Privacy Policy

1. Who we are

Kontracks is a multi-tenant SaaS platform operated by LWR Technologies, Inc., a Delaware C‑Corporation ("Kontracks", "we", "us"). The platform is used by United States home-improvement service businesses (roofing, siding, and decking contractors) to manage leads, proposals, jobs, invoices, and customer communications.

When you (the "Recipient") provide your phone number, email address, or other personal information to a business that uses Kontracks (a "Tenant Business") through one of that tenant's intake forms, proposal e‑signature flows, or in‑person estimates, the data is processed jointly by Kontracks and the Tenant Business. The Tenant Business is the controller of your customer relationship; Kontracks is the processor that provides the software and the messaging delivery rails.

2. Information we collect

Through the Kontracks platform, the following categories of information may be collected from Recipients:

• Identity: first and last name, postal address, email address, mobile phone number
• Property details (when relevant to the requested service): address of the service location, scope of work requested, photographs you choose to upload
• Consent records: timestamp, source (online form, signed proposal, verbal estimate), and the exact text of the consent disclosure you accepted
• Messaging activity: SMS and email conversations between you and the Tenant Business, opens, link clicks, and delivery receipts
• Payment information (only when you elect to pay via the Tenant Business's invoice): processed through PCI‑DSS‑compliant providers (Stripe). Card numbers are never stored on Kontracks servers. Tokenized payment references and Stripe payment intent IDs are stored so the Tenant Business can reconcile invoices and so refunds and disputes can be processed
• Accounting integration data (only when the Tenant Business connects QuickBooks Online): when a Tenant Business opts to sync invoices to QuickBooks Online, Kontracks transmits to Intuit a copy of (a) the Recipient's identity details necessary to create or update a QuickBooks Customer record, (b) the line items, amounts, due dates, and tax codes of invoices, (c) payment records and their amounts and methods, (d) refund records, and (e) credit memos resulting from voided invoices. Kontracks does not transfer SMS opt-in data, message content, or property photographs to Intuit
• Device + analytics: IP address, browser user agent, page-visit timing on tenant-hosted public links

3. How we use your information

We use the information collected to:

• Deliver the service the Tenant Business is providing to you (estimates, proposals, scheduled appointments, invoices, warranty correspondence)
• Send transactional SMS and email messages you consented to receive — appointment reminders, on‑the‑way alerts, job status updates, payment receipts, one‑to‑one replies from the Tenant Business's reps, and opt-in / opt-out confirmations
• Authenticate your access to customer-facing portals (proposal e‑signature, invoice payment, photo upload)
• Maintain audit records required by the Telephone Consumer Protection Act (TCPA), the FCC's 10DLC compliance regime, state-level marketing laws (FTSA, WCEMA, OTSA), and anti-fraud rules
• Improve platform reliability, detect abuse, and respond to carrier complaints

4. How we share your information

We share information only as required to operate the platform:

• The Tenant Business you contacted — they see and respond to your inquiry
• Sub-processors bound by data-processing agreements that mirror this policy: Telnyx (SMS delivery), Resend and Gmail/Microsoft 365 (email delivery), Google Calendar / Google Contacts / Google Drive (calendar, contact, and file sync, only when the Tenant Business connects the corresponding Google account), Google Maps + Apple Maps (address geocoding), Stripe (payments), Intuit (QuickBooks Online accounting sync, only when the Tenant Business explicitly connects QBO), QXO (wholesale materials pricing and ordering, only when the Tenant Business connects a QXO account), Vercel + Neon + Google Cloud (hosting and storage), Anthropic + OpenAI + Google AI (AI features, only when you or the Tenant Business explicitly invokes them, and only with the redacted payload required to compute the result). The complete current Sub-processor list, updated whenever it changes, is published at /legal/subprocessors/
• Regulators and carriers, on demand, in the event of a TCPA / 10DLC audit or consumer complaint
• Successors in interest in the event of a merger, acquisition, or asset sale — bound by this policy

5A. Financial data handling (Stripe & QuickBooks Online)

Kontracks handles financial data with the same care as the rest of the platform plus the additional controls expected of accounting and payment integrations:

