Privacy Policy

1. Introduction

GivingStump, Inc. ("GivingStump", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and our Terms of Service. If you do not agree with our policies and practices, please do not use the Service.

This Privacy Policy applies to information we collect through the Service, in email, text, and other electronic communications sent through or in connection with the Service, and information collected offline or through other means, such as customer support interactions.

2. Information We Collect

2.1 Information You Provide Directly to Us

We collect information that you provide directly to us when you:

• Create an Account: Name, email address, phone number, password, and profile information
• Post a Job: Property address, job description, photos, budget range, timeline preferences, and special requirements
• Submit a Bid (Contractors): Business name, license numbers, insurance information, qualifications, portfolio, pricing, and availability
• Complete Payment: Payment card information (processed securely through Stripe), billing address, and transaction details
• Communicate with Us: Support requests, feedback, survey responses, and correspondence
• Connect Third-Party Services: Information from integrated services such as Google Calendar, CRM systems, or payment processors

2.2 Information Automatically Collected

When you access or use the Service, we automatically collect certain information about your device and usage patterns, including:

• Device Information: IP address, browser type and version, operating system, device identifiers, mobile network information, and device configuration
• Usage Data: Pages visited, features used, time spent on pages, clickstream data, search queries, and navigation patterns
• Location Data: Precise or approximate location information derived from IP address, GPS, WiFi, or other location services (with your consent)
• Log Information: Access times, dates, and referring website addresses
• Error Reports: When something on the Service breaks, our error monitoring provider, Sentry, receives a report with the page address, your browser and device type, and technical details of the error
• Session Replay (only with your consent): If you choose "Allow" on the cookie notice, Sentry also records a replay of about 1 in 10 visits, and of every visit where an error occurs: the page layout, clicks, scrolling and navigation. All page text and everything you type is masked and all images are blocked, so the replay shows placeholders, not your content. Replay does not run until you allow it, and never runs when your browser sends Global Privacy Control (see Section 8)
• Error-Monitoring Diagnostics (only with your consent): If you choose "Allow" on the cookie notice, Sentry also receives the steps that led up to an error, a record of each page view, and performance traces for a sample of page loads and navigations, as described in Section 8.3. Until you allow it, and whenever your browser sends Global Privacy Control, Sentry receives error reports only
• Site Performance: Vercel Web Analytics and Speed Insights count page views and measure how quickly pages load. They run for every visitor and do not set cookies
• Cookies and Tracking Technologies: Information collected through cookies, web beacons, pixel tags, and similar technologies (see Section 8 for details)

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment processors (Stripe) for transaction and payment verification
• Authentication providers (Google OAuth) for account creation and login
• Background check and verification services for Contractor credential verification
• Analytics providers (Google Analytics) for usage statistics
• Social media platforms if you connect your accounts
• Public databases and government records for license and insurance verification

2.4 AI and automated processing

When you use features that generate or summarize content from your inputs, we (or subprocessors acting on our instructions) may process the text, images, or metadata you provide—such as job descriptions, tree photos, and location context—to produce suggestions or assessments. Those outputs are described in our Terms of Service and are not a substitute for professional on-site evaluation.

These are the providers that process your text, photos and documents for these features, and what each one receives:

• Anthropic (Claude): text you write when you use an AI feature, such as a job description, and tree photos, to detect and assess the trees in them. We may also send Claude the text you write for the other side before a job is awarded (bids and their price lines, job posts and edits, questions and answers on a job listing, and notes on video requests and measurements), to screen it for visit scheduling and for attempts to take the deal off GivingStump. Our requests may pass through Vercel AI Gateway, which can route a request to the same Claude model hosted by another cloud provider
• Google Cloud Vision: tree photos, to label what is in them for tree detection and species identification; every photo you upload and frames from walkaround videos, to screen out prohibited content, with video frames also read for phone numbers or email addresses shown on screen; and certificates of insurance that contractors upload, whose text Vision reads so we can pull out the insurer, policy number, coverage amounts and policy dates
• Google Gemini: tree photos, the labels Cloud Vision found in them, and the city and state of the job, to suggest the tree species
• Pl@ntNet: tree photos, to identify the species

