Your BusinessThe Contractor Codex

Legal

Privacy Policy

How we collect, use, store, and protect data when you use The Contractor Codex.

Last updated: July 9, 2026

1. Who we are

The Contractor Codex is a software product operated by Bulwark Black LLC, a limited liability company organized under the laws of the State of Washington, United States. References in this policy to “we,” “us,” or “the Service” mean Bulwark Black LLC doing business as The Contractor Codex.

For privacy questions, data access requests, or to report a concern, contact support@contractorcodex.com.

2. Scope of this policy

This policy covers data we collect when you visit contractorcodex.com, sign up for an account, use the dashboard and admin tools, connect a third-party integration (such as Google Calendar, Stripe, or DocuSign), link a bank account to the bookkeeping features, or correspond with us.

It does not cover data handled solely by third-party services you separately authorize. Their own policies govern that data; we link to the main ones below.

3. What we collect

Account and profile data

When you create an account, our identity provider (Clerk) collects your email address, name, password (hashed, never stored by us in plaintext), and optionally a phone number, profile photo, or multi-factor authentication credentials. We receive a user identifier and your verified email back from Clerk to associate the account with your organization.

Business and client data you enter

You enter and store records about your business and your clients in the Service, including client names, email addresses, phone numbers, mailing addresses, project descriptions, work session timestamps and notes, quote and contract content, signatures, file uploads, and internal notes. This includes contact details for people you bill directly by email. We hold this data on your behalf as a processor; you control it.

Payment data

We use Stripe to process payments. Stripe collects and stores cardholder data directly; we never see or store full card numbers. We retain Stripe-issued identifiers, invoice metadata, amounts, statuses, and refund records to operate the Service. Stripe’s privacy practices are at stripe.com/privacy.

Bank account data (optional bank feed)

If you choose to connect a bank account to the bookkeeping features, the connection is made through one of our bank connectivity providers: Plaid Inc. or Stripe Financial Connections. You sign in with your bank on a screen provided by that provider and your bank. Your online banking credentials are never sent to us and never stored by us. Plaid’s privacy practices are at plaid.com/legal.

With your consent, the provider shares with us the linked account’s institution and account details, balance information, and transaction history (dates, amounts, and descriptions). We store imported transactions so you can categorize them, track job costs, and build financial reports. We do not store your full account or routing numbers.

Access is read-only. Connecting a bank account does not authorize us or anyone else to move money in or out of it. You can disconnect a linked account yourself from the bookkeeping settings, or email support@contractorcodex.com and we will stop importing new data. Section 8 describes what happens to transactions already imported.

Google user data (Calendar integration)

If you choose to connect Google Calendar, Google will ask you to grant The Contractor Codex permission via the Google OAuth consent screen. With your consent, we receive:

  • Your verified Google email address and basic profile, so we can label the connection in your settings.
  • A short-lived access token and a refresh token that let us call the Google Calendar API on your behalf.
  • Calendar event data (titles, descriptions, start and end times, locations, attendees you include in events you create through the Service, and the calendar identifier you selected).

We use this data only to: (a) push portal events (work sessions, signed quotes, contract milestones, project deadlines, invoice due dates) to your selected Google Calendar, and (b) pull events from that calendar back into the in-app calendar view so your portal stays in sync.

The Contractor Codex’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving advertisements, do not transfer it to third parties except as necessary to provide or improve user-facing features that are prominent in our user interface, do not allow humans to read it (except with your explicit consent, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized), and do not use it for any purpose other than providing or improving the user-facing features that are prominent in the Service.

E-signature data (DocuSign integration)

If you connect DocuSign, we exchange envelope identifiers, signer status, and document metadata with DocuSign to power contract signing. DocuSign holds the underlying envelope data. Their privacy notice is at docusign.com/company/privacy-policy.

Usage, log, and device data

For security, abuse prevention, and basic analytics, we log IP addresses, user agent strings, request paths, timestamps, and limited diagnostic information. Signatures recorded on contracts include the signer’s IP and user agent as part of the audit trail. When error monitoring is enabled, application errors and related request details are sent to Sentry so we can find and fix problems; sign-in credentials and cookies are removed from those reports before they are sent.

Email correspondence

Emails sent or received through the Service (transactional receipts, invitations, inbound replies) are processed by Resend on our behalf and stored on our infrastructure for deliverability tracking and customer support. Resend’s privacy notice is at resend.com/legal/privacy-policy.

