Privacy Policy

1. Introduction

SUBStrust LLC (“SUBStrust,” “we,” “our,” or “us”) operates a contractor marketplace platform that connects General Contractors (GCs) with licensed Subcontractors. This Privacy Policy describes how we collect, use, share, and protect your personal information when you access or use our website, mobile application, and related services (collectively, the “Platform”).

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Platform.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, phone number, and password
• Company information: business name, address, EIN, and business type
• License information: state contractor license numbers, license types, expiration dates, and supporting documentation
• Project details: project descriptions, locations, budgets, timelines, trade requirements, and scope of work
• Messages: communications sent through the Platform's messaging system
• Payment information: billing details processed securely through Stripe (we do not store full credit card numbers on our servers)
• Uploaded documents and photos: project photos, insurance certificates, license documents, and other files you upload to the Platform

2.2 Information Collected Automatically

• IP address, browser type, operating system, and device information
• Pages visited, features used, and time spent on the Platform
• Referring URLs and search terms
• Cookies and similar tracking technologies (see Section 8)

2.3 Mobile Application

When you use the SUBStrust mobile app, we may access the following device features. Access occurs only when you initiate the relevant action — we do not access them in the background:

• Camera and photo library: used only when you scan or upload a contractor license, insurance certificate, or project document. Images are uploaded to the Platform as the documents you choose to submit; we do not collect other photos from your device.
• Push notification tokens: if you enable notifications, we collect a push token from Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM), delivered via Expo, so we can send you project, payment, and license notifications. You can disable notifications at any time in your device settings, and the token is removed when you sign out.
• Device information: device type, operating system version, and app version, used to operate and troubleshoot the app.

The mobile app does not offer in-app purchases; subscription billing is handled on the web. We do not use your data for third-party advertising or cross-app tracking.

3. How We Use Your Information

We use your information for the following purposes:

• License verification: to verify your contractor licenses against state licensing boards and maintain verified status
• Project matching: to match Subcontractors with relevant project opportunities using AI-powered scoring based on licenses, location, trade, and project fit
• Escrow payments: to process and manage escrow payments between GCs and Subcontractors, including milestone tracking and fund releases
• Communication: to facilitate messaging between users and to send transactional notifications (project updates, payment confirmations, license reminders)
• Account management: to create, maintain, and secure your account
• Platform improvement: to analyze usage patterns and improve our services
• Legal compliance: to comply with applicable laws, regulations, and legal processes

4. Third-Party Services

We use the following third-party services to operate the Platform. Each provider has its own privacy policy governing how it handles your data:

• Firebase (Google): authentication, user database, and file storage
• Stripe: payment processing, escrow fund management, and subscription billing
• Google Cloud Platform: application hosting and infrastructure
• SendGrid (Twilio): transactional and notification emails
• Expo: delivery of mobile push notifications to Apple (APNs) and Google (FCM) device services
• Sentry: error monitoring and performance diagnostics on the web application

We do not sell your personal information to third parties. We share data with these providers only to the extent necessary to operate the Platform.

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

• With other users: your verified credentials, company name, trade specialties, and professional profile are visible to other Platform users as part of the matching and hiring process
• Service providers: with the third-party vendors listed in Section 4, solely to operate the Platform
• Legal requirements: when required by law, subpoena, court order, or to protect the rights, safety, or property of SUBStrust or others
• Business transfers: in connection with a merger, acquisition, bankruptcy, or sale of all or a portion of our assets

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Firebase Authentication with secure session management
• Role-based access controls and broken access control enforcement
• Regular security audits and vulnerability assessments
• Stripe PCI-DSS compliance for payment data handling

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Privacy Rights (GDPR / CCPA)

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to correction: request correction of inaccurate or incomplete data
• Right to deletion: request deletion of your personal data, subject to legal retention requirements
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing of your data for certain purposes
• Right to withdraw consent: withdraw consent for data processing at any time
• Right to opt out of sale: we do not sell personal information, but you may contact us to confirm

To exercise any of these rights, contact us at support@substrust.com. We will respond to verified requests within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies: session management, authentication state, and security tokens required for the Platform to function
• Analytics cookies: understanding how users interact with the Platform to improve our services
• Preference cookies: remembering your settings and display preferences

You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain Platform features.

9. Data Retention

We retain your personal information for as long as your account is active and as needed to provide our services. When you request account deletion:

• Account data and profile information will be deleted within 30 days
• Transaction records and payment history may be retained for up to 7 years as required by tax and financial regulations
• Aggregated, anonymized data that cannot identify you may be retained indefinitely for analytics purposes

To request account deletion, contact us at support@substrust.com.

10. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal data from a child under 18, we will promptly delete that information. If you believe a child under 18 has provided us with personal data, please contact us at support@substrust.com.

11. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers and third-party service providers are located. If you are accessing the Platform from outside the United States, your data will be transferred to the US. We take appropriate safeguards to ensure your data receives an adequate level of protection in accordance with applicable data protection laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Platform. The “Last Updated” date at the top of this policy reflects the most recent revision. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.