Draft for legal review. This page is being reviewed by a lawyer and may change before StepLadder opens to the public.
Privacy policy
StepLadder is software for small contracting businesses: a website, quote requests, quotes, contracts, invoices, payments, scheduling, and tools that help them post their finished work. This policy explains what information StepLadder handles, why, who else sees it, and the choices you have. “StepLadder,” “we,” and “us” mean [StepLadder's legal name, once registered].
Who this covers
- Businesses and their people: owners and crew who use StepLadder to run a contracting business.
- Their customers: homeowners and others who request a quote, sign a contract, pay an invoice, or book a visit through a business that uses StepLadder.
- Visitors to a business's StepLadder website.
For a business's customer records, the business decides what to collect and why, and StepLadder handles that information on the business's behalf. Questions about those records are best sent to the business first; we will help them answer.
What we collect
- Account details: name, email address, and the sign-in method you choose (Google, Microsoft, Apple, or email). Passwords are handled by Google Identity Platform; StepLadder never sees them.
- Business records that businesses enter: their details, services and prices, customers and their contact details and addresses, jobs, quotes, contracts and signatures, invoices, payments, appointments, documents, and photos (including before and after photos of jobs).
- What customers send: quote requests and their photos, booking details, contract signatures (typed name, drawn signature, and the time of signing), and whether they agree to photos of their job being used in the business's posts.
- Payments: card and bank payments are processed by Stripe. StepLadder sees the result (amount, date, last four digits, and card brand) but never full card or bank numbers.
- Connected social accounts: when a business connects Facebook, Instagram, or LinkedIn, we keep the account's name and id and an access token, encrypted with Google Cloud Key Management Service. We never ask for or store social media passwords.
- Technical information: a sign-in cookie that keeps you signed in, and server logs (such as the time of a request and errors) used to keep the service working and secure. We don't use advertising or cross-site tracking cookies.
How we use it
- To run StepLadder for businesses and their customers, and to support them.
- To bill businesses for their StepLadder plan.
- To post to a business's connected social accounts, only content the business has approved.
- For AI features: text from quote requests may be checked by an AI model to spot spam, and AI may suggest captions and ideas for posts. Photos are checked by Google Cloud Vision so faces, license plates, and house numbers can be blurred before a post. AI never makes decisions about money or publishes anything by itself; a person approves first.
- To keep StepLadder secure and to meet legal obligations.
We don't sell personal information, and we don't use it for advertising.
Who else sees it
Only the service providers StepLadder runs on, for the purposes above:
- Google Cloud: hosting, databases, file storage, sign-in, encryption keys, image checks (Cloud Vision), and AI models (Claude on Vertex AI).
- Anthropic: AI models (Claude) for the AI features.
- Stripe: payments to businesses and StepLadder's own billing.
- Meta (Facebook, Instagram) and LinkedIn: only the posts a business approves, sent to the accounts it connected.
We may also share information when the law requires it, or to protect people from harm. If StepLadder adds a provider that handles personal information, we will update this page.
How long we keep it
- Business records are kept while the business uses StepLadder, then deleted on request.
- The text of AI requests and answers is deleted after 7 days.
- Social account tokens are deleted as soon as an account is disconnected, or when Meta tells us someone asked for their data to be deleted.
- Backups are kept for a short period and then overwritten.
Your choices
- You can ask to see, correct, or delete information about you.
- Businesses can disconnect social accounts at any time in Settings → Social accounts. See how to delete your data.
- Customers can decline photo use when signing a contract, and can ask the business to stop texts or emails.
Security
Information is encrypted in transit, social account tokens are encrypted at rest with keys held in Google Cloud, and each business can only reach its own records.
Children
StepLadder is meant for adults and isn't directed to children under 13.
Changes and contact
We'll post changes here and update the date above. Questions or requests: [contact email].