1. Who we are
Preposal is the service this policy covers. For anything in this document, write to support@preposal.io.
Where this document says a firm, it means a business with a Preposal account. Where it says a client, it means somebody that firm sends a proposal to.
Two roles. For a firm's own account and the people who use it, we decide what is collected and why. For a firm's clients, the firm decides: it enters their details and sends them proposals, and we hold that information on the firm's behalf and use it only to run the service for that firm. Under California law we are the firm's service provider for it; under European law, its processor.
Preposal is a service of Vividly Built Inc., which is the company responsible for Preposal and for the information it decides to collect.
2. What a firm gives us
Because they chose to, in order to use the product:
- The account. Name, email address, and a password stored only as a PBKDF2 hash. If they sign in with Google instead, we receive the email address, name and profile picture Google gives us, and never a password. The picture is copied into their profile where that has none of its own, appears on the proposals they send, and can be changed or removed in their settings.
- The firm's own details. Business name, address, phone, logo, brand colour, the credentials shown on a proposal. All of it is published to that firm's clients on the proposals it sends, which is the reason it is collected.
- Their pricing and their work. Services, rates, rules, estimates, payments recorded against a job. This is the firm's commercial information and we treat it as theirs.
- Billing. For a paid plan: the billing email, company name, billing address and tax ID, and which plan was bought. The card itself is entered on Stripe's page and goes to Stripe, never to us.
- How the account is used. When somebody signed in last, and the town, region and approximate coordinates the network reported for that visit, kept as one latest position rather than a history. A log of actions in the account, such as saving or sending an estimate, with the IP address each came from. We use these to keep accounts secure, to support firms and to see how the product is used.
- That they agreed to this. When an account is opened, and when a change to these documents is accepted, we record which versions of the Terms of Service and this policy were in force, the exact sentence shown on the screen, the time, the IP address and the browser's user agent string. It is kept for as long as the account exists, because it is the record of the agreement the account runs on. It goes when the account goes.
People who ask for access before they have an account give us their email address, firm name and country, and we record the browser's user agent string. It is kept for 24 months.
3. What a firm's clients give us, without meaning to
This is the section worth reading. A firm enters its clients' details, and we record how those clients read what they were sent.
- Details the firm typed. A client's name, postal address, email address, phone number, and any notes the firm wrote about them.
- How they read the proposal. Every time a proposal link is opened we record the time, the IP address, the browser's user agent string, the city, region, postal code and approximate coordinates the network reports, how long the page was open, which parts were looked at, and whether the prices came into view. The firm sees all of this, and it is the reason the firm can tell whether a proposal was read. The location comes from the network the reader is on, not from their device: it is accurate to a town rather than to an address, and nobody is ever asked to share a location. Every proposal page links to this section from its footer.
- What they send back. A message asking for a change, which is kept and emailed to the firm. If they accept, the time, the IP address, the option and total they accepted and the exact wording they were shown, and we email them a copy.
- Whether they want the firm's email. If a client unsubscribes from a firm's email, or their address bounces or reports it as spam, we keep that address on that firm's do-not-email list, so the firm cannot write to them through us again.
We do not sell any of it, and we do not use it to advertise. A client's details are used only for the firm that entered them. The one thing that crosses between firms is described in section 7: anonymous trade figures built from firms' own prices and results, never from anything about a client as a person.
A member of the firm opening their own proposal is discarded before anything is written, so a firm previewing its own work does not appear in its own figures.
4. Cookies, and what happens whether you answer or not
Some of this is not a choice, and saying so plainly is fairer than a banner that implies everything is.
Always on
These are what the service is made of. There is no version of it that works without them, so there is nothing here to opt out of short of not using it.
- pp_session, one cookie, set when somebody signs in. It holds a signed token and nothing else, it is HttpOnly and Secure so no script can read it, and it ends after thirty days without a visit and in any case a year after you signed in.
- pp_oauth, for ten minutes while somebody signs in with Google. It carries the state of that one sign-in so the reply from Google can be checked, and it is deleted when the sign-in finishes.
- pp_tower, pp_look and pp_back, set only for our own staff while they use the support tool in section 6.
- pp_email, if you start signing up from the homepage. The address you type there is held in your browser for one hop so the signup page opens with it already filled in, and it is deleted as soon as it is read. It is session storage rather than a cookie, so closing the tab ends it, and it never reaches us except as the address you then submit.
- lastSignIn, in your browser's local storage: whether you last signed in with Google or a password, so the sign-in page can offer that first. Nothing else is in it.