Their processing is governed by our agreements with them and their published privacy terms.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Provision: To provide, operate, maintain, and improve the Service, including facilitating job postings, bidding, matching, scheduling, payment processing, and communication between Users
• Account Management: To create and manage your account, authenticate your identity, process transactions, and provide customer support
• Communication: To send you transactional communications (job alerts, bid notifications, payment confirmations, scheduling updates), respond to your inquiries, and provide customer support via email, push notifications, and in-app messages
• Matching and Recommendations: To match Customers with Contractors based on location, job requirements, availability, ratings, and preferences
• Payment Processing: To process payments, manage escrow accounts, calculate and collect platform fees, facilitate payouts to Contractors, and handle refunds and disputes
• Verification and Safety: To verify Contractor credentials, licenses, and insurance; conduct background checks; detect and prevent fraud, abuse, and illegal activity; and ensure platform safety and security
• Analytics and Improvement: To analyze usage patterns, conduct research, develop new features, improve user experience, and optimize the Service
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests; enforce our Terms of Service; protect our rights and property; and resolve disputes
• Advertising measurement (only with your consent): If you allow it, the Meta Pixel tells Meta when a visit that started from one of our Facebook or Instagram ads goes on to post a job or sign up, so we can see which ads work. It is not loaded unless you allow it, and never when your browser sends Global Privacy Control (see Section 8)
• Marketing (with consent): To send you promotional communications, newsletters, special offers, and updates about new features (you may opt out at any time)
• Aggregated Data: To create anonymized, aggregated data sets for business intelligence, market research, and statistical analysis
• AI-assisted features: To generate or refine job descriptions, provide informational summaries from user-provided photos or text, estimate costs or scope suggestions, and improve prompts and safety filters—using subprocessors described in Section 2.4

We process your information based on legitimate business interests, contractual necessity, legal obligations, and, where applicable, your consent. We will not use your personal information for purposes incompatible with those described in this Privacy Policy without your consent.

4. How We Share Your Information

We may share your information in the following circumstances:

4.1 With Other Users

• Job Postings: When you post a job, Contractors can see your job description, location (general area), budget range, and timeline
• Bids: When you submit a bid, Customers can see your business name, qualifications, pricing, and profile information
• Accepted Bids: When a bid is accepted, we share contact information (name, phone, email) between Customer and Contractor to facilitate service delivery
• Reviews and Ratings: Reviews and ratings you submit may be displayed publicly on Contractor profiles

4.2 With Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Payment Processors: Stripe for payment processing, escrow management, and financial transactions
• Email Delivery: Resend for transactional and notification emails
• Cloud Infrastructure: Vercel, Supabase, and AWS for hosting, database, and storage services
• Analytics (only with your consent): Google Analytics for usage statistics
• Site Performance: Vercel Web Analytics and Speed Insights, which count page views and measure page speed without cookies
• Error Monitoring: Sentry, for error reports and, only if you allow it, masked session replays, page-view records and performance traces (see Sections 2.2 and 8.3)
• Maps and Places: Google Maps Platform, which receives addresses to place jobs and contractors on the map, and contractor business names, to match a business to its Google listing
• Email Services: Email delivery and marketing automation platforms
• Background Checks: Checkr. We send Checkr a contractor's name, email address, phone number and state; Checkr then collects the contractor's authorization and any further details it needs through its own form
• License Checks: Cobalt Intelligence, which receives a contractor's license number, license state and business name to look the license up with the state licensing board
• AI and image processing providers: Anthropic, Google (Cloud Vision and Gemini) and Pl@ntNet, for the features and data described in Section 2.4
• Customer Support: Help desk and customer support platforms

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

• Compliance with subpoenas, court orders, or legal processes
• Responding to government or regulatory requests
• Enforcing our Terms of Service or other agreements
• Protecting our rights, property, or safety, or that of our Users or others
• Investigating potential violations of law or our policies
• Preventing fraud, abuse, or illegal activity

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity or successor organization, subject to the same privacy protections.

5. How We Communicate With You

We send transactional and operational communications—such as job alerts and bid notifications, schedule proposals and confirmations, payment and escrow status updates, account security alerts, and other service-related messages—through email, in-app messages, and, where you enable them, push notifications.

We do not send SMS or RCS text messages. Any phone number you provide is used to help Customers and Contractors coordinate work directly and for account verification or support—not for marketing texts from us.

Marketing. We obtain any separate consent required by law before sending promotional email. You can opt out of marketing email at any time using the unsubscribe link in those messages; transactional messages necessary to operate the Service may continue while your account is open.

You can manage your notification preferences at any time in your account settings or by contacting us at support@givingstump.com.

6. Data Security

We implement industry-standard technical and organizational security measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Data is encrypted in transit over TLS and encrypted at rest by our database provider
• Card details never reach our servers. Payments are handled by Stripe, a PCI DSS Level 1 certified provider, and we store only Stripe's reference identifiers
• Access to production data requires authentication, and database access is restricted by row-level security policies
• Dependencies and code are scanned automatically on every change before it ships
• The database is backed up automatically by our hosting provider
• If a breach affects your personal information, we will notify you and the relevant authorities as required by law

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

In the event of a personal data breach that requires notification, we will notify affected individuals and regulators without undue delay and within timelines required by applicable law (which may differ by jurisdiction).

7. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

7.1 General Rights (All Users)

• Access: Request access to your personal information and receive a copy
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request transfer of your data to another service provider in a machine-readable format
• Objection: Object to processing of your information for certain purposes
• Restriction: Request restriction of processing in certain circumstances
• Withdraw Consent: Withdraw consent where processing is based on consent

7.2 California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA"):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (with certain exceptions)
• Right to correct inaccurate personal information
• Right to opt out of the "sale" or "sharing" (for cross-context behavioral advertising) of personal information. GivingStump does not sell personal information. If you allow advertising measurement, the Meta Pixel sends Meta information about your visit, which California law may treat as "sharing". We load it only after you allow it, you can withdraw that at any time from Section 8.3, and we treat a Global Privacy Control (GPC) signal from your browser as an opt-out: with GPC on, neither the Meta Pixel nor Google Analytics is loaded, Sentry Session Replay does not record, and we do not ask.
• Right to limit the use and disclosure of sensitive personal information. We collect precise geolocation only with your permission and use it to operate the Service (for example, matching nearby Contractors); we do not use sensitive personal information to infer characteristics about you.
• Right to non-discrimination for exercising privacy rights

7.3 European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access, rectify, or erase personal data
• Right to restrict or object to processing
• Right to data portability
• Right to lodge a complaint with a supervisory authority

7.4 Exercising Your Rights

Account deletion (in-app): Signed-in users may delete their account in the Service at Settings → Account Actions → Delete Account. You will be asked to confirm the action before it is processed. Our Account & Data Deletion page lists exactly what is removed and what we are required to keep.

To exercise other rights (including access or portability), contact us at privacy@givingstump.com or through your account settings (for example, Export Data). We will respond to your request within 30 days (or as required by applicable law). We may require verification of your identity before processing certain requests. Some information may be exempt from these rights under applicable law, such as information we are required to retain for legal or business purposes.

8. Cookies and Tracking Technologies

8.1 Types of Cookies We Use

We use cookies, web beacons, pixel tags, and similar tracking technologies to collect and store information about your use of the Service. Types of cookies include:

• Essential Cookies: Required for the Service to function (authentication, security, load balancing)
• Functional Cookies: Remember your preferences and settings (language, region, display options)
• Analytics Cookies (only with your consent): Help us understand how Users interact with the Service (page views, click patterns, session duration)
• Advertising Measurement Cookies (only with your consent): The Meta Pixel measures whether our Facebook and Instagram ads lead to visits, job posts and sign-ups. Meta may also use this information under its own terms, including for its advertising. We do not use cookies to show you ads on our Service.

Session Replay (only with your consent) is not a cookie, but it is covered by the same choice: Sentry keeps a replay identifier in your browser's session storage while it records (see Section 2.2).

8.2 Third-Party Cookies

Third-party services we use may set their own cookies, including:

• Google Analytics for usage analytics (only if you allow it)
• Meta Platforms (the Meta Pixel) for measuring our Facebook and Instagram ads (only if you allow it)
• Stripe for payment processing
• Authentication providers (Google OAuth)

8.3 Cookie Management

Google Analytics and the Meta Pixel are not loaded, and Sentry Session Replay does not record, until you choose "Allow" on the cookie notice, and none of them run when your browser sends Global Privacy Control. Error reports still reach Sentry either way, without a replay. Until you allow it, error reports are all Sentry receives from your browser, and they leave out the steps that led up to the error. Once you allow it, error reports also include those steps (pages, clicks, network requests and console messages), and Sentry also receives a record of each page view (the app version and your browser and device type), performance traces for a sample of page loads and navigations (timings, the network requests and files the page loaded, with query-string values removed apart from simple settings such as page numbers, and how quickly the page responded to clicks and typing), and counts of reports your browser could not send. Vercel Web Analytics and Speed Insights run for every visitor and do not set cookies. Your choice is stored in your browser. You can change it at any time:

You can also control cookies through your browser settings. Most browsers allow you to refuse or delete cookies, but doing so may limit your ability to use certain features of the Service. You can also opt out of certain third-party cookies through industry opt-out tools such as the Network Advertising Initiative or Digital Advertising Alliance.

9. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary based on:

• Account Information: Retained while your account is active and for a reasonable period after account closure for legal and business purposes
• Transaction Records: Retained for at least 7 years to comply with tax, accounting, and financial regulations
• Legal Requirements: Retained as required by applicable laws, regulations, or legal processes
• Dispute Resolution: Retained until disputes are resolved and applicable appeal periods expire
• Contractor Credentials: Retained while the Contractor account is active and for verification purposes

When we no longer need your personal information, we will securely delete or anonymize it, except where we are required to retain it for legal or legitimate business purposes.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

11. International Data Transfers

The Service is operated from the United States. If you are located outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

By using the Service, you consent to the transfer of your information to the United States and other countries, which may have different data protection laws than your country of residence. We implement appropriate safeguards, such as standard contractual clauses, to protect your information when transferred internationally.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on the Service with a new last-updated date and document version
• Sending an email notification to the address associated with your account
• Displaying a prominent notice on the Service

Your continued use of the Service after such modifications constitutes your acceptance of the updated Privacy Policy. If you do not agree to the changes, you should discontinue use of the Service and may delete your account.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

GivingStump, Inc.
Privacy Officer
Email: privacy@givingstump.com
Support: support@givingstump.com
Website: www.givingstump.com

For users in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority if you believe we have not addressed your privacy concerns adequately.