Privacy Policy
Estimate Chaser Effective Date: 2026-10-22
This Privacy Policy explains how Estimate Chaser ("Company," "we," "us," or "our") collects, uses, stores, and shares personal data when you use Estimate Chaser ("Service"), available at https://estimatechaser.com.
Estimate follow-ups that send themselves.
We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Data We Collect
1.1 Account & Authentication Data
| Data | Purpose | Basis (GDPR) |
|---|---|---|
| Email address | Account creation, login, communications | Contract performance |
| Name (if provided) | Account personalization | Contract performance |
| OAuth provider ID (Google, GitHub, etc.) | Federated authentication | Contract performance |
| Hashed password (if email/password auth) | Authentication | Contract performance |
| Session token | Maintaining your authenticated session | Contract performance |
Authentication is handled via Neon Auth / Better Auth. Session tokens are stored server-side in our PostgreSQL database.
1.2 Billing Data
| Data | Purpose | Basis (GDPR) |
|---|---|---|
| Stripe customer ID | Link your account to payment records | Contract performance |
| Subscription status & plan | Provision correct feature access | Contract performance |
All payment information (card numbers, billing addresses) is collected and processed exclusively by Stripe. We never receive, store, or transmit your card details. See Stripe's Privacy Policy.
1.3 Product-Specific Data
- Business details: business name, sender name, reply-to email, phone, email signature, time zone and sending preferences.
- Estimates: your customer's name, email and phone, the job title and details, the estimate amount, dates, status, won amount and your notes.
- Follow-up emails: the schedule, subject and text of each email, and when it was sent.
- Customer replies: the sender's address, subject and text of replies to your follow-ups.
- Weekly summary figures, such as open estimates, replies and jobs won.
Legal basis (GDPR): Contract performance — this data is necessary to provide the Service's core functionality.
1.4 Analytics Data (Opt-In Only)
We use PostHog for product analytics. PostHog tracking is disabled by default and only activated if you explicitly opt in via our cookie consent banner. If you accept cookies, we also use Google Analytics (Google) and the Meta Pixel (Meta) to measure visits, sign-ups and purchases. Neither loads unless you accept.
Global Privacy Control (GPC). If your browser sends a Global Privacy Control signal, we treat it as an opt-out of sale or sharing of your personal data for advertising. In that case Google Analytics and the Meta Pixel are never loaded — even if you click Accept on the cookie banner — and only our own product analytics (PostHog) loads after you accept.
When opted in, PostHog may collect:
- Page views and navigation paths
- Custom product events (e.g., feature usage)
- User properties (e.g., subscription plan, account creation date)
- Device type, browser, operating system
- Approximate location (derived from IP; IP is not stored long-term)
Legal basis (GDPR): Consent. You can withdraw consent at any time through the cookie settings accessible in the Service.
1.5 Technical / Automatically Collected Data
| Data | Purpose | Basis (GDPR) |
|---|---|---|
| IP address | Security, abuse prevention, infrastructure routing | Legitimate interest |
| Server logs (request method, URL, status code, timestamp) | Debugging, security monitoring | Legitimate interest |
Server logs are generated by Vercel (edge/serverless hosting) and retained for a limited period as described in Section 5.
1.6 Your customers' information
When you add an estimate, you give us your customer's contact details so the Service can email them on your behalf, under your business name. You are responsible for having a lawful basis to contact them. When a customer replies, we process and store their message to detect the reply, stop the remaining follow-ups, display the reply in your dashboard, and forward it to your inbox. We use your customers' information only to provide the Service to you, and requests about it should go to you as the business that collected it.
2. Cookies & Local Storage
| Cookie / Storage | Type | Consent Required | Purpose |
|---|---|---|---|
| Auth session cookie | Strictly necessary | No | Maintains your login session |
| PostHog analytics cookies | Analytics | Yes — opt-in only | Product analytics (disabled until you consent) |
| Google Analytics cookies | Analytics | Yes — opt-in only | Google Analytics measurement (disabled until you consent) |
| Meta Pixel cookies | Ad measurement | Yes — opt-in only | Meta Pixel ad measurement (disabled until you consent) |
| Theme preference | localStorage | No | Stores your UI theme preference client-side |
Cookie Consent Mechanism
On first visit, analytics cookies are not set. A cookie consent banner is displayed. Analytics tools are only loaded if you actively opt in. You may change your preference at any time via the cookie settings link in the Service. Declining or withdrawing consent does not affect your access to any Service functionality.
Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale/sharing for advertising. If GPC is enabled, advertising and ad-measurement tools (the Meta Pixel, Google Analytics and the Google Ads tag) are never loaded, even if you click Accept. Accepting with GPC enabled only loads our own product analytics (PostHog). The cookie banner tells you when this applies.
3. How We Use Your Data
We use your data to:
- Provide and operate the Service — account management, authentication, core product functionality.
- Process payments — via Stripe; we interact only with Stripe customer IDs and subscription status.
- Improve the Service — if you opt in to analytics, we use aggregated usage data to identify bugs and improve features.
- Communicate with you — transactional emails (password resets, billing receipts, service updates). We do not send marketing emails without separate consent.
- Ensure security — fraud detection, abuse prevention, and infrastructure monitoring.
- Comply with legal obligations — tax records, lawful data requests.
