Privacy Policy

This policy explains what New Contractor List (“we”, “us”) does with personal information at www.newcontractorlist.com. It covers two groups of people: contractors listed on the site, whose details come from public licensing records, and people who use the site. Questions go to support@newcontractorlist.com.

Signing in with Google: how we use your Google data

New Contractor List is a subscription service that publishes newly issued US contractor licenses. Signing in with Google is optional, and it is the only thing we use Google APIs for.

• Data accessed: your Google account email address, whether it is verified, your name, your profile picture URL and your Google account ID, through the openid, email and profile scopes. Nothing else: we cannot see your Gmail, contacts, calendar or files.
• How it is used: to create your account, sign you in, send you the emails described below and show your details on your account page.
• How it is stored: in our account database, with the sign-in tokens Google issues, reachable only over encrypted connections and accessible only to the application and its operator.
• How it is shared: it is not sold, rented or shared for advertising. Your email address is passed to Amazon SES only to deliver email to you.
• What it is never used for: advertising, building profiles, determining credit or insurance eligibility, training artificial intelligence or machine learning models, or generating images or other content of any kind.
• Retention and deletion: kept while your account exists. Email support@newcontractorlist.com to delete your account, and your Google data is removed within 30 days.

New Contractor List’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google Account settings.

If you are listed on this site

Our listings come from the licensing records that US states, counties and cities publish. They can include a business name, the name of an owner or qualifier, a license number and type, a business address and zip code, and a phone number and email address where the record publishes them. If you run a business in your own name, some of this may be about you personally. We get it only from those records, and we do not add to it from elsewhere.

• On a public page anyone can see the business name, city, county, license type and date, with the phone, email and license number partly hidden and the street address left out. A name on a license held by a person is masked too.
• With a paid plan or pack a customer can see the full record, including the phone and email the record publishes, and download it. Customers use it to offer services to new contractors, and our terms require them to follow the laws on calls, texts and email.
• Why we use it: to publish and sell a directory of newly licensed contractors, drawn from records the government has made public. In Washington we keep business entities only, and leave sole proprietors out.

Asking us to correct or remove a listing

Use the contact form with the topic “Remove my listing”, or “A listing looks wrong” to correct one, or email support@newcontractorlist.com. Tell us the business name, the state and the license type as the page shows them, so we can find it. You do not need an account. A person reads each request and replies within two business days. If we need to confirm that the listing is yours, we will ask.

• When we remove a listing, it comes off our public pages, the feed, alerts and new exports, and stays out of our later daily reads of that record.
• We cannot recall a copy a customer has already downloaded.
• We do not hold the original. Your entry in the licensing record stays until the office that issued the license changes it, and it can correct the record at its source.

How long a listing stays

We keep a license for as long as it remains useful as a record of who was licensed, including after it lapses, unless you ask us to remove it. A license that is no longer new drops out of the feed’s window and the new-license counts but stays on record. We keep what we need of a removal request to keep the listing out and to show that we honored it.

If you use this site

When you sign in

With an email link, we collect the address you enter and send a one-time link that expires after 15 minutes. There are no passwords. With Google, we request only the standard openid, email and profile scopes and receive your email address and whether Google has verified it, your name and profile picture URL, and a Google account identifier with the sign-in tokens Google issues as part of that exchange. We do not request, and cannot access, your Gmail, contacts, calendar, files or anything else in your Google account.

While you use your account

• Account records: when your account was created, what you subscribe to and a log of account events such as sign-ins.
• Saved feeds and alerts: the filters you save, their names, how often you want alerts and a record of each alert email we send.
• An alert asked for on a page: if you give your address on a place’s page, we keep it with the place and the page you asked from, and email a link that confirms it. Nothing else goes to that address unless the link is followed.
• Session cookie: after you sign in we set a cookie holding a random session identifier, so you stay signed in. Sessions last up to 30 days.
• What you buy: your subscriptions and packs, the scope of each, when you downloaded a pack and how many rows you exported.

When you pay

Checkout happens on a page run by Creem, our merchant of record. You give your card and billing details to Creem, not to us, and we never see or store your card number. Creem tells us the identifiers of your customer record, subscription or order, what it is for, its status and when the current period ends.

When you contact us

Messages through the contact form include the name, email address, topic and message you enter. If you are signed in, the message is linked to your account.