• Card data. Full credit card numbers, CVVs, and bank routing numbers are never stored on Kontracks servers. Card data is collected and tokenized exclusively by Stripe, which is PCI-DSS Level 1 certified. Kontracks stores only tokenized references (e.g., Stripe payment intent IDs) and amount/method metadata necessary to reconcile invoices and process refunds.
• QuickBooks Online (QBO). Where the Tenant Business connects QuickBooks Online, Kontracks acts solely on the Tenant Business's documented instructions to transmit specific invoice, payment, customer, credit-memo, and refund records to the Tenant Business's own QBO company. OAuth tokens issued by Intuit are encrypted at the column level using AES-256-GCM before being written to the database. Kontracks does not access QBO data for any purpose other than executing the sync that the Tenant Business has configured, supporting the Tenant Business when they request help, and detecting abuse. Tenant Businesses can disconnect QuickBooks Online at any time from the Settings panel; Kontracks calls Intuit's revoke endpoint and wipes the tokens immediately.
• Idempotency & ledger truth. Each payment record carries a globally unique idempotency identifier so duplicated webhook deliveries from Stripe or QuickBooks cannot cause double-recording. The platform maintains a payment ledger as the source of truth for what was paid, when, and by what method; this ledger is what is reflected to the Tenant Business and is used in their accounting reconciliations.
• Retention. Invoices, payment records, and the audit trail of who took what action on them are retained for at least four (4) years from the date of issue to satisfy U.S. federal and state tax record-keeping obligations and statute-of-limitations periods for disputed charges.
• Access controls. Access to financial records is restricted to Authorized Users to whom the Tenant Business has granted permission. Every financial-record change (invoice edit, void, payment recorded, refund issued) is logged with user attribution and timestamp.

6. Email opt-out

Every email sent through the Kontracks platform on behalf of a Tenant Business includes a one-click unsubscribe link in the footer. Clicking it suppresses your address on that Tenant Business's mailing list immediately. Transactional emails (invoice receipts, appointment confirmations) may continue when you have an active service relationship.

7. Data retention

Personal information is retained while the Tenant Business maintains an active service relationship with you, plus the minimum period required to satisfy tax, warranty, and consent-record retention obligations (typically four years for invoices and seven years for TCPA consent records). You may request deletion at any time — see Section 9 below.

8. Security

The platform is hosted on Vercel and Google Cloud Platform, both SOC 2 Type II certified. All connections to the platform use TLS 1.2 or higher. Database backups are encrypted at rest. Tenant API keys for third-party providers (Stripe, AI providers) are encrypted at the column level with AES-256-GCM before being written to the database. Access to production data is restricted to LWR Technologies employees and contractors who have signed confidentiality and acceptable-use agreements.

9. Your rights

You may request that we (a) confirm what information we hold about you, (b) provide a copy, (c) correct inaccurate information, (d) delete information that is no longer required for the purposes above, and (e) restrict or object to certain processing. Requests are honored within 30 days. Send your request to privacy@kontracks.com with proof of identity sufficient to associate you with the record (typically the email address or phone number on file).

If you are a California resident, the California Consumer Privacy Act (CCPA) provides additional rights, including the right to opt out of "sale" or "sharing" of personal information. Kontracks does not sell or share personal information as those terms are defined in the CCPA.

10. International transfers

Kontracks is operated from the United States. If you submit information from outside the United States, you understand that the information is transferred to and processed in the United States. We rely on the Standard Contractual Clauses where required by GDPR for any incidental EU/UK data.

11. Children's privacy

The Kontracks platform is not directed to children under 16. We do not knowingly collect information from a child. If we learn that a child has provided personal information, we delete it.

12. Changes to this policy

We may update this policy. Material changes will be posted here with a new effective date. Continued use of the Kontracks platform after the effective date constitutes acceptance of the updated policy.

13. Contact

Privacy questions: privacy@kontracks.com.
Legal: legal@kontracks.com.
Mailing address: LWR Technologies, Inc. · 390 NE 191st St STE 32488 · Miami, FL 33179 · United States.