1. Who we are
Preposal is the service this policy covers. For anything in this document, write to support@preposal.io.
Where this document says a firm, it means a business with a Preposal account. Where it says a client, it means somebody that firm sends a proposal to.
Preposal is a service of Vividly Built Inc., which is the company responsible for the information described here.
2. What a firm gives us
Because they chose to, in order to use the product:
- The account. Name, email address, and a password stored only as a PBKDF2 hash. If they sign in with Google instead, we receive the email address, name and profile picture Google gives us, and never a password. The picture is copied into their profile where that has none of its own, appears on the proposals they send, and can be changed or removed in their settings.
- The firm's own details. Business name, address, phone, logo, brand colour, the credentials shown on a proposal. All of it is published to that firm's clients on the proposals it sends, which is the reason it is collected.
- Their pricing and their work. Services, rates, rules, estimates, payments recorded against a job. This is the firm's commercial information and we treat it as theirs.
- That they agreed to this. When an account is opened we record which versions of the Terms of Service and this policy were in force, the exact sentence shown on the screen, the time, the IP address and the browser's user agent string. It is kept for as long as the account exists, because it is the record of the agreement the account runs on. It goes when the account goes.
3. What a firm's clients give us, without meaning to
This is the section worth reading. A firm enters its clients' details, and we record how those clients read what they were sent.
- Details the firm typed. A client's name, postal address, email address, phone number, and any notes the firm wrote about them.
- How they read the proposal. Every time a proposal link is opened we record the time, the IP address, the browser's user agent string, the city, region, postal code and approximate coordinates the network reports, how long the page was open, which parts were looked at, and whether the prices came into view. The firm sees all of this, and it is the reason the firm can tell whether a proposal was read. The location comes from the network the reader is on, not from their device: it is accurate to a town rather than to an address, and nobody is ever asked to share a location.
We do not sell any of it, we do not use it to advertise, and we do not use one firm's information to do anything for another firm. It exists so the firm that sent the proposal knows what happened to it.
A member of the firm opening their own proposal is discarded before anything is written, so a firm previewing its own work does not appear in its own figures.
4. Cookies, and what happens whether you answer or not
Some of this is not a choice, and saying so plainly is fairer than a banner that implies everything is.
Always on
These are what the service is made of. There is no version of it that works without them, so there is nothing here to opt out of short of not using it.
- pp_session, one cookie, set when somebody signs in. It holds a signed token and nothing else, it is HttpOnly and Secure so no script can read it, and it ends after thirty days without a visit and in any case a year after you signed in.
- pp_email, if you start signing up from the homepage. The address you type there is held in your browser for one hop so the signup page opens with it already filled in, and it is deleted as soon as it is read. It is session storage rather than a cookie, so closing the tab ends it, and it never reaches us except as the address you then submit.
- The ordinary record of a request. Our host, Cloudflare, sees and keeps for a short period what every web server sees: the IP address a request came from, the browser that made it, the page asked for and the time. It is what makes it possible to keep the service up, to block an attack and to work out why something broke. No cookie is involved and we do not build a profile out of it.
- Error reports. When something fails, Sentry receives the fault so we can fix it. It is configured not to attach personal information.
- What you typed in, because you typed it in. Your firm, your catalogue, your clients and your estimates. Sections 2 and 3 are about those.
Only if you allow it
Microsoft Clarity, on our marketing pages, and nothing else. Section 5 says what it does. How we ask depends on where you are, because the law is not the same in both places:
- In the EU, the UK, the EEA and Switzerland, nothing is loaded until you press Accept. Saying nothing is the same as saying no. If we cannot tell where you are, you get this one.
- Everywhere else, it loads and the bar tells you so on the same page view, which is the notice the law asks for. Press Decline and we stop it and clear the two cookies it sets.
We honour Global Privacy Control everywhere. If your browser sends that signal, analytics does not run and you are not asked, wherever you are, not only in the states that require it of us.
Your answer is kept in your own browser's local storage rather than in a cookie, andCookies in the footer of those pages brings the question back whenever you want to change it.