- Settings inside the app. Once you are signed in, the app keeps small preferences in your browser, such as which panels you left open and the map layer you chose, and a cache of map positions for your clients' addresses so the dashboard map loads quickly. All of it is removed from the browser when you sign out.
- The ordinary record of a request. Our host, Cloudflare, sees and keeps for a short period what every web server sees: the IP address a request came from, the browser that made it, the page asked for and the time. It is what makes it possible to keep the service up, to block an attack and to work out why something broke. No cookie is involved and we do not build a profile out of it.
- Error reports. When something fails, Sentry receives the fault so we can fix it. It is configured not to attach personal information.
- What you typed in, because you typed it in. Your firm, your catalogue, your clients and your estimates. Sections 2 and 3 are about those.
Google sign-in only loads Google's own script when you press the Google button. From then on Google's own cookies and privacy policy apply to that sign-in.
Only if you allow it
PostHog analytics, on our website, the sign-up and sign-in pages and inside the app, and nothing else. Section 5 says what it does. We ask once, in the bar on our homepage, and every page follows that answer. How we ask depends on where you are, because the law is not the same in both places:
- In the EU, the UK, the EEA and Switzerland, nothing is loaded until you press Accept. Saying nothing is the same as saying no, on every page. If we cannot tell where you are, you get this one.
- Everywhere else, it loads and the bar tells you so on the same page view, which is the notice the law asks for. Press Decline and we stop it on every page.
We honour Global Privacy Control everywhere. If your browser sends that signal, analytics does not run, wherever you are and even if you said yes before, and you are not asked.
Your answer is kept in your own browser's local storage, under preposal.cookies, rather than in a cookie, with the date you gave it, and we ask again after twelve months. Your privacy choices in the footer of our homepage brings the question back whenever you want to change it.
Never
No cookie of any kind is set on a proposal page. A client reading a price a firm sent them is not given one, nothing is stored on their device, they are not measured by PostHog, and they are not asked anything, because there is nothing to ask about. There is no advertising network anywhere on this product.
5. Analytics
We use PostHog to see how our website and the app are used: which pages are read, where people click, where they get stuck, and roughly where visitors are, to the city, worked out from the network address a request comes from. It can also record a visit as a replay of the page, showing what was clicked and how the page scrolled. It runs on our website, the sign-up and sign-in pages and inside the app. It isnever present on a proposal page.
Inside the app, every word on the screen is hidden before anything is sent, in replays and in clicks alike, so the names, addresses and prices on it never reach PostHog. We see where people clicked, not what they read. Anything typed into a form is hidden everywhere. When you are signed in, what is sent is tied to a number for your account and your firm, never your name or your email.
It sets no cookie. It keeps an identifier in your browser's local storage, under keys beginning ph_, and declining stops PostHog and removes them. PostHog keeps what it receives for up to a year.
6. Who else sees it
We use other companies to run the service. Each gets only what it needs to do its job, under its own terms for handling that data.
- Preposal's own staff. We keep one internal support tool that lets named members of our own staff look at a firm's account, correct something in it, and open the firm's own screens as one of its people in order to help. It is limited to named staff accounts, it needs a password typed again each time it is opened, and every single thing read or changed through it is recorded with who did it and when, including which account they were signed in as. Anyone signed in through it sees a banner on every screen saying so. It is used to support and run the service, and for nothing else. We do not use it to read a firm's work for any other purpose, and we never enter a firm's account to act on its behalf commercially.
- Cloudflare hosts the application and stores the database.
- Stripe takes payments. It receives the owner's email, the firm's billing details and the card, and handles the card itself.
- Resend delivers the emails the product sends, including the ones a firm sends its clients, and tells us when one bounces or is reported as spam.
- Sentry receives error reports so we can fix faults. It is configured not to attach personal information to them.
- Google in four ways:
- sign-in, for anyone who presses the Google button;
- maps and Street View: addresses a firm types, and its clients' addresses, are sent to Google to find them on a map and to show a picture of the property;
- its Gemini AI model, which drafts a follow-up email when a firm asks for one, reads a property description for an address, works out a driving distance between two towns, and matches a firm's service names to generic kinds of work. For a draft it is sent the client's name, the project, the firm's and the rep's names and any note the client wrote; it is never sent how the client read the proposal. We use Google's paid service, under which Google does not use what it is sent to train its models;
- Google Chat, where our own team is told when a new firm signs up, with the firm's name, trade and size. A firm can also add a Google Chat space of its own, and then the notifications it asked for are posted there.
- RentCast answers property lookups for an address a firm enters.
