Privacy Policy

Effective date: July 22, 2026 · Last updated: July 22, 2026

1. Who we are

This Privacy Policy explains how SKCG Financial Holdings LLC, a Texas limited liability company doing business as HoustonBuilt ("HoustonBuilt," "we," "us," or "our"), collects, uses, shares, and protects information about you when you use the website at houstonbuilt.app, our email communications, and any related service (collectively, the "Service"). For the purposes of GDPR, HoustonBuilt is the "controller" of personal data collected through the Service.

2. What we collect

We collect the following categories of information:

2.1 Information you provide

• Account information: full name, email address, password (stored only as a salted hash), user role (Homeowner or Contractor).
• Contact and job information: phone number (optional), service address(es) for jobs, project descriptions, scope, timelines, budget ranges.
• Contractor profile information: business name, Texas license number and issuing agency, insurance carrier and policy details, years in business, trades offered, portfolio and profile photos, biographical information, service area, hourly or project rates.
• Messages and job content: in-app messages, quotes, milestone descriptions, change orders, reviews, and photos you upload for a job or portfolio.
• Support requests: emails you send us at hello@houstonbuilt.app and any attachments.

2.2 Information collected automatically

• Device and log information: IP address, browser type and version, operating system, device type, referring/exit pages, pages viewed, session timestamps, and diagnostic information (for example, error logs).
• Cookies and similar technologies: as described in Section 6 and in our Cookie Policy.

2.3 Information from third parties

• Payment / KYC data: Stripe collects payment credentials (card, bank account) and identity-verification information directly from you and shares limited status information (for example, "verified," "payout enabled") with us.
• License and insurance verification: we may cross-check license and insurance information you provide against publicly available Texas registries or third-party verification services.

We do not knowingly collect sensitive personal information such as Social Security numbers, government ID numbers, biometric data, or precise geolocation (Stripe may collect some of these directly for identity verification — they are governed by Stripe's own privacy notice).

3. How we collect it

We collect information (a) directly from you when you create an account, submit a job, send a message, upload a photo, contact support, or use any interactive feature; (b) automatically from your device when you visit the Service, through cookies, log files, and similar technologies; and (c) from third parties such as Stripe or public license registries as described above.

4. How we use your information

We use the information we collect to:

1. provide and operate the Service, including matching Homeowners with Contractors, delivering messages, hosting quotes and job details, and displaying portfolios and reviews;
2. process payments through Stripe Connect and enable milestone-based escrow;
3. communicate with you about your account, jobs, quotes, milestone approvals, disputes, and the HoustonBuilt Guarantee;
4. verify Contractor identity, license status, and insurance;
5. detect, investigate, and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service;
6. debug the Service, monitor performance, and improve features (using aggregated analytics via Google Analytics 4);
7. comply with legal obligations, including tax-reporting obligations (for example, Form 1099-K where applicable), lawful requests from government authorities, and record-keeping requirements; and
8. with your consent, send occasional product updates and marketing emails (you can unsubscribe at any time).

5. Who we share it with

We share information only in the ways described below. We do not sell your personal information to third parties. We do not share personal information with third parties for their own advertising or marketing purposes.

5.1 Between users on the Service

• Homeowners see: a Contractor's public profile, business name, trades, service area, photos and portfolio, reviews, license type/number (as displayed on the profile), and insurance status.
• Contractors see: once hired for a job, the Homeowner's name, job address, job description, uploaded photos, messages, and milestone information. Before hire, Contractors see only the information needed to submit a quote (typically neighborhood-level location and job description).

5.2 Service providers (sub-processors)

Each provider is bound by contractual data-protection terms and may only use your information to provide services to us.

5.3 Legal, safety, and enforcement

We may disclose information if we believe in good faith that disclosure is necessary to (a) comply with a legal obligation, subpoena, warrant, or court order; (b) enforce our Terms of Service; (c) detect, investigate, or prevent fraud or security issues; or (d) protect the rights, property, or safety of HoustonBuilt, our users, or the public.

5.4 Business transfers

If HoustonBuilt is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, your information may be transferred to the successor entity, subject to a privacy policy at least as protective as this one.

5.5 With your consent

We may share information for any other purpose with your consent.