Never
No cookie of any kind is set on a proposal page. A client reading a price a firm sent them is not given one, is not measured by Clarity, and is not asked anything, because there is nothing to ask about. We do not sell or share anything with anybody for advertising, and there is no advertising network anywhere on this product.
5. Analytics
Our public marketing pages only can load Microsoft Clarity, which records anonymised interaction with the page, where a pointer went and what was read, so we can see which parts of it are worth keeping. It is not present in the app, and it is not present on any proposal page.
It sets two cookies of its own, _clck and _clsk, and section 4 says when it is allowed to. Declining stops it and expires both. Blockingclarity.ms in your browser as well costs you nothing else on the site.
6. Who else sees it
We use other companies to run the service. Each gets only what it needs to do its job, and none of them is permitted to use it for anything else.
- Preposal's own staff. We keep one internal support tool that lets named members of our own staff look at a firm's account, correct something in it, and open the firm's own screens as one of its people in order to help. It is limited to named staff accounts, it needs a password typed again each time it is opened, and every single thing read or changed through it is recorded with who did it and when, including which account they were signed in as. Anyone signed in through it sees a banner on every screen saying so. It is used to support and run the service, and for nothing else. We do not use it to read a firm's work for any other purpose, and we never enter a firm's account to act on its behalf commercially.
- Cloudflare hosts the application and stores the database.
- Resend delivers the emails the product sends.
- Sentry receives error reports so we can fix faults. It is configured not to attach personal information to them.
- Google handles sign-in for anyone who chooses it, supplies Street View imagery for an address a firm looks up, and provides the model that reads a property description. An address a firm types is sent to Google for those features.
- RentCast answers property lookups for an address a firm enters.
- Microsoft receives Clarity data from the marketing homepage only, as described above.
- Public economic data comes from the Federal Reserve Bank of St. Louis, the US Census Bureau and Freddie Mac. Those are requests for published figures and carry nothing about anybody.
A firm may optionally add a Google Chat webhook of its own, in which case notifications it has asked for are posted to the space it chose.
We will hand information to a court or a regulator where we are legally required to. If the business is ever sold, accounts move with it, and we will say so beforehand.
7. The benchmark for a trade
Every firm wants to know whether its win rate is normal, whether it discounts more than everybody else, and whether an estimate takes everybody as long to get out of the door. No firm can see another firm's book. We can, so we publishone median per trade and it is the only thing we ever publish.
Four figures, and no others:
- the middle won job, at what it was signed for;
- jobs won out of jobs decided;
- days from an estimate's first save to its link going out;
- how far quotes move between what was quoted and what was signed.
Nothing published is ever one firm's. A figure is published only when at least five firms are behind it, and the rule is applied when the figure is computed rather than when it is shown, so a smaller group produces no figure at all rather than one somebody has to remember to hide. No firm's own numbers are ever shown to another firm, nothing is broken down finely enough to point at anybody, and no firm, client, project, address or price appears anywhere in it.
We never put two firms' own service names in a column together. One firm calls it "Design development" and the next calls it "Concept & Plans", and they may not be the same work at all. Anything pooled is first matched to a short list of generic, trade-wide descriptions we publish and maintain; a service that does not match one is left out entirely rather than stretched to fit.
What your market charges
Alongside the figures above, the app shows firms on the Pro plan a price rangefor the common kinds of work in their trade and region, so they can see whether they sit above or below it. It has two sources, both set out below. The panel doesnot label which of the two a particular figure came from, and that is a privacy decision rather than an omission: a mark saying "pooled from eight firms in your trade" is a fact about who else is on this platform, printed on a screen a competitor may be reading. The count of firms behind a figure never leaves our side of it.
- Published sources. An AI model with web search reads trade guides, published rate cards and cost surveys and reports a range. Where it cannot find at least two independent sources that actually state prices, no range is published for that kind of work at all. Each kind of work is re-read on a cycle and every reading is kept: what is published is what the recent readings agree on, with the odd ones out dropped, so no single reading decides a figure. The date the figure was last worked out is shown on screen.
