This Privacy Policy explains what personal information [LEGAL ENTITY NAME TBD], a California single-member LLC (in formation) ("Home by Five," "we," "us"), collects when you use the Home by Five web application (the "Service"), how we use it, who we share it with, and the choices you have. The Service was previously called "Paint Buddy"; this is the same Policy, continued under the new name.
Home by Five is a business tool used by contracting businesses. The contracting business is our customer; its owner and team are the people who use the Service day to day, and the business's own customers (for example, homeowners) may have their information entered into it. This is a plain-language template and not legal advice; it should be reviewed by an attorney before being relied on with paying customers. Items highlighted in [square brackets] still need to be decided or confirmed.
Home by Five is a small business and does not currently appear to meet the thresholds that make the California Consumer Privacy Act (CCPA), as amended by the CPRA, mandatory. We provide the disclosures and honor the rights described below as a matter of good practice and to give California users clarity, not as a concession that the law currently applies. As the business grows, we will reassess. [Applicability is a point-in-time, attorney-confirmable question; this is not a binding statement that the law does not apply.]
We do NOT collect or store payment card numbers — Stripe processes card payments. We do not collect precise geolocation, government IDs, health, biometric, or demographic data; we do not analyze photos to identify specific individuals; and we do not create voiceprints or use recordings to identify who is speaking.
The only sensitive personal information we handle is your account login credentials (email and a hashed password), which we use solely to operate your account. We do not use or disclose sensitive personal information for any purpose other than providing the Service, so the CPRA "right to limit" its use does not give you anything additional to restrict.
We collect personal information directly from you and your team when you sign up, create jobs and enter your customers' details, record walkthroughs or dictate scopes, upload contract documents, and manage your account. We receive billing contact details from Stripe when you subscribe, and limited technical information automatically (such as log and device data) through our hosting infrastructure.
We do not use your content for advertising, to build profiles about individuals, or to train or improve AI models.
Dictation and walkthroughs: when you record, we store the audio and photos, send the audio to Deepgram to convert it to text, and send the resulting transcript to Anthropic (the company behind Claude) to draft a scope of work for your review.
Contract templates: when you upload a contract document, we send its pages and text to Anthropic to read and label its parts — which lines are standard, which change per job — so you can review and approve the recreated template. Corrections you make in the review are applied directly by the Service without further AI processing.
No training on your content: we do not use your content to train or improve AI models. Under Anthropic's commercial API terms, Anthropic does not use the inputs we send or the outputs it returns to train its models; Anthropic applies limited retention for trust-and-safety purposes. We opt every transcription request out of Deepgram's model-improvement program, so Deepgram does not use your recordings to train its models and retains them only as needed to process the request. Each provider's own current terms govern and may change; for details see anthropic.com/legal, privacy.claude.com, and deepgram.com/privacy.
To run the Service we share data with a small number of U.S.-based vendors that process it only to provide their service to us:
We will keep this list current and give customers a way to learn about material changes to our sub-processors before they take effect. We may also disclose information if required by law or to protect rights and safety (see below), and in a business transfer such as a merger or acquisition.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have never done so, and the Service loads no third-party advertising or analytics trackers. Because we do not sell or share, we do not offer a "Do Not Sell or Share" link — there is nothing to opt out of. [If the app ever adds advertising or analytics trackers, this statement must be revisited and an opt-out and Global Privacy Control handling may be required.]
We may access, preserve, or disclose information if we reasonably believe it is required by applicable law, legal process, or a valid government or law-enforcement request, or where necessary to protect the rights, property, or safety of Home by Five, our customers, or others. Where permitted and appropriate, we will try to notify the affected customer.
We keep your account information, job and customer records, estimate records (recordings, photos, transcripts, and scopes), uploaded contract documents, and billing records for as long as your company maintains an active account, plus a reasonable period afterward to wind down the account and meet legal, tax, and security obligations. [Decide and implement a shorter retention cap for raw estimator audio — e.g., delete recordings some period after the transcript is confirmed — before wide launch, then state it here.] When data is no longer needed, we delete or de-identify it.
You can delete jobs, estimates, and contract templates from within the app. Deleted jobs and estimates go to a trash where they can be recovered for about 7 days, after which they are permanently purged along with their recordings and photos. [A self-service data-export feature is not currently built; do not promise one until it is.]
We use reasonable administrative and technical safeguards designed to protect your information, including storing passwords only as salted bcrypt hashes (never in plain text), serving the app over HTTPS/TLS, scoping each company's data so it is separated from other companies', rate-limiting signup, and limiting access to authorized personnel and vendors.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim formal security certifications or encryption-at-rest beyond what our hosting and database providers apply by default.
We honor the following rights as a matter of good practice:
Because Home by Five is a business tool, requests about an individual team member's data are often handled through the company's account owner, and some data may be retained where the company's contract or the law requires.
To exercise any right, email us at support@gethomebyfive.com with your request and the account it concerns. We will confirm receipt and respond within 45 days; if we need more time, we may extend up to a further 45 days and will tell you why. To protect your data, we will take reasonable steps to verify your identity before acting (for example, confirming control of the account email). You do not need to create an account to make a request, and you may use an authorized agent.
The Service processes information about your own customers — the contact details you enter on jobs, details you speak in recordings, and details that appear in your contract documents — solely on your behalf, to prepare your estimates, proposals, and contracts. As between you and us, you are responsible for any notice your customers are owed about the information you collect from them, and for the accuracy of what you enter.
Team members are asked to photograph the work, not people, and to record their own narration, not other people's conversations. Our Terms require users to obtain any consent the law requires before recording anyone. If someone who is not a Home by Five user believes their information or likeness appears in content submitted through the Service and wants to raise a concern, they can contact us at support@gethomebyfive.com and we will look into it, working with the customer whose account it concerns. The customer (employer) is responsible for any worker notice or consent its state's laws require.
Home by Five is a workplace tool for adult professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. We do not sell or share personal information of any user. If you believe a minor has provided us information, contact us and we will delete it.
We and our service providers (Anthropic, Deepgram, Vercel, Neon, Stripe, and Resend) are based in the United States, and your information is processed and stored in the United States. If you access Home by Five from outside the U.S., you understand your information will be transferred to and processed in the U.S., where data-protection laws may differ from those where you live.
If we discover a security incident that affects your personal information, we will notify affected customers and users without unreasonable delay and as required by California law, and we will take steps to investigate and remediate.
We review this Policy periodically (at least annually) and will post changes here, with the "Last updated" date reflecting the latest revision. Questions about this Policy or your privacy? Email us at support@gethomebyfive.com.
See also our Terms of Service.