Privacy Policy

1. Who we are

EdgeQuote ("EdgeQuote," "we," "us") is an instant-estimate and lead-capture service for trade contractors, operated by Sebastien Vautier (professionally known as Sebastien Ricci), a sole proprietor trading as Beyond the Edge Studio. Registered address: 4375 N Las Vegas Blvd, Suite 7, PMB 5028, Las Vegas, NV 89115, USA. Contact: sebastien@beyondtheedgestudio.com. The Service is published at edgequote.beyondtheedgestudio.com.

Three groups matter in this policy:

• Contractors — the trade businesses who hold an EdgeQuote account, configure an estimator, and receive the leads it produces.
• Homeowners — people who use a Contractor's estimator to get a price range and, if they choose, leave their contact details so that Contractor can follow up.
• Prospective contractors — people who ask us for a demo through our own marketing pages, and businesses we identify ourselves and approach by email or telephone to introduce EdgeQuote.

Roles. For Homeowner data, the Contractor is the data controller and EdgeQuote acts as a processor on their documented instructions. That relationship is governed by our Data Processing Addendum. For Contractor account data and for demo requests, EdgeQuote is the controller. This policy describes both, and says which is which in each section.

2. Information we collect

From Contractors (we are controller): account email address, role, the business details you enter (business name, logo, accent colour, currency, locale, service-area postal prefixes, notification email addresses and mobile numbers, business telephone number, reply-to address, sending domain), your price sheet and estimator configuration, your webhook destination and its shared secret, sign-in timestamps, and your session records (expiry, last-seen time, browser user-agent string, and a hashed IP address — never the raw address), and the record of your acceptance of these documents (which versions you accepted, when, the browser user-agent string and a hashed IP address), and the record of each notice of a change to these documents that we send you (your account email address, what changed, the date it takes effect, and whether the message was delivered).

From Homeowners, on the Contractor's behalf (Contractor is controller): the name they give, and an email address, a phone number, or both; their answers to the Contractor's estimator questions and the plain-language summary of those answers frozen at submission; the estimate range calculated for them and its breakdown; the postal code or area they enter; their preferred contact time or requested appointment window; up to three job photographs they choose to upload; the page address the estimator was embedded on; a hashed IP address; and the timestamp and version of the consent wording they were shown. Notes the Contractor later adds to the lead, and the contract value if the job is won, are also stored on that record.

Billing (we are controller) — [EFFECTIVE WHEN BILLING LAUNCHES — as at 2026-09-06 the Service has no payment integration and collects no billing data]: when paid plans launch, payments will be processed by Stripe. Your card number is typed into Stripe's own form and goes directly to Stripe; we never receive or store it. We receive and keep the billing name and address you give, the card brand, its last four digits and expiry month, your VAT or tax identification number if you supply one, your plan and billing period, and your invoice and payment history. Stripe processes card data as an independent controller under its own privacy policy, for fraud prevention and for its regulatory duties, and acts as our processor for the rest.

From prospective contractors who ask for a demo (we are controller): name, business name, email address, optional phone number, the trade selected and the language of the page the request was sent from (English or French), plus a hashed IP address.

About prospective contractors we approach ourselves (we are controller): business name, trade, the business contact's name, business email address and telephone number, business postal address, website, contractor-licence number where it is public, and our notes of any contact with you. We obtain these from public sources: your own website, business directories and review sites, public contractor-licence registers (for example a state contractors-board licence search), trade-association member lists, and professional networking sites. [PLACEHOLDER — if a purchased or rented contact list is ever used, name the vendor here. Proposed default: none.] We never obtain prospect data from the estimator or from any Homeowner. The first message or call you receive from us tells you where we found your details and how to stop, because GDPR Art. 14 requires that when data is not collected from you directly.

Automatically: application and security logs, aggregated daily counts per Contractor (estimator views, sessions started, sessions completed, leads produced, total estimated value, and how many people answered each question), rate-limit counters, and records of abuse signals. The per-question and per-day counters are aggregate only: they hold no identifier for any individual and cannot be traced back to one.

Email deliverability. If a message we send on a Contractor's behalf bounces or is reported as spam, we record the recipient's email address on a suppression list with the reason, so we stop mailing an address that does not exist or does not want us. That list exists to protect recipients and our sending reputation.

What we deliberately do not collect. We do not store raw IP addresses anywhere; every IP is hashed before it is written. We do not collect payment card details of any kind. We do not collect government identifiers, health data, biometric data, precise geolocation, or data about racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation. We do not knowingly collect data from children.

