Privacy Policy

This Privacy Policy explains how Aden Ennis dba ListPaver (“ListPaver,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with the ListPaver website, applications, and related services (the “Service”). ListPaver is operated from and intended for users in the United States.

1. Information We Collect

• Account information — name, email address, password, role (general contractor or trade), language preference, and similar details you provide at signup or in your profile.
• Business information — business name, address, service areas, trades offered, team members, and portfolio content.
• License and verification information — license numbers, certificates of insurance (COIs), declarations pages, policy numbers, named insureds, and supporting documents you submit to verify your business. Treated as confidential records, not public marketing material — see §6 below.
• COI access logs— when another user (e.g. a general contractor you invited or who accepted your bid) views your full Certificate of Insurance, we record the viewer’s account ID, the timestamp, and the IP address and user-agent of the request. Subcontractors can review their own access log.
• Usage data — pages viewed, features used, referrers, and similar product analytics collected via PostHog and similar tools.
• Payment data — subscription and billing details are processed by our payment processor (Stripe). We do not store full payment card numbers; we receive limited information such as last four digits, card brand, and billing status.
• Message content — messages, attachments, bids, job details, and other communications you send through the Service, which we process to deliver platform features.
• Device and security data — IP address, browser type, device identifiers, approximate location, timestamps, and logs, used for security, fraud prevention, and troubleshooting.

2. How We Use Information

• To provide, operate, and maintain the Service;
• To verify accounts and prevent fraud, abuse, and policy violations;
• To measure, analyze, and improve the Service and develop new features;
• To send transactional communications (billing, security, and service updates) and, where permitted, marketing communications you can opt out of at any time;
• To comply with legal obligations and enforce our Terms.

3. How We Share Information

We share information only as described below:

• Service providers — Stripe for subscription billing, Supabase for hosting, authentication, and database infrastructure, and PostHog for product analytics. These providers are bound by contract to use the information only for the services they provide to us.
• Other users — information you choose to share through your profile, listings, bids, or messages is visible to other users as designed by those features.
• Legal and safety — we may disclose information when we believe, in good faith, that disclosure is required by law, legal process, or to protect the rights, property, or safety of ListPaver, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to continued protection.

We do not sell your personal information.

4. Your Rights and Choices

Depending on where you live, you may have rights with respect to your personal information, including the right to access, correct, delete, or obtain a portable copy of it, and to opt out of certain uses. California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. Although ListPaver is US-only, we extend reasonable access, correction, and deletion rights to all users as a matter of policy.

You can manage most account information from your settings. To exercise other rights, email us at support@listpaver.com. You can opt out of marketing communications at any time via the unsubscribe link in those emails or by contacting us. We may need to verify your identity before honoring certain requests.

5. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Service, and as required to comply with our legal obligations, resolve disputes, enforce agreements, and maintain business records. When information is no longer needed, we delete or de-identify it. COI access logs are retained for the life of your account plus seven (7) years to support insurance, audit, and dispute resolution; logs are accessible to the subcontractor whose COI was viewed.

6. Insurance Documents and Verification Records

Insurance documents are sensitive business records, not public credentials. ListPaver handles them in tiers:

• Public profile— only a redacted summary is visible: insurance carrier, coverage tier (rounded to a band such as “$1M–$2M”), expiration month and year, and the date ListPaver verified the document. Policy numbers, declarations pages, named-insured home addresses, premium amounts, EIN/SSN, and the full COI image are never published publicly.
• Gated release to GCs — the full COI is released only to a general contractor who has invited you to bid or accepted one of your bids. Releases generate a short-lived link, are logged, and are visible to you in your account.
• Home-address opt-in — for contractors whose business address is a home, the street address is hidden from GCs by default and only displayed with a specific opt-in. City, state, and ZIP remain visible to GCs you have an accepted bid with so they can confirm jurisdictional service area.
• Click-through consent — at the time you upload a COI, you affirmatively consent to the redacted public-profile display described above. That consent is stored with a timestamp.
• ACORD forms — ACORD-branded certificates remain the property of ACORD and are displayed under fair-use principles solely for verification purposes. We do not republish ACORD forms in marketing or training datasets.

ListPaver is not an insurance broker, underwriter, or licensed insurance producer within the meaning of California Insurance Code §1631 et seq. Verification is a documentation review against the records you upload at a point in time. It is not a guarantee of current coverage, payment of premium, or the carrier’s acceptance of any claim. Always confirm coverage directly with the issuing carrier before contracting.

7. Security

We use administrative, technical, and physical safeguards designed to maintain a level of security appropriate to the nature of the information we handle, consistent with our duty under California Civil Code §1798.81.5. Measures include encryption in transit (TLS), encryption at rest for stored documents, role-based access controls, row-level database authorization, short-lived signed URLs for sensitive document access, audit logging, and ongoing monitoring. We restrict access to verification records (including COIs) to the specific account holder, related counterparties as described in §6, and authorized ListPaver personnel with a documented need to review. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Under California Civil Code §1798.150, California residents whose nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of a business’s violation of the duty to implement and maintain reasonable security procedures and practices may have a private right of action. We take this duty seriously and will notify affected users in accordance with applicable breach-notification law if a qualifying incident occurs.

8. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage, and secure the Service. You can manage cookies through your browser. Blocking some cookies may affect how the Service works.

9. Children’s Privacy

ListPaver is not intended for anyone under 18. We do not knowingly collect information from children under 18. If you believe a child has provided us information, contact us and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice (for example, by email or in-app notice). Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For questions about this Privacy Policy or our data practices, contact Aden Ennis dba ListPaver at support@listpaver.com or 130 Stanford Ct, Irvine, CA.