Legal

Privacy Policy

Last updated: August 8, 2026

This Privacy Policy explains what personal information is collected through this platform, how it is used and protected, and who is responsible for it. It applies to visitors, prospective clients, portal clients, and staff who use this system operated by Imagine That (“we,” “us,” the “Company”).

1. Who is responsible for your data

Understanding the two parties involved matters, because it determines who controls your information and where it lives.

The Company (Data Controller)

Imagine That operates this platform, decides what information is collected, and is the party you contact about your data. The Company licenses this software from the Software Provider and runs it on the Company's own hosting account.

The Software Provider (Imagine That)

Imagine That built and licenses the software. It is not the operator of this install and does not host or store the Company's live data. It has no routine access to the records entered here.

Where your data is stored. All data entered into this platform is stored on hosting infrastructure controlled by Imagine That through its own third-party hosting provider — not on servers owned or operated by Imagine That. The Software Provider does not receive, retain, or process copies of this data as part of normal operation.

2. Information we collect

Prospective clients (contact & quote requests)

  • Name, email address, and phone number.
  • Details you provide about your project (type of work, package interest, description).
  • Files you choose to upload — photos, sketches, or PDF plans.
  • Your IP address and a bot-protection token, collected when you submit a form.

Portal clients

  • Contact details and the email address used to access your secure portal link.
  • Project information: estimates, change orders, invoices, and related documents.
  • Property or job-site addresses, which may be converted to map coordinates to display location.
  • Messages and attachments you exchange with the Company through the portal.

Staff and employees

  • Name and contact information.
  • Pay and payroll information (wage or salary, time records).
  • Profile photos, where provided.
  • Time-clock records, which may include the date, time, and — where the Company enables job-site verification — the approximate location of a clock-in or clock-out.

Technical information

  • Cookies used strictly to keep you signed in and to protect forms (see §5).
  • Standard server logs, which may include IP address, browser type, and timestamps.
Location data. Where the Company enables job-site time verification, clock-in and clock-out events may record approximate location to confirm presence on site. This is used only for timekeeping and payroll accuracy and is visible to the Company's authorized staff only.

3. How we use your information

  • To respond to inquiries and prepare quotes.
  • To deliver, document, and bill for the services you engage us for.
  • To operate the client portal and let you review project documents.
  • To administer staff timekeeping and payroll.
  • To secure the platform, prevent abuse, and meet legal or tax obligations.

We do not sell your personal information, and we do not share it for third-party advertising.

4. Third-party services

The platform relies on a small number of service providers to function. These may include:

  • The Company's hosting provider — stores the application and its database.
  • A bot-protection service (Cloudflare Turnstile) — verifies that form submissions are human.
  • An email delivery service — sends notifications, portal links, and receipts.
  • A mapping/geocoding service — converts addresses to coordinates for display.

Each provider only receives the information needed to perform its function. Payment processing is not currently handled by this platform; if card payments are added, card data will be handled by a dedicated payment processor (such as Stripe) and never stored here.

5. Cookies

This platform uses only the cookies required to operate securely — a session cookie to keep you signed in and a token to protect forms against cross-site request forgery. These cookies are marked Secure and HttpOnly and use SameSite protection. No advertising or cross-site tracking cookies are used.

6. How your data is protected

The platform is built with the following safeguards:

  • Encryption in transit. Traffic is served over HTTPS (TLS).
  • Protected credentials. Admin passwords are stored using one-way hashing. Portal access uses high-entropy links that are stored hashed, encrypted at rest, expire after inactivity, and can be revoked.
  • Access controls. Staff access is restricted by capability on a default-deny basis — users see only what their role permits.
  • Form protection. All data-changing actions require anti-forgery tokens, and sessions are hardened against fixation.
  • File safeguards. Uploaded files are stored with randomized names, blocked from direct web access, and served only through authenticated endpoints.
  • Error and secret hygiene. Detailed errors are logged privately, not shown to visitors, and configuration secrets are kept out of public files.
Because the platform runs on hosting infrastructure controlled by the Company, the security of the underlying server environment, backups, patching, and account access is managed by the Company and its hosting provider.

7. Data retention

We keep personal information for as long as needed to provide services, maintain business and tax records, and meet legal obligations. Prospect inquiries are retained while a project is being considered and for a reasonable follow-up period. You may request deletion of your information as described in §8, subject to records we are legally required to keep.

8. Your choices and rights

Depending on where you live, you may have the right to access, correct, or delete the personal information we hold about you, or to object to certain uses. To make a request, contact the Company at canyou@imaginethat.works. We will respond within the time required by applicable law.

9. Children

This platform is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children.

10. Data breaches and limitation of liability

We take reasonable measures to protect your information. However, no method of transmission or storage is completely secure, and no system can be guaranteed against every threat.

Responsibility for the hosting environment. Because the data collected through this platform is stored on hosting infrastructure controlled by Imagine That and its hosting provider — and not on infrastructure operated by Imagine That — the Company and its hosting provider are responsible for securing that environment, maintaining backups, and for any breach notification required by law.

Imagine That licenses the software “as is.” To the maximum extent permitted by law, the Software Provider is not liable for any loss, unauthorized access, disclosure, alteration, or destruction of data stored on the Company's hosting account, including any breach arising from the Company's hosting configuration, credentials, third-party providers, or use of the software.

Nothing in this section limits any liability that cannot be excluded under applicable law.

11. Future hosting changes

The Company may, in the future, move this platform to hosting managed by the Software Provider or another provider. If that happens, this policy will be updated and, where appropriate, a separate data-processing agreement will govern how data is handled.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest revision. Material changes will be posted on this page.

13. Governing law

This Privacy Policy is governed by the laws of the State of Washington, without regard to its conflict-of-laws rules.

14. Contact

Data controller: Imagine That — canyou@imaginethat.works

Software provider (licensing / software only): Imagine That — canyou@imaginethat.works