3. Cookies and tracking

The estimator sets no cookies at all. It writes nothing to your browser's local or session storage, loads no analytics script, no advertising pixel, and no session-replay or heat-mapping tool, whether it is used on our domain or embedded in a Contractor's own website. The usage counts in Section 2 are produced on our server from the request itself and are aggregated per day; there is no per-visitor record, no visitor identifier, and no cross-site tracking.

The Contractor dashboard sets two strictly necessary cookies: eq_session, which keeps a signed-in user signed in, and eq_view_as, which records that an agency administrator is temporarily viewing a specific Contractor's account. Neither is used for advertising or analytics.

Because there is nothing to opt out of, a "Do Not Track" or Global Privacy Control signal changes nothing: we treat it as a request to opt out of sale and sharing, which is already everyone's position. This is set out in full in our Cookie and Tracking Statement.

When billing launches, the checkout and billing pages of the dashboard will load Stripe's script, which sets Stripe's own fraud-prevention cookies (__stripe_mid, __stripe_sid) on those pages only. They are necessary to take payment and are listed in the Cookie Statement. The estimator remains cookie-free.

4. How we use information

We use Contractor information to operate accounts, authenticate sign-in, publish and serve the estimator, deliver leads and notifications, produce the Contractor's own reports, provide support, prevent abuse, and meet legal obligations. When billing launches we will also use billing information to charge the subscription, issue invoices, handle failed payments, refunds and disputes, and keep the accounting records the law requires.

We use the information of prospective contractors only to introduce EdgeQuote to your business, by email or telephone, to answer a demo request, and to record that you have asked us not to contact you again. We do not profile prospects, score them, or enrich their records with data about them as individuals.

We process Homeowner information only to provide the Service as the Contractor has configured it: calculating and displaying the estimate range, emailing and, where enabled, texting the Contractor that a lead has arrived, sending the Homeowner a copy of their own estimate, delivering the lead to a webhook destination the Contractor has configured, displaying the lead and any photographs in the Contractor's dashboard, and exporting it when the Contractor asks. We also process it to detect and block abuse of the form.

We do not sell personal information, we do not share it for cross-context behavioural advertising, we do not use Homeowner data to market anything of our own, and we do not use it to train artificial-intelligence models. EdgeQuote has no AI features.

5. Legal bases (GDPR Art. 6)

Where the EU or UK GDPR applies, the bases are:

6. What Homeowners are told, and when

Before a Homeowner submits their details, the estimator displays: "By continuing you agree to be contacted by [the Contractor's business name] about this project." (in French: "En continuant, vous acceptez d'être contacté par [business] au sujet de ce projet."). We record when they agreed and which version of that wording they were shown, so the Contractor can demonstrate consent as GDPR Art. 7(1) requires rather than merely assert it. The current version identifier is 2026-09-07.v3 (the sentence with the link to version 0.3 of the notice); 2026-09-06.v2 was the same sentence linking version 0.2 of the notice, and 2026-08-23.v1 was the same sentence shown without the link.

That sentence alone is a contact permission, not a full Art. 13 notice. The complete point-of-collection notice for Homeowners is the Homeowner Privacy Notice, which is linked from the estimator's contact step, directly beneath that sentence, in English and in French, and is published at edgequote.beyondtheedgestudio.com/legal/homeowner-notice. See NOTES FOR YOUR LAWYER.

7. Sharing

We share information only with:

(a) Sub-processors needed to run the Service. The current list, with role and location, is at subprocessors.md and is published at edgequote.beyondtheedgestudio.com/legal/subprocessors. In summary: Vercel Inc. (application hosting), Neon Inc. (managed PostgreSQL database), Resend Inc. (transactional email), Twilio Inc. (SMS notifications to Contractors, where the Contractor enables them), and Cloudflare Inc. (Turnstile bot verification on public forms). When billing launches, Stripe, Inc. (payment processing) is added; for card data Stripe is an independent controller, not our processor.

(b) The Contractor whose estimator the Homeowner used. That is the entire purpose of the Service.

(c) Destinations the Contractor connects. If a Contractor configures a webhook, lead data is sent to the address they specify. That transfer happens on the Contractor's instruction, to a destination we do not control, and the receiving service's own terms then apply. We verify the destination is a public HTTPS address and refuse internal or reserved network ranges, but we cannot vouch for what happens after delivery.

