Privacy Policy

Icon Drywall Works Inc, doing business as Icon Builders Co. (“we,” “us,” or “our”), is a licensed California contractor (Lic. #1140320) based in Riverside, CA. This policy describes how we collect, use, and protect information through our website and our business management application (the “Service”).

Depending on how you use the Service, we may collect:

• Account information — name, email address, and password (stored only as a secure cryptographic hash), or your Google sign-in identity if you choose Google login.
• Business records you create — jobs, estimates, invoices, contracts, receipts, photos, employee and vendor records, and related documents you enter or upload.
• Estimate requests — if you submit a request on our website, we collect the contact details and project information you provide so we can respond.
• Payment information — card payments are processed by Stripe. Card numbers are never stored on our servers.
• Bank account and transaction data via Plaid — if you choose to connect a bank account for bookkeeping, we use Plaid Inc. to link your account and retrieve transaction data. See “Bank connections via Plaid” below.

Our bookkeeping feature lets an account holder connect their own business bank account. When you do, you authenticate directly with your financial institution through Plaid Link — we never see or store your bank username or password. Plaid provides us with account details and transaction history, which we use solely to provide bookkeeping, expense categorization, and financial reporting for your own account.

• Bank data is used only for the account holder’s own books. We do not sell it, share it with third parties for marketing, or aggregate it across users.
• Plaid access tokens are encrypted at rest using AES-256-GCM in addition to database-level encryption.
• You can disconnect a linked bank at any time from within the application, which stops further data retrieval.
• Plaid’s handling of your data is governed by the Plaid End User Privacy Policy.

• To provide, operate, and improve the Service.
• To respond to estimate requests and communicate about projects, invoices, and appointments.
• To process payments and maintain accurate business and bookkeeping records.
• To send transactional emails (for example invoices, receipts, and account notifications).
• To comply with legal, tax, and licensing obligations.

We do not sell your personal information.

We rely on a small set of vendors to run the Service: Vercel (application hosting), Neon (encrypted database hosting), Stripe (payment processing), Plaid (bank connections), and Resend (transactional email). Each receives only the data needed to perform its function.

All traffic is encrypted in transit with TLS 1.2 or better. Data is encrypted at rest by our database provider, and sensitive credentials such as Plaid access tokens are additionally encrypted at the application level. Passwords are stored only as secure hashes. Every data query is scoped to the authenticated account owner, and administrative access to our systems is protected by multi-factor authentication.

We retain your data while your account is active and as required for legal, tax, and accounting purposes. You may request deletion of your account and associated data by contacting us at the email below; we will honor verified requests except where retention is required by law (for example, financial records subject to tax requirements).

Depending on where you live (including under the California Consumer Privacy Act), you may have the right to access, correct, export, or delete your personal information. To exercise any of these rights, contact us using the details below and we will respond within the time required by applicable law.

The Service is intended for business use and is not directed to children under 13.

If we make material changes, we will update the effective date above and, where appropriate, notify account holders by email or in the application.