Collected automatically

• Performance measurements: anonymous page-speed metrics and the page path they were measured on, not linked to your account.
• Server logs: the server in front of the site keeps an access log of each request: the IP address it came from, the full web address requested, the browser’s or program’s user agent, the referring page, the time and the response. We use it for security and to understand automated traffic, keep it for a limited time, and then delete it.
• Rate limiting: to stop abuse, we count requests per IP address in Upstash, a hosted store, under an expiring key. The contact form and sign-in links also use your IP address and the address entered, held in memory for up to a day.
• Theme preference: if you choose light or dark mode, the choice is saved in your browser’s local storage and stays on your device.

Product analytics (PostHog)

We use PostHog to understand how the site is used. In your browser, PostHog records the pages you view (including filters in the page address), the links and buttons you click, where you came from, your browser, device type and screen size, an approximate location derived from your IP address, errors in the page, session recordings and heatmaps with what you type into form fields masked, and a random identifier stored in a cookie and local storage.

When you sign in, we link that identifier to your account’s internal ID, not your email address or name, and record events such as an account being created, a checkout being opened and which plan it was for. We do not send PostHog your Google profile, your email address or the contents of messages you send us. PostHog does not use this data for advertising, and you can block it with any common tracker blocker and the site keeps working. We do not use advertising cookies or cross-site tracking.

How we use it

To create and sign in to your account, to send the alerts you turn on and the emails needed to run the service (sign-in links, a welcome message and account notices), to deliver what you bought, to answer you, to protect the service and stop mail to addresses that bounce or report spam, and to measure and improve the site. We do not sell your account information, share it for advertising, or build profiles of you for any other purpose.

Who processes your information

We share account information only with the service providers that help us run the site:

• Amazon Web Services (Amazon SES) delivers our email and tells us when one bounces or is marked as spam.
• Creem processes payments as merchant of record, under Creem’s privacy policy. We send it your email address and account identifier when you start a checkout.
• PostHog provides product analytics, session recordings and heatmaps, as described above.
• Upstash holds the per-address request counts used to limit abuse.
• Google processes your sign-in if you choose Google sign-in, under Google’s own privacy policy.
• Our hosting provider runs the servers and database where the site and your account data are stored.

We may also disclose information if required by law, to protect our rights or the safety of others, or to a successor in a merger or sale of the service.

How long we keep account information

• Account data, saved feeds and alerts are kept while your account exists and deleted when you ask us to delete the account.
• Alert delivery records and account event logs are kept for the life of the account.
• Purchase records are kept for the life of the account, and a pack stays downloadable for 365 days. Creem keeps payment and tax records for as long as the law requires.
• Contact messages, including removal requests, are kept as long as needed to handle the request and keep a record of it.
• An alert asked for on a page whose link was never followed is deleted after 90 days, and that address is not mailed again.
• Sessions and sign-in links are deleted once they expire.
• If an email address bounces or reports our mail as spam, we keep it on a do-not-send list even after account deletion, so we never mail it again.
• Analytics data held by PostHog is kept under PostHog’s retention settings for our project, and session recordings expire automatically. We delete your analytics data with your account when you ask.

Your choices and rights

• Unsubscribe: every alert email has a one-click unsubscribe link, and you can turn any alert off on the Alerts page.
• Access, correction and deletion: email support@newcontractorlist.com from the address on your account and we will send you a copy of your data, correct it, or delete your account and its data. We respond within 30 days.
• A listing about you: see correcting or removing a listing.
• Analytics: blocking PostHog in your browser, or clearing its cookie, stops analytics collection without affecting the site.
• Google access: remove New Contractor List from your Google Account connections. This stops Google sign-in; email us to delete the data we already hold.

Depending on where you live, including California and other US states with privacy laws, you may have further rights under local law. We honor those requests through the same address, and we will not treat you differently for making one.

Security

All traffic to the site is encrypted with HTTPS. Accounts have no passwords to steal; sign-in links expire after 15 minutes and sessions can be revoked on our side. Account data is stored separately from the license listings, with access restricted. No system is perfectly secure, and we will notify affected users of a breach as the law requires.

Children

New Contractor List is a business data service, not directed to children under 16. We do not knowingly collect information from them.

Changes to this policy

If we change this policy we will update the effective date above. If a change materially affects how we use information we already hold, we will tell account holders by email before it takes effect.

Contact

New Contractor List · support@newcontractorlist.com · contact form