AI feature data (optional AI providers)

The Service includes optional AI Features: the in-portal AI chat for clients, the admin assistant, the AI quote drafter, the Report-a-Problem voice transcription, the Codex bookkeeping assistant that suggests categories for imported bank transactions, and the MCP connection for outside AI assistants. When you use them, the prompts you send, relevant Service context, and audio recordings are routed to an AI provider for processing. Depending on the feature, that context can include client names and contact details, project, quote, and invoice details, and imported bank transaction descriptions, amounts, and dates.

For most AI Features, your organization chooses the provider and supplies its own API key in Settings. The providers currently supported are:

Your organization can instead point these features at a self-hosted AI gateway it runs, in which case no cloud AI provider receives the data.

We do not train any model of our own on Customer Data or end-client data. When your organization supplies its own AI provider key, that provider processes the data under your organization’s agreement with it. The business API terms of the providers listed above state that API data is not used to train their models by default, but review the terms of the provider and plan tier you connect; free or consumer tiers can have different data practices. Where an AI provider processes data under our account (voice transcription), we do not permit it to train its models on that data. AI Features can be disabled for your organization in your admin settings.

Website content you import

When you give us a website address to build your company profile (used to give the AI Features context about your business), we use Firecrawl to fetch a limited number of publicly available pages from that site and store the result in your organization’s settings. Firecrawl’s privacy notice is at firecrawl.dev/privacy-policy.

4. How we use data

  • To provide, operate, and maintain the Service.
  • To authenticate users and protect accounts from unauthorized access.
  • To sync events between The Contractor Codex and Google Calendar when you have authorized the integration.
  • To process payments, send invoices, and manage subscription billing.
  • To import bank activity you connect, suggest transaction categories, and build financial reports for your business.
  • To send transactional messages (receipts, notifications, signing requests, password resets).
  • To respond to support requests and improve the Service.
  • To comply with legal obligations, enforce our terms, and investigate suspected abuse or fraud.

We do not sell personal information. We do not use Google user data, customer business data, or end-client contact records for advertising. We do not train generalized machine-learning models on your data without your explicit consent.

5. How we share data

We share data only with service providers necessary to operate the Service (subprocessors) and only as needed for the described purposes. Our current subprocessors include:

  • Clerk. User authentication and session management.
  • Stripe. Payment processing, subscription billing, and Stripe Connect onboarding for contractors who collect payments from their own clients. Also bank account connections (Stripe Financial Connections) when you link a bank account to the bookkeeping features.
  • Plaid Inc. Bank account connections when you link a bank account to the bookkeeping features through Plaid. Your bank sign-in happens directly with Plaid and your bank; we receive read-only account details and transaction history.
  • Google. Calendar API when you authorize the calendar integration, and Google AI (Gemini) when your organization selects Gemini as its AI provider.
  • DocuSign. E-signature processing, when you authorize the integration.
  • Resend. Transactional email delivery and inbound mail handling.
  • Anthropic. AI prompts and context when an organization configures Anthropic as its AI provider.
  • OpenAI. AI prompts and context when an organization configures OpenAI as its AI provider.
  • xAI. AI prompts and context when an organization configures xAI (Grok) as its AI provider.
  • Deepgram. Voice-to-text transcription for the Report-a-Problem feature and other optional voice inputs.
  • Firecrawl. Fetches publicly available pages from a website you ask us to import when building your company profile.
  • Sentry. Error monitoring, when enabled. Error reports include request details; sign-in credentials and cookies are removed before sending.
  • Hosting, database, and file storage providers. The Service runs on dedicated servers located in the European Union. Uploaded files may also be stored with an S3-compatible storage provider.

Subprocessor changes. If we add or replace a subprocessor that materially changes how Customer Data or end-client data is processed, we will update this list and give you at least thirty (30) days’ notice by email or in-app notice before the change takes effect. If you object to a new subprocessor, you may terminate your subscription at any point in the notice period and request a prorated refund for the unused portion of your then- current billing cycle.

We may disclose data when required by law, valid legal process, or to protect rights, safety, and the integrity of the Service. If we ever sell or merge the business, we will transfer data to the successor entity under the same commitments described here.

6. Cookies and similar technologies

We use a small number of cookies and similar technologies to run the Service. We do not use cookies for advertising or cross-site tracking.

  • Strictly necessary. Session cookies set by our identity provider (Clerk) to keep you signed in, CSRF-protection cookies during the Google OAuth and signing flows, and a session cookie that scopes admin views to a selected customer in the dashboard.
  • Functional. Cookies that remember preferences such as the time zone you selected and the subscription plan you picked before signing up.
  • Analytics. If we add analytics in the future, we will update this policy first and rely on privacy-friendly, aggregated tooling.