- PostHog receives the analytics described in section 5 and stores it in the United States.
- Public economic data comes from the Federal Reserve Bank of St. Louis, the US Census Bureau and Freddie Mac. Those are requests for published figures. The Census Bureau is sent a ZIP code and nothing else.
We will hand information to a court or a regulator where we are legally required to. If the business is ever sold, accounts move with it, and we will say so beforehand.
7. The trade comparisons
Every firm wants to know whether its win rate is normal, whether it discounts more than everybody else, and whether an estimate takes everybody as long to get out of the door. No firm can see another firm's book. We can, so we publish anonymous medians for each trade, nationally and for each state.
Four figures, and no others:
- the value of the middle won job, at what it was signed for;
- jobs won out of jobs decided;
- days from an estimate's first save to its link going out;
- how far quotes move between what was quoted and what was signed.
Nothing published is ever one firm's. A figure is published only when at least five firms are behind it, and the rule is applied when the figure is computed rather than when it is shown, so a smaller group produces no figure at all rather than one somebody has to remember to hide. No firm's own numbers are ever shown to another firm, nothing is broken down finely enough to point at anybody, and no firm, client, project, address or single job's price appears anywhere in it.
We never put two firms' own service names in a column together. One firm calls it "Design development" and the next calls it "Concept & Plans", and they may not be the same work at all. Anything pooled is first matched to a short list of generic, trade-wide descriptions we publish and maintain; a service that does not match one is left out entirely rather than stretched to fit.
What your market charges
Alongside the figures above, the app shows firms on the Pro plan a price rangefor the common kinds of work in their trade and region, so they can see whether they sit above or below it. It has two sources, both set out below. The panel doesnot label which of the two a particular figure came from, and that is a privacy decision rather than an omission: a mark saying "pooled from eight firms in your trade" is a fact about who else is on this platform, printed on a screen a competitor may be reading. The count of firms behind a figure never leaves our side of it.
- Published sources. An AI model with web search reads trade guides, published rate cards and cost surveys and reports a range. Where it cannot find at least two independent sources that actually state prices, no range is published for that kind of work at all. Each kind of work is re-read on a cycle and every reading is kept: what is published is what the recent readings agree on, with the odd ones out dropped, so no single reading decides a figure. The date the figure was last worked out is shown on screen.
- What firms here charge. Once at least five firms in the same trade and region have a price for the same kind of work, that replaces the researched figure, because real prices beat published ones. What is pooled is therate on a firm's own price list, never a client's quote, a project or a job. It is published as a range across those firms and never as anybody's figure, and exactly the same five-firm floor and the same opt-out apply.
Every firm is included unless it asks to leave. You can leave. Tell us and we will take you out, on any plan, and it covers everything in this section: your figures, your rates and your wording all come out at the next rebuild. Leaving does not take away your own access to any of it, because the published figures are anonymous either way and withholding them would be a punishment for a choice we said was yours.
Words we could not match, we count. Where a service on a firm's list matches none of the generic descriptions, we keep the words and a number: how many firms in that trade use that wording. No firm is recorded beside it and no price is attached to it. It is how we learn which kinds of work the list is missing, and it is the only thing about an unmatched service we keep. Leaving takes a firm out of this too.
The pooled figures are recomputed away from any request. Nothing a firm does in the app reads another firm's rows.
8. Where it is kept, and for how long
Data is stored on Cloudflare's network, which is distributed and includes servers in the United States, and the companies in section 6 are based in the United States. If you are in Europe or the UK, your information is transferred there under the standard contractual clauses in those companies' data processing terms.
- While an account is open, a firm's own records, its clients and its estimates are kept until the firm deletes them. That is the point of the product: an estimate from two years ago is a record the firm relies on.
- How a proposal was read. The opens and reading time stay with the estimate. The IP address, browser and location recorded with each open are removed after 24 months, and only the time of the open is kept.
- The log of actions in an account keeps its IP addresses for 24 months, and then drops them.
- Older activity logs move out of the live database after 90 days. They are kept as compressed monthly files in our Cloudflare storage, without any IP address, and are deleted when the firm's account is deleted.
- Our staff support log, which records everything read or changed through the support tool, is kept for 3 years and then deleted, so that any access can be checked afterwards.
- Requests for access are kept for 24 months.
- A do-not-email entry is kept for as long as the firm's account exists, because deleting it would let the firm write to that person again.
- Sign-in sessions last while they are being used: thirty days after the last visit, and never more than a year from signing in. Every one of them stops working the moment a password is changed.
