Privacy Policy

This policy says what ConFacts LLC ("ConFacts", "we") collects about you when you use con-facts.com, what we do with it, and the choices you have. In short: we collect what it takes to run your account and your reports, we never sell it, and the site carries no advertising trackers.

What we collect

When you sign in

Google tells us your Google account id, your email address and whether Google has verified it, your name, and the address of your profile picture. We keep these with the dates you joined and last signed in. We never see your Google password.

If the link that brought you to the site carried campaign tags, the account you create keeps them, with the page you first landed on, so we can tell which campaigns bring people who sign up and pay. They are set once, when the account is created.

When you run a report

The licence number or company name you search, the reports you have pulled, when you pulled and last opened each one, and whether it finished. Together they are your My reports list.

When you pay

Stripe handles the payment. We keep the ids Stripe gives your customer record and your checkout, what you bought, the amount, its status and any refund, and your credit balance. Your card number never reaches us.

When you visit

Each page view is counted as an event: the page, the site that sent you (its domain only, never the full address), the campaign tags in the link you followed, if it had any (utm_source, utm_medium, utm_campaign, utm_content, utm_term), and whether you are browsing inside an app such as Instagram or Facebook (one word for the kind of browser, never its full description). A page view carries no cookie, no visitor id and no IP address, so it can't be tied to you. If a page hits an error, we record the error so we can fix it.

To keep the site working

To limit abuse, we count how many reports each network address starts. Those counts are deleted within an hour. A name search made while signed out is tied to your network by a one-way code for up to two hours, so that only you can pick from its results. Our host keeps server logs, which can include your IP address, for a limited time. Sentry, our error tracker, receives technical details of errors, and is set not to receive IP addresses or what you typed.

Cookies and browser storage

These are all needed for the site to work. We use no advertising cookies and no third-party analytics. When you pay, Stripe's payment box may set its own cookies to prevent fraud. The site's fonts load from Google Fonts, which, like any server your browser fetches from, receives your IP address.

How we use it

• to sign you in, run your reports and keep your list of them;
• to take payment, keep your credit balance and answer questions about a charge;
• to count, in totals, which pages and campaigns bring visitors, sign-ups and purchases, so we know what works;
• to keep the site secure, stop abuse and fix errors;
• to answer you when you write to us, and to meet our legal and tax duties.

We don't send marketing email. We don't sell your personal information, and we don't share it for advertising that follows you across other sites and apps.

Who processes it for us

• Railway hosts the site and its databases.
• Google provides sign-in and the site's fonts.
• Stripe processes payments.
• Sentry receives reports of errors.
• Cloudflare runs a check that tells a person from a bot on signed-out searches, when that check is switched on.

To build a report we also ask other sources about the contractor: state and federal records, manufacturers' directories, Google, Brave Search, and Anthropic's AI, which reads the records and the contractor's website. Those requests are about the contractor. They don't include your name, your email or your payment details.

We may also disclose information when the law requires it, to protect someone's safety or our rights, or to a buyer of the business, who would be bound by this policy.

Information about contractors

Reports are about businesses. They include what public records say about a licence and the people the state lists on it, such as a qualifier or an officer, and what the business says about itself on its website and listings. That information comes from public records and public pages. If you are named in a report and something in it is wrong, write to office@con-facts.com and we will check it against the issuing record.

How long we keep it

• Your account and your list of reports: until you ask us to delete your account.
• Payment records: as long as tax and accounting law requires, usually seven years, even after your account is deleted.
• Sign-in sessions: until they expire, 90 days at most.
• Abuse counts: an hour. The signed-out name-search code: two hours.
• Page-view counts: they hold nothing that identifies you.

Your choices and rights

You can remove a report from My reports at any time, and sign out to end your session. To see what we hold about you, correct it, or delete your account, write to office@con-facts.com from the email address on your account. We answer within 45 days, and we won't treat you differently for asking.

If you live in California, you have the right to know what personal information we collect, use and disclose; to have it deleted; to have it corrected; and to opt out of its sale or sharing, which we don't do. Someone you authorise can make a request for you.

Children

ConFacts is not meant for children. We don't knowingly collect personal information from anyone under 18. If you believe a child has signed up, write to us and we will delete the account.

Security

Connections to the site are encrypted. We store sign-in sessions only as one-way codes, never the session itself, and card details never reach us. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

Changes

When this policy changes, the date at the top changes with it. If a change matters, we will say so on the site before it takes effect.

Contact

ConFacts LLC, San Francisco, California. office@con-facts.com