Regulated Data Statement

This document classifies EdgeQuote against the regimes that carry their own heavy penalties (health, children, financial, biometric) and records the design decisions that keep the Service outside them. The short answer is that none applies today, by design, and the longer answer is what has to stay true for that to remain so. It was written after reading the data model and the estimator's question engine, not from assumptions.

1. Classification

2. What keeps the classification true (design controls)

1. No free-text input from Homeowners. Every estimator question is an option list or a number with a unit, defined by the price sheet; the only free-text fields are name, email, phone, postal code and best time to call. A Homeowner cannot volunteer a diagnosis, a disability, an account number or a child's name in an answer. [Verified against the question engine on 2026-09-06; if a free-text question type is ever added, this document is wrong.]
2. Photographs are stored, not analysed. No face detection, no OCR, no object recognition, no machine-learning model. Adding any of those would engage BIPA-style laws and the DPIA criteria.
3. The Acceptable Use Policy §2 prohibits Contractors from collecting health, financial-account, government-identifier, biometric or children's data through the Service, and §3A prohibits such content in photographs and notes.
4. Card data never touches our systems (WISP §12).
5. The financing line is fixed-format: an APR and a term entered by the Contractor, an arithmetic monthly figure, and a mandatory "illustrative only, subject to credit approval, not a lending offer" sentence. No application, no decision, no data sent to a lender.
6. No age-attractive features: no games, no rewards, no characters, no social features, no accounts for Homeowners.

3. Children — the clause and the steps that back it

Clause (in the Terms §3, the Privacy Policy §13 and the Homeowner Notice): "The Service is for businesses and for adult homeowners. It is not directed at children, we do not knowingly collect personal data from anyone under 16, and we have no feature that would identify a user's age. If you believe a child has given us data, write to us and we will delete it." Contractors must be at least 18 to hold an account [VERIFY the Terms §3 says so; if not, the fix in this run adds it].

Why 16 and not 13. COPPA's line is 13; the GDPR's default is 16 (Art. 8), with member states able to lower it to 13 (France chose 15). Using 16 everywhere is the simplest rule that satisfies all of them.

Steps that keep children out, and what we deliberately do not do:

• No age gate is shown, because asking every Homeowner their age would collect more data than the Service needs and would itself be a COPPA-style signal that children are expected. A gate is required only where a service is child-directed or has actual knowledge, and neither is true.
• A Homeowner who submits an estimate must give a name and a contact detail; the estimator's subject matter (paying a contractor thousands of dollars for a roof) is not one a child engages with.
• Actual knowledge protocol: if any Contractor or member of staff learns that a lead came from a child under 16 (a note says so; the person says so; a parent writes in), the lead and its photographs are deleted at once through the Data Deletion Procedure, the Contractor is told not to contact the person, and the event is logged. No verification of the claim is required before deleting; deleting on notice costs nothing.
• If a Contractor's trade were ever one that markets to children (none is), the estimator would not be made available for it.

4. Health — the trap, and why we stay outside it

Most consumer products that fall foul of the FTC's Health Breach Notification Rule are not healthcare businesses; they are apps that collected a health-related fact and then shared it with an advertiser. EdgeQuote shares nothing with advertisers (Cookie Statement; us-privacy.md §2) and collects no health fact. One trade needs a specific rule: a Contractor doing accessibility or mobility renovations (ramps, walk-in showers, stair lifts) might want to ask why the customer needs the work. That question must never be added. Ask about the building ("Is there an existing ramp?"), never about the person.

5. Financial — the two things that matter

1. Card data stays with Stripe. This is the whole of our PCI posture and most of our financial-privacy posture. No engineer may add a card field to any page.
2. The financing line is advertising, not lending. Under Regulation Z (12 CFR §1026.24) stating a monthly payment is a triggering term; the fixed sentence supplies the required APR and term. Under French law, credit advertising needs the L312-5 sentence, which is added in this run to the French version. Neither makes us a lender, broker or intermediary; if the Service ever routed a Homeowner to a lender, passed data to one, or received a fee from one, licensing regimes (state lending and brokerage licences; France's IOBSP status) would engage. It must not.

6. Biometric — one sentence

Photographs are pixels we store and show to one Contractor; no template, hash or measurement of any human feature is ever created. That is the entire reason BIPA (with its USD 1,000 to 5,000 per-violation private right of action) does not apply, and it is a design constraint, not a policy.

---

NOTES FOR YOUR LAWYER

1. These regimes need a specialist, and documents alone are not compliance. This document records that none applies and why. If the owner ever wants to serve a healthcare-adjacent trade, add a free-text question, analyse photographs, take card data directly, or route Homeowners to a lender, stop and instruct a specialist in that regime before writing a line of code.
2. Confirm the COPPA "actual knowledge" reading in Section 3 and the decision not to age-gate, which is deliberate.
3. Confirm the HBNR analysis in Section 4, particularly that a photograph of a bathroom with grab rails is not "health information" merely because it implies something about the occupant.
4. Confirm the Regulation Z and L312-5 treatment of the financing line (also in Disclaimers, note 3).
5. Terms §3 minimum age. Verify the Terms state 18 for account holders; the reality-match pass checks it.

WHAT THIS DOES NOT COVER

• Any regime for a trade EdgeQuote does not serve (healthcare, finance, education, childcare).
• Contractors' own regulatory obligations in their trade.
• Export-controlled or defence data (none).
• Any change to the product after 2026-09-06.