- When an account is closed, tell us and we will delete the firm's records, including everything it held about its clients, within 30 days. Our database keeps a rolling 30 day history that lets us undo a mistake, so a deleted record can persist in that history for up to 30 days after it goes, and no longer.
9. How it is protected
- Everything travels over HTTPS. There is no unencrypted route in.
- Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a random salt. Nobody here can read one, including us.
- Every query in the customer-facing application is scoped to the firm that made it, and that rule is enforced by a test that fails the build rather than by anyone remembering. There are three exceptions and all are described in this document: the internal support tool in section 6, which reads across firms on purpose and records every access to it; the trade comparisons in section 7, which are computed away from any request and store nothing that belongs to any firm; and one shared list of map positions for addresses, which holds an address and its coordinates and nothing about who asked for it.
No system is perfect. If we find that personal information has been exposed, we will tell the firms affected without undue delay and within 72 hours of confirming it, help them tell their clients, and notify regulators and the people affected ourselves wherever the law requires us to.
10. What you can ask for
Whoever you are, and wherever you live, you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@preposal.io and we will answer within 30 days. We check a request comes from the person it is about, usually by replying to the email address we hold. Somebody may ask for you if you have given them written permission. If we turn a request down you can ask us to look at it again, and we will explain the outcome. Nobody is treated differently or charged more for asking.
If you are a client rather than a firm, the details we hold about you were entered by the firm that sent you a proposal, and it decides what happens to them. Asking the firm directly is usually fastest. If you write to us, we pass your request to that firm and act on its answer, and if the firm no longer has an account with us, we deal with it ourselves.
California
In the last twelve months we have collected these categories of personal information, for the purposes given in sections 2 and 3: identifiers (such as a name, email, postal address and IP address); commercial information (plans bought, estimates and their prices); internet activity (how a proposal was read, how the app and the marketing pages were used); approximate location from the network; and professional information (a firm's name, role and credentials). We collect them from firms, from their clients' use of proposals, and from the providers in section 6. We disclose them only to the providers in section 6, for the purposes described there.
We do not sell personal information and we do not use or disclose sensitive personal information. PostHog processes our analytics for us and does not use it for advertising. You can still turn analytics off with Your privacy choicesin the footer of our homepage or with Global Privacy Control. You also have the right to know what we hold, to delete it, to correct it, and not to be treated differently for using those rights.
Europe and the UK
For information we decide to collect, we rely on these legal bases: running the contract with a firm (its account, billing and the service itself); our legitimate interests in keeping the service secure, supporting firms, improving the product and producing the anonymous trade comparisons; consent, for analytics; and legal obligations, such as tax records. You may also object to processing based on our legitimate interests, and complain to your local data protection authority.
11. Children
This is business software. It is not for anyone under 18 and we do not knowingly collect anything about children.
12. Changes
If this document changes in a way that affects what we do with information, we will email account holders before it takes effect rather than quietly changing the date at the top. Earlier versions stay published, word for word, at preposal.io/privacy/ followed by their date.
13. Email we send you, and what we learn from it
Two kinds of email leave this product and they are treated differently, because they are different things.
Alerts about your own work. A client opened your proposal, a client accepted it, somebody reset a password, somebody was invited to your firm. You get these because you use the product, they are about your own jobs, and there is nothing to unsubscribe from: switching them off is a setting in the app, under Notifications.
Email we decide to send. A nudge that a client has gone quiet, a Monday brief, a note that a link is about to expire. Every one of these carries anUnsubscribe link and a one-click unsubscribe header that your mail client can use on your behalf. Unsubscribing stops all of them, permanently, for that address, and never expires. It does not touch the alerts about your own work described above, and we say so in the footer of every one.
We send at most one of these per firm every seven days. If a second one qualifies inside that window it is dropped rather than queued.
We do not measure whether you opened an email. There is no tracking pixel in any message we send, and no invisible image of any kind. The only thing we record is whether the button in the email was pressed: the link goes through preposal.io, we count the press against that one message, and you are sent straight on to the page. We keep the fact that the message was sent, whether it was pressed and how many times, and nothing about what you read.
Email a firm sends its clients through us, such as an estimate or a follow-up, goes out in the firm's name from our address. Each one carries an unsubscribe link and a postal address. A client who unsubscribes is not emailed by that firm through Preposal again. We never sell an address, never rent one, and never send a firm's clients marketing of our own.
14. Getting hold of us
support@preposal.io, for anything in this document, including any request under section 10.
By post: Preposal, 18047 Beach Blvd # 1060, Huntington Beach, CA 92648.