Draft for review · 2026-10-29-draft-2
Privacy Notice
This is a staging draft, not an effective production policy.
Draft status
This notice describes the staging implementation for review. It is not an approved production privacy policy. Final operator identity, business contact address, retention schedule, provider arrangements and applicable privacy request procedures must be settled before public launch. Contact support@insulationblacklist.com.
Information used by the service
Registration collects business name, category, business contact, email, business address, optional website, a password hash and an optional EIN used for administrator verification. Reporting uses contractor business identifiers and accounts-receivable invoice fields, including invoice number, due date, balance and status. Disputes use submitted explanations, responses, review outcomes and, when enabled, private supporting documents. Purchases and operations use transaction references, saved results, watchlist entries, audit events and policy acceptance records.
Avoid unnecessary private information
Do not submit Social Security numbers, personal home addresses, bank account details, payroll or unrelated personal or financial records. EIN is optional and restricted to administrative verification. Import only business identity and accounts-receivable fields. Use the private portal or a secure submission method arranged with support for evidence, rather than placing evidence in the assistant.
Who can access records
Members can access their own account tools and authorized purchased results. Paid contractor results omit reporting supplier identities and source invoice documents. Administrators can review operational records and supplier identity. Contractor private notices and dispute communications relate to the specific authorized report and may identify the reporting supplier. Service providers process relevant information to operate hosting, payments, email, AI or SMS where enabled. Records may also need to be handled for appropriate lawful process or security investigation; final disclosure procedures require review.
Service providers and payments
The staging application uses Render for hosting and data services, Stripe for available checkout, Microsoft Graph for configured email, OpenAI for general FAQ question interpretation and Twilio for configured SMS functions. Configuration does not establish that a service is active or approved. Card entry takes place through Stripe; the application retains payment references rather than raw card numbers or security codes. Provider agreements, transfer arrangements and production configuration remain part of release review.
Assistant questions and private summaries
General assistant questions and public FAQ content may be sent to OpenAI. The application does not maintain a chat transcript, but operational hosting logs can still exist. Do not enter private records, secrets or verification codes in chat; automated input screening is not a guarantee that all sensitive text will be recognized. Authenticated account summaries and contractor notice tokens are handled by local website code and are not included in AI prompts. The model cannot query private tables or perform account changes.
Cookies, security and access links
Session and form-security cookies support sign-in and protected forms. Rate limits and operational counters help limit abuse. Private notice links act as access credentials: keep them confidential and contact support if a link is exposed. The implementation uses access controls, password hashing and encryption for configured private fields or files; no security measure guarantees that a system is risk-free. Secure uploads remain unavailable until scanning and storage controls are activated.
Retention and privacy requests
A final retention and deletion schedule has not yet been approved. Paid or corrected invoices can be removed from active totals while restricted audit, payment and dispute records remain. This draft does not promise automatic deletion after a fixed period. Contact support to request access, correction or deletion, or to report inappropriate disclosure. Identity and authority must be checked before releasing or changing private data; request handling and any required retention must be reviewed for the production service.
Administrator SMS program
Insulation Blacklist Administrator Alerts is for the owner or authorized administrator who explicitly requests sign-in verification codes and opts in to operational account alerts. Message frequency varies. Message and data rates may apply. Reply STOP to stop text messages; contact support@insulationblacklist.com for help or to arrange another access method before relying on SMS sign-in. SMS registration and delivery must be active before messages are sent. This program does not send marketing or contractor debt-collection texts.
Mobile information and SMS consent
Mobile numbers and SMS opt-in information are used to provide the requested transactional program. Mobile information, opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes. Relevant information may be processed by messaging service providers solely to operate and deliver the SMS program. A phone number supplied for another purpose does not itself enroll that person in SMS alerts.
Policy versions
Registration records the draft policy bundle version, document hashes, acknowledgement wording and server timestamp. Existing accounts are not backfilled with fabricated acceptance. Archived bundles remain available for comparison. Final policies will use a new version and a separately reviewed acceptance process.
Archived version: 2026-10-29-draft-2 · Status: draft · Contact support