Privacy Policy

Contractor Catalogue (“we,” “us,” or “our”) is an Oregon contractor directory that aggregates public licensing records and allows contractors to claim and enrich their profiles. This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information. By using Contractor Catalogue, you agree to the practices described here.

This is a beta service. We will update this policy as the product evolves and will post notice of material changes on this page.

1. Information you provide

Account registration

When you create an account, we collect your email address and password. You may optionally provide a display name that appears on reviews and other community content you contribute. Display names are public.

Account identity

To verify account identity (for example, before submitting a contractor claim), we may ask for your first and last name. These are used for identity verification purposes and are not displayed publicly on the site.

Phone number for verification

As part of the contractor claim process, we collect your phone number to verify access to a CCB-listed business phone line via one-time passcode (OTP). Phone numbers provided for verification are not displayed publicly. We also use Twilio Lookup, a third-party service, to assess the line type associated with a phone number (for example, mobile versus landline) as part of claim review. See the Third-Party Processors section below.

Contractor-provided profile content

If you claim a contractor profile, you may provide additional business information, portfolio photos, project descriptions, and other marketing content. This content is displayed publicly on your contractor profile.

Reviews and endorsements

Logged-in users may submit reviews (including ratings and written feedback) and endorsements for contractors. Reviews and endorsements, along with any display name you have set, are publicly visible on contractor profiles.

2. Information we collect automatically

Public Oregon CCB records

Contractor Catalogue periodically imports contractor licensing data from the Oregon Construction Contractors Board (CCB) via the Oregon Socrata open-data platform. This includes business names, license numbers, license types, endorsements, bond and insurance information, and registered business addresses. This information is sourced from official public records. It is not collected in real time and may not reflect the current state of a contractor’s license. Users should verify license, bond, and insurance status directly with the Oregon CCB before making any hiring decisions.

Usage and analytics data

We use PostHog to collect anonymous analytics about how the service is used — for example, which pages are visited and which features are used. PostHog analytics data is not used for behavioral advertising. You can learn more about PostHog’s data practices at posthog.com.

Error and performance monitoring

We use Sentry to monitor application errors and performance. Sentry may capture technical details such as browser type, operating system, page URL, and error stack traces. This information is used to diagnose and fix bugs. Sentry may incidentally capture request data relevant to an error event.

3. How we use your information

• To create and manage your account and authenticate your sessions.
• To process and review contractor profile claim requests, including verifying access to a CCB-listed phone number.
• To display contractor profiles, reviews, endorsements, and portfolio content to the public.
• To send transactional emails such as claim status notifications and email address confirmation messages (via Resend).
• To detect and prevent fraud, abuse, impersonation, and policy violations.
• To moderate community-submitted content (reviews, endorsements).
• To improve the service through aggregate analytics.
• To comply with applicable legal obligations.

4. What is public vs. private

The following information is displayed publicly on the site:

• Oregon CCB licensing data (business name, license numbers, status, endorsements, registered address, bond and insurance information)
• Contractor-provided profile content (business description, service areas, portfolio photos and project descriptions)
• Reviews and endorsements, along with the reviewer’s display name (or “Customer” if no display name is set)

The following information is not displayed publicly:

• Your email address
• Your first and last name (used for identity verification only)
• Your phone number (used for claim verification only)
• Your account password (stored as a secure hash by Supabase)

5. Authentication and sessions

Account authentication, session management, and email confirmation are handled by Supabase, a backend-as-a-service platform. Supabase stores your email address and hashed password and manages secure session tokens. When you log in, Supabase issues a session cookie that your browser stores and sends with subsequent requests to keep you signed in.

We use a Supabase authentication session cookie for login state. We do not use tracking cookies for advertising. PostHog may set analytics cookies or use local storage for session identification; these are used only for product analytics, not advertising.

6. File storage

Portfolio photos uploaded by contractors are stored in a public Supabase Storage bucket and delivered via Supabase’s CDN. Because this bucket is public, portfolio photos are accessible to anyone with the storage URL. Only authenticated business editors may upload or delete photos for a given business profile.

7. Third-party processors

We work with the following third-party service providers who may process information on our behalf:

8. Data retention

We retain information for as long as reasonably necessary to operate, secure, moderate, and improve the service; comply with applicable legal obligations; resolve disputes; prevent fraud and abuse; and maintain appropriate records. The appropriate retention period varies by type of data and the purposes for which it is processed. We do not retain data longer than necessary for these purposes.

9. Deletion and privacy requests

Self-service account deletion is not currently available in this beta. If you would like to request deletion of your account or personal information, or have another privacy-related request, please contact us at the address listed in the Contact section below. We will honor deletion requests subject to information that must reasonably be retained for security, moderation, legal compliance, fraud prevention, or recordkeeping purposes.

10. Security

We use reasonable technical and organizational measures to protect information we hold, including encrypted connections (TLS/HTTPS), hashed password storage via Supabase Auth, and server-side authorization checks on all data-modifying operations. No security measures are perfect, and we cannot guarantee that unauthorized access, disclosure, alteration, or destruction will never occur. If you believe you have discovered a security issue, please contact us promptly.

11. Children

Contractor Catalogue is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Account registration requires users to be at least 18 years of age.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post an updated policy on this page with a revised effective date. We encourage you to review this policy periodically. Continued use of the service after a policy update constitutes acceptance of the updated policy.

13. Contact

For privacy questions, requests, or concerns, please contact us at:

privacy@contractorcatalogue.example