- What firms here charge. Once at least five firms in the same trade and region have a price for the same kind of work, that replaces the researched figure, because real prices beat published ones. What is pooled is therate on a firm's own price list, never a client's quote, a project or a job. It is published as a range across those firms and never as anybody's figure, and exactly the same five-firm floor and the same opt-out apply.
You can leave. Tell us and we will take you out, on any plan, and it covers everything on this page: your figures, your rates and your wording all come out at the next rebuild. Leaving does not take away your own access to any of it, because the published figures are anonymous either way and withholding them would be a punishment for a choice we said was yours.
Words we could not match, we count. Where a service on a firm's list matches none of the generic descriptions, we keep the words and a number: how many firms in that trade use that wording. No firm is recorded beside it and no price is attached to it. It is how we learn which kinds of work the list is missing, and it is the only thing about an unmatched service we keep. Turning off the switch below takes a firm out of this too.
The pooled figures are recomputed away from any request. Nothing a firm does in the app reads another firm's rows.
8. Where it is kept, and for how long
Data is stored on Cloudflare's network, which is distributed and includes servers in the United States.
- While an account is open, a firm's own records are kept until the firm deletes them. That is the point of the product: an estimate from two years ago is a record the firm relies on.
- Sign-in sessions last while they are being used: thirty days after the last visit, and never more than a year from signing in. Every one of them stops working the moment a password is changed.
- When an account is closed, tell us and we will delete the firm's records, including everything it held about its clients, within 30 days. Our database keeps a rolling 30 day history that lets us undo a mistake, so a deleted record can persist in that history for up to 30 days after it goes, and no longer.
9. How it is protected
- Everything travels over HTTPS. There is no unencrypted route in.
- Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a random salt. Nobody here can read one, including us.
- Every query in the customer-facing application is scoped to the firm that made it, and that rule is enforced by a test that fails the build rather than by anyone remembering. There are two exceptions and both are described above: the internal support tool in section 6, which reads across firms on purpose and records every access to it, and the trade benchmark in section 7, which is computed away from any request and stores nothing that belongs to any firm.
No system is perfect. If we ever find that information has been exposed, we will tell the firms affected rather than wait to be asked.
10. What you can ask for
Whoever you are, and wherever you live, you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@preposal.io and we will answer within 30 days.
If you are a client rather than a firm, the details we hold about you were entered by the firm that sent you a proposal, and they control them. Asking them directly is usually faster. Ask us and we will act on it and tell them.
11. Children
This is business software. It is not for anyone under 18 and we do not knowingly collect anything about children.
12. Changes
If this document changes in a way that affects what we do with information, we will email account holders before it takes effect rather than quietly changing the date at the top.
13. Email we send you, and what we learn from it
Two kinds of email leave this product and they are treated differently, because they are different things.
Alerts about your own work. A client opened your proposal, a client accepted it, somebody reset a password, somebody was invited to your firm. You get these because you use the product, they are about your own jobs, and there is nothing to unsubscribe from: switching them off is a setting in the app, under Notifications.
Email we decide to send. A nudge that a client has gone quiet, a Monday brief, a note that a link is about to lapse. Every one of these carries anUnsubscribe link and a one-click unsubscribe header that your mail client can use on your behalf. Unsubscribing stops all of them, permanently, for that address, and never expires. It does not touch the alerts about your own work described above, and we say so in the footer of every one.
We send at most one of these per firm every seven days. If a second one qualifies inside that window it is dropped rather than queued.
We do not measure whether you opened an email. There is no tracking pixel in any message we send, and no invisible image of any kind. The only thing we record is whether the button in the email was pressed: the link goes through preposal.io, we count the press against that one message, and you are sent straight on to the page. We keep the fact that the message was sent, whether it was pressed and how many times, and nothing about what you read.
We never sell an address, never rent one, and never send email on behalf of anybody else. Your clients are never sent marketing of any kind by us; the only mail they get is the proposal your firm sent them and anything your firm sends through the app.