(d) Authorities, where we are legally required to disclose, and a successor if the business is sold, in which case this policy continues to apply until replaced with notice.

We do not otherwise disclose personal data, and we do not sell it. Reading your business details from a public source is not a disclosure by us to anyone.

8. International transfers

We operate from the United States and use US-based sub-processors. Where personal data of people in the EEA, the UK or Switzerland is transferred to us or to a sub-processor outside those areas, the transfer is made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with the supplementary measures described in Section 9. [PLACEHOLDER — confirm with each sub-processor that its current DPA incorporates the 2021 SCCs and the UK Addendum, and retain a copy.] See NOTES FOR YOUR LAWYER.

9. Retention

• Leads are erased 24 months after they are created. A Contractor may set a shorter or longer window on their own account; the permitted range is 1 to 84 months and it cannot be switched off. Erasure is carried out by a daily job whose runs are recorded, so a job that silently stops is detectable.
• Demo requests are erased 12 months after they are made.
• Prospective contractors we approach: the business contact record is erased 12 months after our last contact if you have not replied [PROPOSED DEFAULT — confirm]. If you ask us not to contact you, we keep only your name, email address and telephone number on a do-not-contact list, for as long as needed to honour that request.
• Billing records (when billing launches): invoices, payment history and tax identifiers are kept for 7 years after the transaction [PROPOSED DEFAULT — US federal tax guidance ranges from 3 to 7 years; French accounting law (Code de commerce art. L123-22) requires 10 years for accounting documents; confirm with the accountant, see tax-and-invoicing.md]. Card brand and last four digits are deleted when the subscription ends and the dispute window has closed.
• Job photographs uploaded but never attached to a submitted lead are purged within hours by the same daily job. Photographs attached to a lead are deleted with that lead.
• Contractor accounts you ask us to close stop serving estimates at once and are deleted 30 days later by the same daily job: the account, its sign-ins, its leads, job photographs, price sheet and configuration. Until then you can still sign in and download everything. Your acceptance record and the record of any notice we sent you are kept without the link to the deleted account, and a legal hold set on the account while a dispute is foreseeable postpones the deletion until it is lifted.
• Sign-in tokens expire in 15 minutes and no more than three may be outstanding at once; expired tokens and sessions are purged automatically.
• Rate-limit counters and IP blocks expire on their own schedule and are swept daily.
• Consent records are kept with the lead they belong to and are erased with it.
• Aggregate daily counts hold no personal data and may be kept indefinitely.
• Suppression-list entries (bounced or complained addresses) are kept for as long as needed to avoid mailing that address again.
• Records needed for accounting, tax, or to establish or defend a legal claim are kept for as long as the applicable law requires.

10. Security

Connections to the Service are made over TLS, and the email we send is delivered over TLS to every receiving mail server that supports it (nearly all do); a receiving server that offers no TLS receives the message unencrypted, which is the standard "opportunistic TLS" behaviour of email. IP addresses are hashed before storage and never written in raw form. Sign-in is by single-use magic link, rotated on redemption rather than on request, so a link intercepted in transit cannot be replayed after use. Sessions are server-side records that can be revoked. Webhook payloads are signed. Incoming provider webhooks are signature-verified before they are trusted. Public forms are protected by bot verification, per-address and per-network rate limits, and abuse recording. Uploaded images are checked against their actual file signature and re-encoded before storage. Access to Contractor data is scoped to that Contractor, and agency-administrator access is recorded. A security gate runs on every change to the codebase.

No method of transmission or storage is completely secure. If a personal-data breach occurs that is likely to result in a risk to affected people, we will notify affected Contractors without undue delay so that they, as controller, can meet their own notification duties, and we will notify supervisory authorities where we are required to do so directly.

11. Your rights

If the EU or UK GDPR applies to you you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your national supervisory authority. In France that is the CNIL (cnil.fr).

If a US state privacy law applies to you (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana) you have the right to know what is collected and why, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of sale, of sharing for cross-context behavioural advertising, and of profiling with legal or similarly significant effects. We do none of those three things, so there is nothing to opt out of and no "Do Not Sell or Share My Personal Information" link is required. You may not be discriminated against for exercising a right.

Marketing. You can stop marketing email with the unsubscribe link in any message we send, and stop calls by telling the caller or writing to us. Email opt-outs are honoured within 10 business days (the CAN-SPAM limit, 15 U.S.C. §7704(a)(4)) and usually immediately; call opt-outs are recorded at once. Opting out of marketing does not affect service messages about an account you hold.