You can clear or block cookies through your browser, but the Service will not function correctly without the strictly necessary cookies above. The app also uses your browser’s local storage for small device preferences (such as the microphone you picked for dictation) and to keep an unsent signature draft on your device while you sign a document.

7. How we store and protect data

Data is stored on dedicated servers located in the European Union, operated for us by an established hosting provider. We use industry-standard safeguards including encryption in transit (TLS) for every connection to the Service.

Sensitive credentials (including Google OAuth refresh tokens, DocuSign tokens, and other third-party access keys) are additionally encrypted at the application layer using AES-256-GCM with a key stored in the server environment and never exposed to the client.

Access to production systems is limited to authorized personnel and protected by key-based sign-in, with multi-factor authentication required on administrative accounts. Payment and signing notifications from our providers are accepted only after their signatures are verified, and financial ledger entries are written to a tamper-evident, hash-chained record. We keep regular backups. No method of transmission or storage is 100% secure; we do our best to protect your information but cannot guarantee absolute security.

Breach notification. If we discover a security incident affecting your personal information, we will notify you and any applicable regulators in accordance with the timelines and disclosures required by applicable law (for example, within 72 hours under the GDPR, or as soon as practicable under US state breach-notification statutes).

8. Data retention

We retain account and business data for as long as your account is active, plus a reasonable period afterward to comply with legal, accounting, and tax obligations. You may request deletion of your account and associated data by emailing support@contractorcodex.com.

Google user data specifically is retained only while you keep the Google Calendar integration connected. When you disconnect the integration in Settings > Calendar, we revoke the refresh token with Google and delete the encrypted tokens and the calendar identifier from our database. Calendar events already created in your portal remain so historical records are not lost; they simply stop syncing with Google.

Bank feed data is retained while the connection is active. When a linked bank account is disconnected we stop receiving new data; transactions already imported remain part of your business records until you delete them or ask us to remove them.

9. Your rights and choices

The following choices are available to all users:

  • Access. You can review most of your data directly in the dashboard. For a portable export, email support.
  • Correction. You can edit account details, client records, and project data through the application.
  • Deletion. You can disconnect integrations at any time. To delete your account and associated data, email support.
  • Revoking Google access. You can revoke The Contractor Codex’s access to your Google Account at any time from myaccount.google.com/permissions.
  • Disconnecting a bank account. Disconnect a linked bank account at any time from the bookkeeping settings, or email support; we stop importing new data when you do, and for Plaid connections we also revoke our access with Plaid.
  • Marketing. Transactional emails are required to operate the Service. We do not send promotional email unless you have explicitly opted in; if we ever do, each message includes an unsubscribe link.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, the categories of sources and recipients, and the business purposes for which it is used; the right to request deletion or correction of your personal information; the right to limit the use of sensitive personal information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising any of these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising as those terms are defined under the CPRA.

To exercise a California privacy right, email support@contractorcodex.com with the request and your account email. We will verify your identity by matching the request to an authenticated account. Authorized agents acting on your behalf may submit requests with written authorization. We respond within 45 days, with one possible 45-day extension if more time is needed.

EEA, UK, and Switzerland (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You may also withdraw consent at any time where we rely on consent as the legal basis. You have the right to lodge a complaint with your local supervisory authority.

Legal bases. We rely on the following legal bases under Article 6 of the GDPR:

  • Performance of a contract for delivering the Service to subscribers, processing payments, and providing customer support.
  • Legitimate interests for securing the Service, preventing fraud and abuse, and improving product features in a way that does not override your rights and freedoms.
  • Consent for optional features that require it (for example, connecting Google Calendar). You may withdraw consent at any time by disconnecting the integration.
  • Legal obligation for tax, accounting, and law-enforcement compliance.

For data subject requests, email support@contractorcodex.com. We respond within one month and may extend by an additional two months for complex requests, with notice.

10. Children

The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. International transfers

Our application and database servers are located in the European Union, and most of our subprocessors (listed in Section 5) process data in the United States. Wherever you use the Service from, your data is transferred to and processed in both regions.

For transfers of personal data out of the EEA, United Kingdom, or Switzerland, we rely on appropriate safeguards including the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and our subprocessors’ certifications under the EU-US Data Privacy Framework where available. By using the Service you consent to these transfers.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 30 days before they take effect. If we ask you to expressly accept an updated version inside the app, the update takes effect for you when you accept it. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

Questions, concerns, or privacy requests? Email support@contractorcodex.com or write to us at the address below.

Bulwark Black LLC
d/b/a The Contractor Codex
522 W Riverside Ave, Ste N
Spokane, WA 99201
United States