Effective August 27, 2026

Privacy policy

Worksheet inputs stay local by default. Business claims, contractor workspaces, and service inquiries use the limited operational information described below.

Local-only tool information

Water Damage Source does not receive the figures, scripts, checklists, customer details, or job records entered into homeowner and contractor tools. Calculations and exports run in the browser. The current contractor tools do not require customer personal information.

Claim evidence exports

The claim evidence pack is assembled locally. Printing, saving a PDF, or downloading a CSV does not upload the entries or files to Water Damage Source. The tool asks visitors not to use a full address, policy number, claim number, phone number, or email address as its short reference label.

Research records

No research submission form is active. If an optional contribution process is introduced, it will use separate consent, redaction, retention, and deletion terms before any estimate, drying record, or case artifact is accepted.

Directory accounts, claims, and corrections

A business claim or submission can collect the requester’s name, work email, business details, authority attestation, evidence references, moderation decisions, session data, and an audit history. Public facts retain their source URL, licence, import version, confidence where applicable, and retrieval date.

Session and claim records are stored in the Water Damage Source PostgreSQL service and sessions use secure cookies. Raw session and one-time-link tokens are not retained. If private verification documents become unavoidable, they are kept in private storage and deleted within 30 days after rejection or when no longer required. Residential addresses are not displayed unless the business confirms a public location.

Contractor workspace and service inquiries

A service request goes only to the contractor identified on the campaign link; it is not resold, rematched, or broadcast. Stage one can collect safety flags, ZIP code, city, loss type, discovery time, whether the source is stopped, name, callback details, preferred contact channel, and separately selected email or WhatsApp permission. Duplicate contact details on the same campaign within 24 hours are joined to the existing lead. IP addresses are retained only as peppered hashes for abuse controls and audit evidence.

Contractors can connect their own email and WhatsApp Business channels in an isolated self-hosted Chatwoot account. Water Damage Source stores provider identifiers and connection status, not the contractor’s raw mailbox or WhatsApp credentials. Messages and delivery events are synchronized to the contractor workspace. An acknowledgement is sent only through the preferred channel when the matching permission was selected.

Contractor checklist and growth emails

The homepage contractor-checklist form requires a separate affirmative checkbox for the seven-email contractor series. It records the submitted email address, displayed consent version and source, consent time, subscription status, and a peppered IP hash used for abuse control. The checklist opens in the browser after a successful signup, and the seven field notes are scheduled for days 0, 2, 4, 7, 10, 14, and 18. Each message identifies Water Damage Source and includes a signed unsubscribe link; unsubscribing cancels every unsent message in the series.

Amazon Simple Email Service processes follow-up messages and ordinary delivery records when email delivery is enabled. Water Damage Source does not add advertising pixels to the series. Subscriber records are not added to the public directory, shared with listed contractors, or sold as homeowner leads. A suppressed or unsubscribed record may retain the minimum email and status needed to honor the preference.

Damage photos and retention

Optional JPEG, PNG, and WebP photos are uploaded to a private quarantine area. They are size- and format-checked, scanned with ClamAV, decoded and re-encoded with metadata removed, and made available only after passing. Contractor download links expire within minutes. Photos are deleted after 30 days. Untouched leads close after 30 days. Contact details, consent evidence, free text, and the synchronized Chatwoot contact/conversation are deleted or anonymized 90 days after a booked, lost, spam, or out-of-area outcome. Anonymous daily campaign totals remain.

Technical and aggregate information

Cloudflare provides hosting, security, and may process ordinary request data such as IP address, browser information, requested URL, and timestamps to deliver and protect the site. If privacy-light Cloudflare Web Analytics is enabled, it will be used for aggregate page and performance measurement.

Optional analytics

Google Analytics loads only if you select Allow analytics. Declining keeps analytics disabled. We do not send form details or worksheet answers to analytics, and Google advertising signals are disabled. Your choice is stored in this browser. Essential security or session cookies may be used for form abuse prevention, a verified business claim, or an authenticated contractor workspace.

External links

Official-source links lead to third-party government websites with their own privacy practices. Opening those links is optional.

Directory rights and requests

Every profile provides a correction and dispute route. Verified owners can request a complete opt-out; the listing is hidden while that request is reviewed. See the directory data policyfor source, suppression, and ownership-dispute details.