Nevada residents may direct us not to sell covered information (NRS 603A.340) by writing to the address in Section 15. We do not sell it, and we will confirm that in writing within 60 days as the statute allows.

How to exercise a right. Homeowners should contact the Contractor whose estimator they used, because that Contractor is the controller of their data; the Contractor can act on the request directly from their dashboard. If you cannot reach them, or you do not know which business it was, write to sebastien@beyondtheedgestudio.com and we will locate your records by email address or by phone number and act on them, or pass the request to the responsible Contractor and tell you we have done so.

We verify a request against the contact details already on the record and may ask for further reasonable verification. We respond within 30 days where the GDPR applies and within 45 days, extendable once with notice, where US state law applies. An authorised agent may act for you with written proof of authority. If we refuse a request you may appeal by replying with "Appeal" in the subject line; we answer appeals within the period your state's law sets, and you may also contact your state Attorney General.

We make no automated decisions producing legal or similarly significant effects about anyone. The estimate range is an arithmetic calculation from the Contractor's own published price sheet and the answers given. It is an indicative price range, not a decision about a person, not a credit assessment, and not a binding quotation.

12. California specifics (CCPA/CPRA)

In the last 12 months we collected the categories described in Section 2: identifiers (name, email address, phone number, hashed IP address); customer records (postal area, project answers); commercial information (estimate ranges, lead status, contract value where a Contractor records one); internet or network activity (service logs, aggregate usage counts); visual information (job photographs the Homeowner chooses to upload); and professional information (a Contractor's business details). They were sourced from you, from your device, and from the Contractor whose estimator you used, for the purposes in Section 4, and disclosed only to the sub-processors in Section 7.

We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding 12 months, and we do not do either now. We do not use sensitive personal information beyond what is necessary to provide the Service, and we draw no inferences about personal characteristics. Requests under Cal. Civ. Code §1798.83 ("Shine the Light") go to the address in Section 11. The retention period for each category is in Section 9, which serves as the retention disclosure the CPRA requires in a notice at collection.

We believe we are currently below the thresholds that make a company a "business" under the CCPA (annual gross revenue above the inflation-adjusted $25 million figure; buying, selling or sharing the personal information of 100,000 or more consumers or households; or deriving half or more of revenue from selling or sharing personal information). We apply this section anyway, and we act as a service provider to California Contractors on the terms in our Data Processing Addendum. The full state-by-state position is in the US State Privacy Statement.

13. Children

The Service is for businesses and for adult homeowners. It is not directed at children, we do not knowingly collect personal data from anyone under 16, and we have no feature that would identify a user's age. If you believe a child has given us data, write to us and we will delete it.

14. Changes

We will post a new "Last updated" date when this policy changes, and we will tell Contractors by email before a material change takes effect. If a change materially affects how Homeowner data is processed, the consent version identifier in Section 6 is incremented so that existing records still point at the wording that was actually shown at the time.

15. Contact

sebastien@beyondtheedgestudio.com. Postal address for formal notices: 4375 N Las Vegas Blvd, Suite 7, PMB 5028, Las Vegas, NV 89115, USA.

EU representative (GDPR Art. 27): [PLACEHOLDER — name and address of the appointed representative. Proposed default: appoint a commercial Art. 27 representative service established in France or Ireland before publication; the same service can usually act as UK representative under UK GDPR Art. 27.] Until an appointment is made, none is designated; see NOTES FOR YOUR LAWYER and the GDPR Operations Kit.