4. Third-Party Services & Data Sharing
We share personal data only with the following categories of service providers, and only as necessary:
| Provider | Data Shared | Purpose |
|---|---|---|
| Vercel | IP address, request metadata | Hosting, edge functions, serverless compute |
| Neon (PostgreSQL) | All application data (encrypted at rest) | Database storage |
| Stripe | Stripe customer ID, subscription events | Payment processing |
| PostHog | Analytics events, device info (if opted in) | Product analytics |
| Analytics events, device info (if you accept cookies and your browser does not send Global Privacy Control) | Google Analytics | |
| Meta | Ad measurement events, device info (if you accept cookies and your browser does not send Global Privacy Control) | Meta Pixel |
| Nori Labs, Inc. (Spelt) and its email provider | your customers' names and emails, follow-up text, replies | Sending follow-ups and forwarding replies. |
Hosting & Sub-processors
This Service is operated by Estimate Chaser (the "Operator"). The Operator uses Nori Labs, Inc. (which operates the "Spelt" platform) to build, host, and maintain the Service on the Operator's behalf. For contractors' own account data, the Operator is the controller and Nori Labs, Inc. is a processor. For homeowner data a contractor enters, the contractor is the controller, the Operator is a processor and Nori Labs, Inc. is a sub-processor. Each processes it only to provide the Service.
The Service relies on the following infrastructure providers and sub-processors:
- Nori Labs, Inc. (Spelt): platform hosting, build, and operational tooling
- Vercel: application hosting and serverless compute
- Neon: PostgreSQL database hosting
- Stripe: payment processing
- PostHog: product analytics (opt-in)
- Google: Google Analytics (opt-in)
- Meta: Meta Pixel (opt-in)
- Resend: transactional email delivery
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
We may disclose data if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Estimate Chaser, our users, or the public.
In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity. We will notify you before your data becomes subject to a different privacy policy.
5. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data | Kept while your account is open, until you ask us to delete it. Backup copies are removed within 24 hours of deletion. |
| Billing records (Stripe customer ID, invoices) | 7 years after last transaction (tax/legal compliance) |
| Product-specific data | Kept while your account is open. To have estimates, customer details or replies removed, email support@estimatechaser.com. Backup copies are removed within 24 hours of deletion. |
| Analytics data (PostHog) | Up to 7 years. Deleted on request. |
| Server logs (Vercel) | A limited period. |
| Email delivery records (Resend) | A limited period. |
| Auth session tokens | Expire after inactivity period; purged on logout or account deletion |
When you close your account through account settings, we close it and cancel billing right away. Your estimates, customer details and stored replies are not removed automatically. Email support@estimatechaser.com to have them deleted; we confirm by email once deletion is complete. Billing records are kept as the law requires.
6. Data Security
We implement industry-standard security measures including:
- Encryption in transit: All data is transmitted over TLS/HTTPS.
- Encryption at rest: Database storage (Neon PostgreSQL) encrypts data at rest.
- Secure authentication: Passwords are hashed using modern algorithms; session tokens are stored server-side.
- Payment security: Stripe is PCI DSS Level 1 compliant. Card data never touches our servers.
- Infrastructure: Vercel serverless architecture minimizes attack surface; no persistent servers to compromise.
- Access control: Internal access to production data is restricted and logged.
No system is 100% secure. If we discover a breach affecting your personal data, we will notify you and relevant authorities as required by GDPR (within 72 hours) and applicable law.
7. Your Rights
Under GDPR (EEA, UK, Switzerland residents)
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion of your personal data.
- Restriction — request that we limit processing of your data.
- Portability — receive your data in a structured, machine-readable format (JSON or CSV).
- Object — object to processing based on legitimate interest.
- Withdraw consent — for any processing based on consent (e.g., analytics), at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint — with your local data protection authority.
Under CCPA (California residents)
You have the right to:
- Know — what personal information we collect, use, and disclose.
- Delete — request deletion of your personal information.
- Opt out of sale — we do not sell your personal information. No opt-out is necessary.
- Non-discrimination — we will not discriminate against you for exercising your rights.
How to Exercise Your Rights
Email us at support@estimatechaser.com with your request. We will verify your identity and respond within 30 days (GDPR) or 45 days (CCPA). For data portability requests, we will provide your data in JSON format.
You can close your account in the Service's account settings. To have your data deleted, email support@estimatechaser.com; we confirm by email once deletion is complete.
8. International Data Transfers
Our infrastructure is hosted in the United States (Vercel, Neon). If you are located outside the US, your data will be transferred to and processed in the US. We rely on:
- Standard Contractual Clauses (SCCs) where required for GDPR compliance.
- Selecting processors (Vercel, Neon, Stripe, PostHog) that maintain appropriate safeguards and certifications.
9. Children's Privacy
The Service is not intended for anyone under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at support@estimatechaser.com and we will delete it promptly.
10. Do Not Track & Global Privacy Control
We do not respond to browser "Do Not Track" signals. We do honor the Global Privacy Control (GPC) signal: when your browser sends it, we treat it as an opt-out of sale or sharing of your personal data for advertising, so advertising and ad-measurement trackers (the Meta Pixel, Google Analytics and the Google Ads tag) are never loaded — even if you accept cookies. With GPC on, only our own product analytics (PostHog) loads, and only after you accept.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days in advance via email or an in-app notice. The "Effective Date" at the top reflects the latest revision. Continued use of the Service after the effective date constitutes acceptance.
12. Data Protection Contact
For any privacy-related questions, requests, or complaints:
Estimate Chaser
Email: support@estimatechaser.com
If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority.