Your BusinessThe Contractor Codex

Legal

Privacy Policy

How we collect, use, store, and protect data when you use The Contractor Codex.

Last updated: May 28, 2026

1. Who we are

The Contractor Codex is a software product operated by Bulwark Black LLC, a limited liability company organized under the laws of the State of Washington, United States. References in this policy to “we,” “us,” or “the Service” mean Bulwark Black LLC doing business as The Contractor Codex.

For privacy questions, data access requests, or to report a concern, contact support@contractorcodex.com.

2. Scope of this policy

This policy covers data we collect when you visit contractorcodex.com, sign up for an account, use the dashboard and admin tools, connect a third-party integration (such as Google Calendar, Stripe, or DocuSign), or correspond with us.

It does not cover data handled solely by third-party services you separately authorize. Their own policies govern that data; we link to the main ones below.

3. What we collect

Account and profile data

When you create an account, our identity provider (Clerk) collects your email address, name, password (hashed, never stored by us in plaintext), and optionally a phone number, profile photo, or multi-factor authentication credentials. We receive a user identifier and your verified email back from Clerk to associate the account with your organization.

Business and client data you enter

You enter and store records about your business and your clients in the Service, including client names, email addresses, phone numbers, mailing addresses, project descriptions, work session timestamps and notes, quote and contract content, signatures, file uploads, and internal notes. We hold this data on your behalf as a processor; you control it.

Payment data

We use Stripe to process payments. Stripe collects and stores cardholder data directly; we never see or store full card numbers. We retain Stripe-issued identifiers, invoice metadata, amounts, statuses, and refund records to operate the Service. Stripe’s privacy practices are at stripe.com/privacy.

Google user data (Calendar integration)

If you choose to connect Google Calendar, Google will ask you to grant The Contractor Codex permission via the Google OAuth consent screen. With your consent, we receive:

  • Your verified Google email address and basic profile, so we can label the connection in your settings.
  • A short-lived access token and a refresh token that let us call the Google Calendar API on your behalf.
  • Calendar event data (titles, descriptions, start and end times, locations, attendees you include in events you create through the Service, and the calendar identifier you selected).

We use this data only to: (a) push portal events (work sessions, signed quotes, contract milestones, project deadlines, invoice due dates) to your selected Google Calendar, and (b) pull events from that calendar back into the in-app calendar view so your portal stays in sync.

The Contractor Codex’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving advertisements, do not transfer it to third parties except as necessary to provide or improve user-facing features that are prominent in our user interface, do not allow humans to read it (except with your explicit consent, for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized), and do not use it for any purpose other than providing or improving the user-facing features that are prominent in the Service.

E-signature data (DocuSign integration)

If you connect DocuSign, we exchange envelope identifiers, signer status, and document metadata with DocuSign to power contract signing. DocuSign holds the underlying envelope data. Their privacy notice is at docusign.com/company/privacy-policy.

Usage, log, and device data

For security, abuse prevention, and basic analytics, we log IP addresses, user agent strings, request paths, timestamps, and limited diagnostic information. Signatures recorded on contracts include the signer’s IP and user agent as part of the audit trail.

Email correspondence

Emails sent or received through the Service (transactional receipts, invitations, inbound replies) are processed by Resend on our behalf and stored on our infrastructure for deliverability tracking and customer support. Resend’s privacy notice is at resend.com/legal/privacy-policy.

AI feature data (Anthropic, OpenAI, Deepgram)

When you use the optional AI Features in the Service (the in-portal AI chat for clients, the AI quote drafter, the Report-a-Problem voice transcription, or the MCP server), the prompts you send, relevant Service context, and audio recordings are routed to third-party AI providers acting as our subprocessors. Currently:

  • Anthropic processes prompts and context for the AI chat and admin assistant. Their privacy notice is at anthropic.com/legal/privacy.
  • OpenAI processes prompts and context when an organization configures OpenAI as its AI provider. Their privacy notice is at openai.com/policies/row-privacy-policy.
  • Deepgram processes audio recordings for voice-to-text transcription (used by the Report-a-Problem feature and other optional voice inputs). Their privacy notice is at deepgram.com/privacy.

We do not authorize these subprocessors to train, fine- tune, or otherwise improve their generalized models on Customer Data or end-client data routed through the Service. We require contractual commitments from these subprocessors consistent with that prohibition. AI Features can be disabled for your organization in your admin settings.

4. How we use data

  • To provide, operate, and maintain the Service.
  • To authenticate users and protect accounts from unauthorized access.
  • To sync events between The Contractor Codex and Google Calendar when you have authorized the integration.
  • To process payments, send invoices, and manage subscription billing.
  • To send transactional messages (receipts, notifications, signing requests, password resets).
  • To respond to support requests and improve the Service.
  • To comply with legal obligations, enforce our terms, and investigate suspected abuse or fraud.

We do not sell personal information. We do not use Google user data, customer business data, or end-client contact records for advertising. We do not train generalized machine-learning models on your data without your explicit consent.

