Privacy Policy

This policy covers app.thecommonstead.com — the Commonstead platform — and the email we send from it. It does not cover any website we do not operate, even if it uses the Commonstead name; if you are unsure whether a site is ours, ask us before submitting anything to it.

Two kinds of people appear in this policy. If you have an account, we decide how your account data is used and this policy describes that directly. If your information was entered into the platform by an organization that uses it — for example because you are their customer or prospect — that organization decides how your information is used, we process it on their instructions, and requests about it should go to them first. We will help them respond.

1. What we collect

Grouped by the categories state privacy laws use:

• Identifiers — name, email address, phone number, city, state or province, country, and an account identifier.
• Account and security data — password (stored only as a cryptographic hash, never in readable form), session tokens, sign-in timestamps, and password change history.
• Professional information — your sales role, your organization, enrollment relationships (who referred whom), certification and training progress.
• Commercial information — proposals, orders, product interest, program applications, and commission and compensation records.
• Customer records entered by users — contacts, companies, properties, opportunities, and activity notes that account holders enter about the people and businesses they work with.
• Internet and device activity — IP address, browser and device type, pages visited, and diagnostic logs, including error reports.
• Approximate location — derived from the address on a property record or from your IP address. We do not collect precise device GPS location.
• Communications content — messages sent through platform features, community posts, and conversations with our AI assistant.
• Inferences — lead scores and business-fit signals generated for outbound campaigns.

2. Sensitive information

We do not ask for, and the platform is not built to hold, government identification numbers, payment card numbers, financial account credentials, precise geolocation, health information, biometric data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or immigration status.

We do not use or disclose sensitive personal information for any purpose that would give you a right to limit that use under California law. If you send us such information anyway — in a message, a note, or an uploaded file — we will delete it when we notice it.

3. Where it comes from

We get personal information from four places:

• You — when you register, fill in a form, upload a file, or send a message.
• Your organization — when it creates your account, assigns your role, or enters records you appear in.
• Automatically — from your device and browser as you use the platform.
• Business data providers — for outbound business-to-business campaigns only. See section 8.

4. Why we use it

We use personal information to create and secure accounts; to provide the platform's features; to generate proposals, orders, and commission records; to send transactional messages you need in order to use your account; to send marketing messages you can unsubscribe from; to provide AI assistance; to detect and investigate fraud, abuse, and security incidents; to meet legal obligations; and to fix and improve the product.

We do not use personal information for automated decisions that produce legal or similarly significant effects about you without a human involved.

5. Who we share it with

Within the platform, your information is visible to your own organization according to the roles and permissions it configures. Enrollment lineage — who referred whom — is visible across organizations, because that relationship follows the person rather than the organization.

Outside the platform, we share personal information only with the service providers listed below, each of which is contractually limited to processing it for the purpose named and prohibited from using it for their own purposes. We also disclose information when the law requires it, to respond to lawful requests, to protect rights and safety, and to a successor in a merger or sale of assets, in which case we will say so before your information becomes subject to a different policy.

We have not sold personal information in the preceding twelve months, and we do not share it for cross-context behavioral advertising. The platform runs no advertising trackers, no advertising pixels, and no tag manager.

6. Service providers

The current list. It changes only through a code change that also updates this page, so the version date above tells you when it was last accurate.

• DigitalOcean — Application hosting, managed PostgreSQL database, and file storage (Spaces).
• Amazon Web Services (SES) — Delivery of transactional and marketing email.
• Sentry — Error and performance monitoring. Error reports can include the acting user's account identifier and the page they were on.
• Anthropic — Large-language-model processing for AI assistance features. Content sent for processing is not used to train their models.
• OpenRouter — Routing layer for large-language-model requests.
• Documenso — Electronic signature for proposals, contracts, and program agreements. Self-hosted by us.
• Smartlead — Delivery of outbound business-to-business email campaigns.
• PeopleDataLabs, LeadMagic — Business contact data and enrichment for outbound campaigns. See the section on business contacts.
• MillionVerifier, NeverBounce — Verifying that a business email address is deliverable.
• DNCScrub — Screening phone numbers against Do Not Call registries before outreach.
• Google Maps Platform — Address autocomplete and map display for property records.

