWNER TO CONFIRM: retention period for each category: accounts, applications, verification documents, membership requests, project requests and messages, reviews, email records, audit log, hosting logs]

Some records cannot simply be erased while others depend on them: the audit log is append-only, and accepted agreements and submitted applications are kept as records of what was agreed and decided. [COUNSEL TO REVIEW: how these records are handled on a deletion request]

You can update your listing and profile from your account. To ask for a copy of your information, a correction, or deletion of your account, sign in and use Privacy requests in your account, or, if you can't sign in, follow the steps under Privacy and account deletion requests. Each request is reviewed by our team. For a deletion request we first deactivate the account, which can be undone if it was made in error; removing the remaining records is a separate, later step.

We will confirm your identity before acting on a request. [OWNER TO CONFIRM: response time for privacy requests] [COUNSEL TO REVIEW: state privacy rights that apply and how to describe them]

Access to data is restricted by account and role, files are kept in private storage, and administrator access is set to require multi-factor authentication. No system is perfectly secure. [COUNSEL TO REVIEW: breach-notification commitments, if any]

The platform is for adults and is not directed at children. [OWNER TO CONFIRM: minimum user age]

When this policy changes we will update the date at the top of this page. [OWNER TO CONFIRM: how users are notified of material changes]