How Bedrock Digital collects, uses, and protects your information.
When you use our builder or create an account, we collect information you provide, including:
| Category | Examples | Purpose |
|---|---|---|
| Identity | Full name, business name | Account creation, site content |
| Contact | Email address, phone number | Account management, communications |
| Business | Trade type, services, service areas, city, slogan, business story | Building your website content |
| Account credentials | Email address, password (hashed) | Client portal authentication |
| Payment | Billing information (processed by Stripe — we do not store card numbers) | Processing transactions |
| Content | Photos, logos, custom text you upload | Displaying on your website |
When you visit our website or use our Services, we may automatically collect:
We may receive information about you from third-party services you connect to our platform, such as payment confirmation data from Stripe following a successful transaction.
We use the information we collect for the following purposes:
We do not sell your personal information to third parties. We do not use your information to serve you advertisements on third-party platforms.
Where applicable law requires a legal basis for processing personal data, we process your information based on:
We share your information only in the following limited circumstances:
We share information with trusted third-party vendors who assist us in providing the Services. These vendors are contractually required to protect your information and use it only for the purposes we specify:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database and authentication | supabase.com/privacy |
| Stripe | Payment processing | stripe.com/privacy |
| Cloudflare | Website hosting and CDN | cloudflare.com/privacypolicy |
| Name.com | Domain registration | name.com/about/privacy |
| Resend | Transactional email delivery | resend.com/legal/privacy-policy |
| Netlify | Serverless function hosting | netlify.com/privacy |
| Google (OAuth) | Only if you connect Google — Business Profile (view and manage your listing), Gmail (send emails you approve), or Calendar (create events you schedule); minimum scopes only, never your Google password. See section 4.2 for details. | policies.google.com/privacy |
| Intuit (QuickBooks Online) | Only if you connect QuickBooks — exchanges invoices, estimates, and expenses both ways | intuit.com/privacy |
Bedrock Digital integrates with Google Business Profile to allow contractors to view and manage their business listing directly within the Bedrock platform. When a user connects their Google account, Bedrock requests access to their Google Business Profile data (the business.manage scope) solely to display and update their listing information. If a user also connects Gmail (the gmail.send scope) or Google Calendar (the calendar scope), those scopes are used only to send emails the user explicitly approves and to create calendar events the user schedules.
Bedrock does not share this Google data with third parties, does not use it for advertising, and only accesses it when the user initiates an action within the platform. We connect to Google solely through Google's official OAuth flow, request the minimum scopes needed, and never receive or store your Google password. Bedrock Digital's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Bedrock Digital, our users, or the public.
If Bedrock Digital is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will notify you via email before your information becomes subject to a different privacy policy.
We may share your information with third parties when you have given us explicit consent to do so.
We retain your personal information for as long as your account is active or as needed to provide the Services. After account cancellation, we retain your data for up to 90 days to allow for account reactivation or data export requests, after which it is deleted from our active systems. We may retain certain information longer as required by law or for legitimate business purposes (e.g., financial records for tax compliance).
We implement industry-standard technical and organizational security measures to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include:
No method of electronic storage or transmission is 100% secure. While we use commercially reasonable security practices, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days. We may require you to verify your identity before processing your request.
If we send marketing emails (separate from transactional service emails), you may opt out at any time by clicking the "unsubscribe" link in any such email or by contacting us directly.
Our website uses minimal cookies and local storage. We use:
We do not use advertising cookies, cross-site tracking cookies, or third-party behavioral advertising pixels.
Our Services are intended for adults operating businesses. We do not knowingly collect personal information from individuals under the age of 18. If we learn that we have collected information from a minor, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at [email protected].
When your website (built by Bedrock Digital) is live and visited by your customers, those visitors' data is governed by your own privacy practices as the website owner. You are responsible for your own privacy policy and compliance with applicable laws regarding data you collect through your website (such as contact form submissions). We recommend consulting a legal professional about your obligations as a website operator.
Bedrock Digital is based in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using our Services, you consent to this transfer. We implement appropriate safeguards for international transfers as required by applicable law.
If you are a California resident, you have the right to: (a) know the categories and specific pieces of personal information we have collected about you; (b) delete personal information we hold, subject to legal exceptions; (c) correct inaccurate personal information; and (d) opt out of the "sale" or "sharing" of personal information.
We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use or disclose sensitive personal information beyond the purposes permitted by law. We will not discriminate against you for exercising these rights. To exercise any of them, contact us at [email protected]; you may use an authorized agent, and we will verify your identity before responding.
Bedrock Digital is the data controller for the personal information described in this Policy. Our legal bases for processing are set out above. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority. Where we transfer your data to the United States, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. To exercise your rights or ask about transfers, contact us at [email protected].
If we become aware of a security breach that compromises your personal information, we will investigate promptly and notify affected users without undue delay, and within any timeframe required by applicable law. Notice will be sent to the email associated with your account and will describe, to the extent known, what happened, what data was involved, and the steps we and you can take.
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy here with a new "Last Updated" date and, where appropriate, notify you by email. Your continued use of the Services after an update means you accept the revised Policy.
Questions about this Privacy Policy or your personal information? Contact us at [email protected].