5. How we share data

We share data only with service providers necessary to operate the Service (subprocessors) and only as needed for the described purposes. Our current subprocessors include:

  • Clerk. User authentication and session management.
  • Stripe. Payment processing, subscription billing, and Stripe Connect onboarding for contractors who collect payments from their own clients.
  • Google. Calendar API, when you authorize the integration.
  • DocuSign. E-signature processing, when you authorize the integration.
  • Resend. Transactional email delivery and inbound mail handling.
  • Anthropic. AI chat, AI quote drafter, and admin assistant prompts and context, when AI Features are enabled.
  • OpenAI. AI prompts and context when an organization configures OpenAI as its AI provider.
  • Deepgram. Voice-to-text transcription for the Report-a-Problem feature and other optional voice inputs.
  • Hosting and database providers. The Service runs on dedicated infrastructure in the United States with managed Postgres storage.

Subprocessor changes.If we add or replace a subprocessor that materially changes how Customer Data or end-client data is processed, we will update this list and give you at least thirty (30) days’ notice by email or in-app notice before the change takes effect. If you object to a new subprocessor, you may terminate your subscription at any point in the notice period and request a prorated refund for the unused portion of your then- current billing cycle.

We may disclose data when required by law, valid legal process, or to protect rights, safety, and the integrity of the Service. If we ever sell or merge the business, we will transfer data to the successor entity under the same commitments described here.

6. Cookies and similar technologies

We use a small number of cookies and similar technologies to run the Service. We do not use cookies for advertising or cross-site tracking.

  • Strictly necessary. Session cookies set by our identity provider (Clerk) to keep you signed in, CSRF-protection cookies during the Google OAuth and signing flows, and a session cookie that scopes admin views to a selected customer in the dashboard.
  • Functional. Cookies that remember preferences such as the time zone you selected.
  • Analytics. If we add analytics in the future, we will update this policy first and rely on privacy-friendly, aggregated tooling.

You can clear or block cookies through your browser, but the Service will not function correctly without the strictly necessary cookies above.

7. How we store and protect data

Data is stored on servers located in the United States. We use industry-standard safeguards including encryption in transit (TLS) on every public endpoint and encryption at rest for the database volume.

Sensitive credentials (including Google OAuth refresh tokens, DocuSign tokens, and other third-party access keys) are additionally encrypted at the application layer using AES-256-GCM with a key stored in the server environment and never exposed to the client.

Access to production systems is limited to authorized personnel and protected by multi-factor authentication. No method of transmission or storage is 100% secure; we do our best to protect your information but cannot guarantee absolute security.

Breach notification. If we discover a security incident affecting your personal information, we will notify you and any applicable regulators in accordance with the timelines and disclosures required by applicable law (for example, within 72 hours under the GDPR, or as soon as practicable under US state breach-notification statutes).

8. Data retention

We retain account and business data for as long as your account is active, plus a reasonable period afterward to comply with legal, accounting, and tax obligations. You may request deletion of your account and associated data by emailing support@contractorcodex.com.

Google user data specifically is retained only while you keep the Google Calendar integration connected. When you disconnect the integration in Settings > Calendar, we revoke the refresh token with Google and delete the encrypted tokens and the calendar identifier from our database. Calendar events already created in your portal remain so historical records are not lost; they simply stop syncing with Google.

9. Your rights and choices

The following choices are available to all users:

  • Access. You can review most of your data directly in the dashboard. For a portable export, email support.
  • Correction. You can edit account details, client records, and project data through the application.
  • Deletion. You can disconnect integrations at any time. To delete your account and associated data, email support.
  • Revoking Google access.You can revoke The Contractor Codex’s access to your Google Account at any time from myaccount.google.com/permissions.
  • Marketing. Transactional emails are required to operate the Service. We do not send promotional email unless you have explicitly opted in; if we ever do, each message includes an unsubscribe link.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, the categories of sources and recipients, and the business purposes for which it is used; the right to request deletion or correction of your personal information; the right to limit the use of sensitive personal information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising any of these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising as those terms are defined under the CPRA.

To exercise a California privacy right, email support@contractorcodex.com with the request and your account email. We will verify your identity by matching the request to an authenticated account. Authorized agents acting on your behalf may submit requests with written authorization. We respond within 45 days, with one possible 45-day extension if more time is needed.

EEA, UK, and Switzerland (GDPR / UK GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You may also withdraw consent at any time where we rely on consent as the legal basis. You have the right to lodge a complaint with your local supervisory authority.

Legal bases. We rely on the following legal bases under Article 6 of the GDPR:

  • Performance of a contract for delivering the Service to subscribers, processing payments, and providing customer support.
  • Legitimate interests for securing the Service, preventing fraud and abuse, and improving product features in a way that does not override your rights and freedoms.
  • Consent for optional features that require it (for example, connecting Google Calendar). You may withdraw consent at any time by disconnecting the integration.
  • Legal obligation for tax, accounting, and law-enforcement compliance.

For data subject requests, email support@contractorcodex.com. We respond within one month and may extend by an additional two months for complex requests, with notice.

10. Children

The Service is not directed to children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. International transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your data is transferred to and processed in the United States.

For transfers of personal data out of the EEA, United Kingdom, or Switzerland, we rely on appropriate safeguards including the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and our subprocessors’ certifications under the EU-US Data Privacy Framework where available. By using the Service you consent to these transfers.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

Questions, concerns, or privacy requests? Email support@contractorcodex.com or write to us at the address below.

Bulwark Black LLC
d/b/a The Contractor Codex
522 W Riverside Ave, Ste N
Spokane, WA 99201
United States