Project Deck

Privacy Policy

Version 2026-10-23 · Effective October 23, 2026. This Policy explains how Project Deck handles personal information when you use projectdeck.net and the Project Deck marketplace.

Updated disclosures for job-photo visibility, private addresses, paused credentials, administrator access, notification providers, isolated optional analytics, privacy requests and retention. Terms wording is unchanged.

Previous Policy (2026-10-09)Privacy contact Your privacy requests

1. Who is responsible for your information

This Policy explains how Project Deck handles personal information for projectdeck.net and its homeowner/contractor marketplace. Project Deck is the marketplace's trading name and is responsible for personal information under its control, including information handled by service providers on its behalf. Contact the designated privacy contact at privacy@projectdeck.net for questions, requests or complaints. Contractors and homeowners receiving information for their own work also have their own applicable privacy obligations; they are not Project Deck employees.

2. Information we collect

Information includes your email and authentication information; names, optional phone/avatar, city/province and profile information; contractor business name, description, services, service radius, location reference data, self-reported insurance/bonding, portfolio and reviews; job descriptions, timing, photos, approximate location and private address/access details; quotes, conversations, messages, attachments where used and project status. We also keep signup/onboarding progress and resumable drafts, legal acknowledgement versions/times, notification preferences and delivery records, feedback, privacy requests and contact inquiries. Infrastructure processes IP addresses, browser/device and security/error information. If phone notifications are enabled, we store the push endpoint, subscription keys and device/browser information needed for delivery. Do not upload unnecessary sensitive details or information about others without permission.

3. Why we collect and use information

We use information to create and secure accounts, resume onboarding, operate profiles, match services and approximate locations, show eligible jobs, exchange quotes/messages, record hiring and project status, publish intended public portfolios/reviews, deliver selected notifications, administer the beta and respond to requests. We also use necessary records to prevent abuse, investigate incidents, resolve support issues and comply with law. Contact forms store inquiries and may forward their contents and your reply-to address to the relevant support mailbox; abuse controls use a salted sender reference. We do not currently process project payments or collect payment-card details for marketplace payments.

4. Exact addresses and private job details

An open job's title, description, city/approximate location, timing and photos can be seen by eligible signed-in contractors, not just the contractor eventually hired. Exact address, unit, postal code and access notes are stored separately and are available to the job owner, authorized administrators and the contractor selected through quote acceptance while the assigned-contractor access conditions apply. Sending a pre-hire message or receiving a quote alone does not grant that private-address access. Matching uses stored approximate/reference coordinates, not continuous device-location tracking. A photo or description may reveal your address or other personal information if you include it: remove unnecessary identifying details before posting. We do not promise that uploaded photos have had location metadata removed. Authorized recipients can retain copies they receive; access controls cannot recall those copies.

5. Public marketplace information

Active contractor storefronts can be viewed publicly, including by search engines. They may display business name, logo/avatar, city/province, services, biography, experience, availability, self-reported insurance/bonding, portfolios, ratings and reviews. Published reviews may show the reviewer's first name, last initial and city. Limited customer identity information may also appear to authorized marketplace users. Customer email, phone, full private address and private account records are not public storefront fields. Contractor postal codes and precise stored coordinates are not public storefront fields. Public content may be copied or indexed by others; pausing a profile does not necessarily erase outside copies.

6. Messages, quotes and project records

Quotes, messages, attachments and project records are restricted to authorized parties and administrators, rather than public listings. Contractors cannot view competitors' private quotes. Conversations may exist before hire or for hired projects; their participants can see messages shared with them. Messages are not represented as end-to-end encrypted from Project Deck. Administrators may access account, signup-progress, job, message, inquiry and request records for support, security, moderation, legal compliance or investigation. Credential submission and verification are paused. Previously supplied credential numbers, legal-holder names, evidence files and review/audit records may remain privately stored; they are not publicly displayed or proof of current verification. Pausing that feature does not automatically delete its records.

7. Consent and choices

We explain important uses and seek meaningful consent where required. Account security, requested marketplace interactions and legal records require some processing. Acknowledging this Policy is not blanket permission for unrelated use, optional analytics or marketing. Optional fields need not be supplied unless a requested feature requires them. Use Privacy choices in the footer for analytics, Settings for marketplace email/device notifications, or contact privacy@projectdeck.net to ask about withdrawing other consent and its consequences. Withdrawal may prevent features dependent on the information and does not undo lawful earlier processing or required retention. We will seek additional consent for a new purpose where required, rather than treating a policy update alone as consent.

8. Marketing communications

Account creation is not blanket consent to promotional email or texts. Promotional campaigns are not currently implemented; any future campaign requires a lawful consent basis, required sender information and an unsubscribe method. Marketplace email alerts for messages, quotes and project updates can be turned off in Settings; optional nearby-job opportunities have a separate switch. Essential authentication, security and requested support messages may still be needed. Phone Web Push requires browser permission and a per-device subscription; turn it off in Settings or browser/device controls. Delivery providers receive your email or push destination and the payload needed to send the notice. Marketplace notification emails/push use generic updates and links, not private message bodies or exact addresses; notifications may still be visible on a device lock screen. Contact-inquiry forwarding is different and may include the inquiry you supplied. For promotional opt-outs or help with alerts without signing in, email privacy@projectdeck.net. Calling a message transactional does not exempt it from applicable anti-spam requirements.