---

NOTES FOR YOUR LAWYER

1. Art. 13 notice at the point of collection — fixed in this run, please verify. Until 2026-09-06 the estimator showed one sentence of contact consent and linked no notice. The contact step now shows a link to the Homeowner Privacy Notice directly beneath that sentence, in both languages, and the notice is served at /legal/homeowner-notice. The consent version identifier was incremented to 2026-09-06.v2 so records show which version carried the link, and again to 2026-09-07.v3 when version 0.3 of the notice corrected the retention range it states. Confirm that a one-sentence consent plus a linked notice satisfies "at the time when personal data are obtained" (Art. 13(1)), and that the Contractor, as controller, may rely on a notice we host.
2. GDPR Art. 27 representative. The Service is offered in French, priced in euros, and aimed at French contractors: strong evidence of targeting the EU under Art. 3(2). A processor with no EU establishment that targets the EU must generally designate a representative in writing unless the Art. 27(2) exemption applies (occasional processing, no large-scale special-category data, unlikely to risk rights). Our position: the exemption is arguable while volumes are small, but the cost of appointing is low and the fine exposure (Art. 83(4)(a)) is not. Proposed default: appoint before publication. Decide, then fill Section 15.
3. Controller/processor split. This pack treats the Contractor as controller of Homeowner data and EdgeQuote as processor. That is the honest description of the product, but EdgeQuote also sets the retention default, the security measures, the consent wording, and the suppression list. Confirm this is a processor relationship and not joint controllership under Art. 26. If joint, an Art. 26 arrangement and a public summary of it are required. Our reasoning for "processor" is in the GDPR Operations Kit.
4. Standard Contractual Clauses. Section 8 asserts SCC coverage. Verify each sub-processor's current DPA incorporates the 2021 SCCs with the correct module and the UK Addendum, and keep executed copies. Do not leave this as an assertion. The Data Privacy Framework is a possible alternative for US sub-processors that are certified; the SCCs are relied on here because a DPF certification can lapse.
5. Stripe's roles. When billing launches, Stripe is an independent controller for card data (its own fraud and regulatory processing) and our processor for the rest; Stripe's standard terms say the same. Section 2 and Section 7 are drafted on that basis. Confirm the split and that Stripe's DPA and SCC module cover it. Stripe's script only loads on billing pages, so the estimator stays cookie-free.
6. B2B prospecting legal basis. Section 5 relies on legitimate interests for approaching businesses, with Art. 14 source disclosure at first contact and objection under Art. 21(2). That is the CNIL's accepted position for B2B email that relates to the recipient's profession, and the UK PECR position for corporate subscribers. It is not enough in Germany (UWG §7 requires consent for email even to businesses), for UK sole traders and partnerships (PECR treats them as individual subscribers), or for calls to US mobile numbers with an autodialler (TCPA). The country rules and the exact opt-out mechanics are in the Marketing Compliance Playbook; confirm the basis and the country list.
7. Suppression list lawful basis. Retaining a bounced, complaining, or opted-out address indefinitely is justified as a legitimate interest in not contacting them again, which is what regulators expect. Confirm, and confirm that an erasure request should not remove a do-not-contact entry (removing it would let contact resume).
8. Photographs. Homeowners upload photographs of their own property. Those may incidentally contain other people, vehicle plates, or documents. There is no automatic redaction. The Homeowner notice now warns against including other people; confirm that is sufficient.
9. Nevada governing law with EU users. Section 15 of the Terms selects Nevada law and arbitration seated in Las Vegas. Mandatory consumer-protection and data-protection rules in France, the EU and the UK cannot be displaced by that choice, and the GDPR applies regardless. The Terms carve those out; confirm the carve-outs are wide enough.
10. Retention defaults. The 12-month prospect window and the 7-year billing-record period are proposed defaults, marked as such. Confirm against Nevada, federal and French record-keeping rules; the accountant should confirm the billing figure.
11. CCPA thresholds. Section 12 states we are below the "business" thresholds but applies the section anyway. Confirm the reading, and confirm the service-provider terms in the DPA meet Cal. Civ. Code §1798.140(ag) and the CPPA regulations (they were drafted to).
12. Blank facts. The registered business address and the postal notice address were filled on 2026-09-07 (the studio's address on every other Beyond the Edge product; it is a commercial mail-receiving agency box). The EU representative and any list vendor are still marked [PLACEHOLDER] and must be filled before publication.

WHAT THIS DOES NOT COVER

• The Contractor's own privacy policy. Each Contractor is a controller in their own right and needs their own notice; this document does not serve as one for them, and nothing here tells them what their own obligations are.
• Any obligation arising from how a Contractor uses lead data after we deliver it, including calling, texting, or emailing a Homeowner. Telephone and messaging consent rules (for example the US TCPA, state mini-TCPA statutes, and French rules on unsolicited commercial contact) apply to the Contractor, not to us.
• Employment, contractor, or supplier data of Beyond the Edge Studio.
• Any jurisdiction outside the US, the EEA, the UK and Switzerland.
• Sector-specific regimes. EdgeQuote is not designed for and must not be used to collect health, financial-account, biometric, or children's data. See the Regulated Data Statement.
• Stripe's own processing of your card details, which is governed by Stripe's privacy policy, not this one.