Updated October 23, 2026

Privacy policy

Worksheet inputs stay local by default. Business claims, contractor workspaces, and service inquiries use the limited operational information described below.

Local-only tool information

Water Damage Source does not receive the figures, scripts, checklists, customer details, or job records entered into homeowner and contractor tools. Calculations and exports run in the browser. The current contractor tools do not require customer personal information.

Claim evidence exports

The claim evidence pack is assembled locally. Printing, saving a PDF, or downloading a CSV does not upload the entries or files to Water Damage Source. The tool asks visitors not to use a full address, policy number, claim number, phone number, or email address as its short reference label.

Research records

No research submission form is active. If an optional contribution process is introduced, it will use separate consent, redaction, retention, and deletion terms before any estimate, drying record, or case artifact is accepted.

Directory accounts, claims, and corrections

A business claim or submission can collect the requester’s name, work email, business details, authority attestation, evidence references, moderation decisions, session data, and an audit history. Public facts retain their source URL, licence, import version, confidence where applicable, and retrieval date.

Session and claim records are stored in the Water Damage Source PostgreSQL service and sessions use secure cookies. Raw session and one-time-link tokens are not retained. If private verification documents become unavoidable, they are kept in private storage and deleted within 30 days after rejection or when no longer required. Residential addresses are not displayed unless the business confirms a public location.

Paid business pages and direct enquiries

The optional USD $97/month business page subscription stores the verified owner's email, business edits, uploaded public business photos, video links, comment moderation and replies, Stripe customer and subscription identifiers, payment status and billing dates. Stripe processes card details and payments; we do not store full card numbers. Business photos are resized and re-encoded with metadata removed. Public page photos are distinct from private damage-request photos.

A direct business-page enquiry shares your name, email, optional phone, message and consent with the business you select. It is saved in that business's private inbox for 90 days and emailed to its verified address through MXroute. It is not broadcast or sold to other businesses. Public comments display the chosen name, comment and business reply after business moderation. Comments are not independently verified reviews. Contact [email protected] for correction, deletion or abuse reports. Essential secure cookies keep business owners signed in; email verification and sign-in links are one-time and expire after 30 minutes.

Contractor workspace and service inquiries

A service request goes only to the contractor identified on the campaign link; it is not resold, rematched, or broadcast. Stage one can collect safety flags, ZIP code, city, loss type, discovery time, whether the source is stopped, name, callback details, preferred contact channel, and separately selected email or WhatsApp permission. Duplicate contact details on the same campaign within 24 hours are joined to the existing lead. IP addresses are retained only as peppered hashes for abuse controls and audit evidence.

Contractors can connect their own email and WhatsApp Business channels in an isolated self-hosted Chatwoot account. Water Damage Source stores provider identifiers and connection status, not the contractor’s raw mailbox or WhatsApp credentials. Messages and delivery events are synchronized to the contractor workspace. An acknowledgement is sent only through the preferred channel when the matching permission was selected.

Contractor checklist and growth emails

The homepage contractor-checklist form requires a separate affirmative checkbox for the seven-email contractor series. It records the submitted email address, displayed consent version and source, consent time, subscription status, and a peppered IP hash used for abuse control. The checklist opens in the browser after a successful signup, and the seven field notes are scheduled for days 0, 2, 4, 7, 10, 14, and 18. Each message identifies Water Damage Source and includes a signed unsubscribe link; unsubscribing cancels every unsent message in the series.

Amazon Simple Email Service processes follow-up messages and ordinary delivery records when email delivery is enabled. Water Damage Source does not add advertising pixels to the series. Subscriber records are not added to the public directory, shared with listed contractors, or sold as homeowner leads. A suppressed or unsubscribed record may retain the minimum email and status needed to honor the preference.

Damage photos and retention

Optional JPEG, PNG, and WebP photos are uploaded to a private quarantine area. They are size- and format-checked, scanned with ClamAV, decoded and re-encoded with metadata removed, and made available only after passing. Contractor download links expire within minutes. Photos are deleted after 30 days. Untouched leads close after 30 days. Contact details, consent evidence, free text, and the synchronized Chatwoot contact/conversation are deleted or anonymized 90 days after a booked, lost, spam, or out-of-area outcome. Anonymous daily campaign totals remain.

Technical and aggregate information

Cloudflare provides hosting, security, and may process ordinary request data such as IP address, browser information, requested URL, and timestamps to deliver and protect the site. If privacy-light Cloudflare Web Analytics is enabled, it will be used for aggregate page and performance measurement.

Optional analytics

Google Analytics loads only if you select Allow analytics. Declining keeps analytics disabled. We do not send form details or worksheet answers to analytics, and Google advertising signals are disabled. Your choice is stored in this browser. Essential security or session cookies may be used for form abuse prevention, a verified business claim, or an authenticated contractor workspace.

External links

Official-source links lead to third-party government websites with their own privacy practices. Opening those links is optional.

Directory rights and requests

Every profile provides a correction and dispute route. Verified owners can request a complete opt-out; the listing is hidden while that request is reviewed. See the directory data policyfor source, suppression, and ownership-dispute details.