9. Service providers and processing

Lovable Cloud provides application hosting and managed database, authentication and private file storage. Resend, through the Lovable delivery connection, handles marketplace and inquiry-forwarding emails; browser/operating-system push services deliver Web Push. Support/privacy email uses the project's Zoho Mail mailbox setup. These services necessarily process relevant account, delivery or inquiry information; this list does not promise a particular hosting country. Essential cookies/browser storage support login, security and preferences. Optional Google Analytics loads only after Allow analytics; our isolated measurement frame receives only approved public page paths, without the parent page's queries, fragments, private record URLs or referrer. Google may still receive network IP, browser/device and cookie information. We do not send account IDs, message contents or addresses as analytics events. Privacy choices lets you decline or withdraw analytics. Operational error monitoring is separate from optional traffic analytics and can process diagnostic details to investigate failures.

10. Processing outside Ontario or Canada

Providers may process or store information outside Ontario or Canada, and it may be accessible to courts, law enforcement or other authorities under that jurisdiction's laws. We do not promise Canada-only hosting. Project Deck remains accountable for personal information transferred for processing and must use appropriate safeguards, including contractual or other measures providing comparable protection where required. Ask the privacy contact about providers and cross-border handling; exact processing locations and provider arrangements may change. Information may also be disclosed when required or permitted by applicable law, with requests assessed rather than treated as unrestricted access.

11. Retention

Retention depends on the purpose and record, including account operation, project/quote/message history, legal acknowledgements, support, security, disputes and legal obligations; this Policy does not set an invented fixed deletion period. The app does not automatically erase all information when a project ends or a closure request is submitted. Requests require review of what may be deleted, anonymized or retained and why. Where information is no longer needed, it should be securely deleted or anonymized, subject to legitimate legal exceptions. Backups, delivery logs, credential evidence and copies lawfully held by other users or providers may need separate handling; deletion from an active screen is not proof that every copy has been erased. Ask the privacy contact about a particular record.

12. Security safeguards

Implemented controls include account authentication, ownership/role-based access rules, private file buckets with controlled signed-link access, upload restrictions for supported files and abuse limits. A private signed link may remain usable until it expires; do not share it with unauthorized people. Public storefront images remain viewable through controlled access. These controls do not constitute a promise of absolute security, complete malware detection, external certification or independently verified organizational practices. Protect credentials and devices and avoid unnecessary sensitive uploads. Report suspected exposure to privacy@projectdeck.net; do not include passwords or tokens in the report.

13. Privacy and security incidents

Report suspected privacy/security incidents to privacy@projectdeck.net. Project Deck must assess incidents and meet applicable breach-recording, reporting and notification duties. Under PIPEDA where it applies, breaches presenting a real risk of significant harm require reporting to the Office of the Privacy Commissioner of Canada and notification to affected individuals as soon as feasible, with other notifications and breach records as required. This describes legal responsibilities, not a claim that every incident is automatically detected or that an independent audit or automated response service exists.

14. Access, correction and deletion requests

You may ask what personal information we hold, how it has been used and disclosed, request access and challenge its accuracy or completeness. You can update supported profile fields yourself and request other corrections, consent withdrawal or account closure/deletion review. Email privacy@projectdeck.net or use the signed-in privacy-request page; requests do not require agreement to revised Terms. We may reasonably verify identity without collecting unnecessary information and protect other people's information or legally restricted records. Where access is refused or limited, we must provide reasons and available complaint options as required. Under PIPEDA where applicable, access requests are generally answered within 30 days, with only lawful extensions and notice; other requests follow applicable requirements. A request/status label is not an automatic export or deletion. Retained information and reasons should be explained rather than promising unconditional erasure.

15. Children

Project Deck is for adults aged 18 or older who can enter into binding agreements and is not directed to children. Signup includes an adult/capacity affirmation, not independent age verification. If you believe a child has supplied information, contact privacy@projectdeck.net so it can be assessed and handled appropriately; do not submit unnecessary identity documents.

16. Changes to this Policy

Material revisions have a distinct version/effective date and a notice identifying important changes. The earlier published Policy is accessible from this page. Account signup and renewed acknowledgement record the displayed Policy version; acknowledging a description does not authorize every new purpose. Additional meaningful consent is required where law requires it, including for optional uses. Existing records and earlier acknowledgements are not silently replaced. Public copies and privacy contact remain available without agreement.

17. Contact and complaints

Send questions, requests or complaints to the designated privacy contact at privacy@projectdeck.net. Include enough detail to locate the issue, not passwords, tokens or unnecessary private documents. Project Deck must investigate complaints and respond in accordance with applicable law. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca about PIPEDA concerns; contacting Project Deck does not waive that right. This Policy is not a claim of lawyer approval or independent privacy certification.

Location data attribution

Some Ontario place names and geographic reference coordinates are based on data provided by GeoNames, used under the Creative Commons Attribution 4.0 license. Data has been filtered and adapted for Ontario service matching; GeoNames does not endorse Project Deck. Geographic matching is approximate.