7. Cookies and tracking

We use cookies and equivalent local storage only for things the platform cannot work without: keeping you signed in, protecting against cross-site request forgery, and remembering your language and display preferences.

There are no advertising cookies, no analytics cookies, and no third-party trackers. There is nothing here to opt out of, which is why you will not see a cookie banner. If that ever changes, this section and the version date change with it, and consent will be requested where the law requires it.

We honor the Global Privacy Control browser signal. Because we do not sell or share personal information, the signal has nothing to switch off, but it is recognized and recorded.

8. If we contacted you about your business

If you received a cold email from us and do not have an account, this section is the one that applies to you, and it is the notice at collection that the law requires we give you.

We obtain business contact information — name, business email address, job title, company, and company firmographics — from the business data providers named in section 6, and from public records and business filings. We use it to determine whether your organization is a fit for energy efficiency solutions and to contact you about that. We verify deliverability and screen phone numbers against Do Not Call registries before any outreach.

Every campaign email carries our mailing address and a one-click unsubscribe. Unsubscribing suppresses you across every campaign we run, not just the one you replied to, and the suppression is permanent.

California residents: business contacts have the same rights as everyone else — the business-to-business exemption expired on January 1, 2023. You can require us to tell you what we hold, correct it, or delete it, using the methods in section 11, and we will not treat you differently for asking.

9. How long we keep it

Account records are kept while the account is active and for two years after it is closed, so that commission history, proposals, and enrollment lineage stay reconstructible for the people who depend on them. Financial and commission records are kept for seven years, which is what tax and audit rules require.

Diagnostic logs and error reports are kept for ninety days. Outbound campaign records, including suppressions, are kept indefinitely — a suppression list only works if it is never forgotten. Consent records are kept for the life of the account and for six years after, because their purpose is to prove what was agreed and when.

Backups roll off on their own schedule, so deleted data can persist in backups for up to thirty-five days after deletion from the live system.

10. Security

Data is encrypted in transit and at rest. Passwords are stored as salted hashes and are not recoverable by us or by anyone else. Access is scoped by role and by organization, and administrative access is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities within the timeframes the law requires.

11. Your rights, and how to use them

Wherever you live in the United States, we extend the same core rights to everyone rather than checking your address first: the right to know what we hold about you and to get a portable copy, the right to correct it, the right to delete it, the right to opt out of marketing, and the right not to be discriminated against for exercising any of them.

California residents additionally have the right to know the categories of information collected, the sources, the business purposes, and the categories of recipients — all of which are stated above rather than only on request — the right to opt out of sale or sharing (we do neither), and the right to limit the use of sensitive personal information (we collect none).

To make a request, email the privacy contact below or call the number below. We will verify your identity against information we already hold before acting — usually by confirming control of the email address on the account. An authorized agent may act for you with written permission we can verify.

We respond within forty-five days and may extend once by another forty-five days where the request is complex, in which case we will tell you before the first period runs out.

12. If we say no

If we decline your request, we will tell you why in writing. You may appeal by replying to that decision or by writing to the privacy contact with the word "appeal" in the subject line. A person who was not involved in the original decision reviews it, and we respond within forty-five days with a written explanation.

If we deny the appeal, we will give you a way to contact your state Attorney General. This appeal process is available to everyone, not only to residents of the states that require one.

13. Children

The platform is for business use by adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child's information has reached us, contact the privacy contact and we will delete it.

14. Where data is processed

The platform is operated for use in the United States and Canada, and personal information is processed and stored in the United States. If you access it from elsewhere, you are transferring information to the United States, which may have different data protection rules than your country.

15. Changes to this policy

When this policy changes materially, we update the version date at the top, and we ask account holders to review and accept the new version at next sign-in. We keep every published version, and you can request a copy of the one that was in effect on any date.

16. Contact us

Privacy requests, questions, and appeals go to the privacy contact below. The phone number below is also the line to use if you would rather make a request by phone.