6. Cookies and analytics

For full detail, see our Cookie Policy. Briefly, we use the following:

• Essential cookies / local storage: the Supabase authentication token (stored as a session cookie or in local storage) is required to keep you signed in. Without it, the Service cannot function.
• Google Analytics 4 cookies: _ga and _gid are used to measure aggregate site usage (page views, session length, referrers). IP anonymization is enabled. GA4 does not personally identify visitors to us.
• No advertising cookies. We do not run ads on the Service and we do not embed third-party marketing pixels (no Meta pixel, no Google Ads tag, no LinkedIn Insight tag, no TikTok pixel).
• Do Not Track: when your browser sends a Do Not Track ("DNT") signal, we do not load Google Analytics on your session.

7. Data storage & international transfers

Personal information you provide is stored in the United States on Supabase infrastructure (us-east region) and on Netlify's hosting infrastructure. If you access the Service from outside the United States, you understand and consent to your personal information being transferred to and processed in the United States, which may have data-protection laws that differ from those of your country. Where required by law, we use appropriate safeguards for cross-border transfers (for example, Standard Contractual Clauses).

8. Data retention

We keep personal information for as long as we need it to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. In particular:

• Transaction, tax, and job records: up to 7 years, to comply with IRS and Texas tax and record-keeping requirements and to defend against or bring legal claims.
• Account data after deletion: when you close your account, we deactivate it promptly and delete or de-identify your personal information within 90 days, except for information we must retain for legal, tax, fraud-prevention, or dispute-resolution reasons.
• Backups: encrypted backups may retain information for up to 90 days after deletion, after which they are overwritten in the normal backup cycle.
• Marketing lists: until you unsubscribe.

9. Security

We take reasonable, industry-standard measures to protect your information, including:

• encryption of data in transit (TLS 1.2+ for all Service traffic);
• encryption of data at rest inside Supabase-managed Postgres;
• row-level security ("RLS") policies in the database so each user can only access rows that belong to them;
• salted, hashed password storage — we never store, log, or receive your password in plaintext;
• least-privilege access controls for HoustonBuilt personnel;
• periodic review of access logs and security configurations.

No system is 100% secure. You are responsible for keeping your account credentials safe and for notifying us at hello@houstonbuilt.app if you suspect unauthorized access.

10. Your California privacy rights (CCPA/CPRA)

Even though HoustonBuilt is based in Texas and primarily serves Houston-area customers, California residents who access the Service have the following rights under the California Consumer Privacy Act, as amended by the CPRA:

• Right to know: the categories and specific pieces of personal information we have collected about you, the sources, the purposes for which we use it, and the categories of third parties we share it with.
• Right to delete: ask us to delete personal information we have collected about you, subject to legal exceptions (for example, information we must keep for tax or fraud-prevention reasons).
• Right to correct: ask us to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing": we do not sell personal information and we do not share it for cross-context behavioral advertising. There is nothing to opt out of, but the right exists.
• Right to limit use of sensitive personal information: we do not use sensitive personal information for any purpose beyond what is necessary to provide the Service.
• Right to non-discrimination: we will not deny you service, charge different prices, or provide a different level of service because you exercised a privacy right.

To exercise any of these rights, email hello@houstonbuilt.app with the subject line "California Privacy Request." We will verify your identity through your account email before responding. You may also designate an authorized agent to make a request on your behalf (we will require signed authorization).

11. Rights of EU/UK users (GDPR)

The Service is directed to United States users and is not intended for or actively marketed to residents of the European Economic Area, the United Kingdom, or Switzerland. If you nonetheless access the Service from those regions, you may have rights under the EU General Data Protection Regulation ("GDPR") or the UK GDPR, including the right to access, rectify, erase, restrict, or object to processing, the right to data portability, and the right to lodge a complaint with your local supervisory authority. Contact hello@houstonbuilt.app to exercise those rights. Our legal bases for processing are typically performance of a contract with you, our legitimate interests in operating and securing the Service, compliance with legal obligations, and (where applicable) your consent.

12. Other U.S. state rights

Residents of Virginia, Colorado, Connecticut, Utah, Oregon, Texas (Texas Data Privacy and Security Act), and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of certain processing. Send requests to hello@houstonbuilt.app. [ATTORNEY: confirm current list of state privacy statutes in effect on the effective date and whether a formal appeals process must be described here.]

13. Children

The Service is for adults age 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, contact hello@houstonbuilt.app and we will promptly delete the information and close the account.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address on your account or by a prominent notice in the Service at least 30 days before the changes take effect, and we will update the "Last updated" date at the top of this page. Non-material changes take effect when posted.

15. How to contact us

Questions, complaints, or privacy requests:

SKCG Financial Holdings LLC (dba HoustonBuilt)
Attn: Privacy
110 Bagby Street, Apt 53
Houston, TX 77002
Email: hello@houstonbuilt.app