What we hold, and why.

The Fabrication Desk, Lawrenceville, GA 30046, runs this site and the trade platform behind it, and decides what is done with the information described here. To ask anything about it, use the contact page or call 470-584-8882.

What you type into a form. Name, company, email address, phone number, ZIP code, job address and whatever you write in the message, plus the project details behind an estimate — rooms, materials, dimensions, cutouts, dates.

What a trade application asks for. Legal and trading name, contact details, billing address, service area, website, business type, expected volumes, and the verification references you choose to give: a Georgia resale certificate (ST-5) number, a federal EIN, a contractor licence number, an insurance carrier and policy number. If you attach the ST-5 certificate or the certificate of insurance, we hold those files too.

A record of the terms you agreed to. When an application is submitted we store the version of the terms, a fingerprint of the exact sentence shown beside the checkbox, the IP address the submission came from and the browser user-agent string it sent. That record exists so an acceptance can say what was accepted, and it is used for nothing else.

Account information. Email address, name, phone number and role. A password is never stored: what is stored is a salted scrypt hash of it, which cannot be turned back into the password. A signed-in session is a random identifier with an expiry.

Files you upload. Drawings, layouts, photographs, field reports and certificates.

A small amount of usage data. First-party only, written on our own server by the action that caused it: an event name such as “estimate submitted”, with counts and codes. It never contains an email address, a phone number, an address or anything you typed, and there is no page-by-page browsing history.

No third-party analytics, no advertising pixels, no tracking scripts, no social embeds. The site loads no script from anywhere but this domain, and the browser is told to refuse anything else. We do not sell personal information and we do not share it for advertising.

Cookies. One, and only once you sign in: it holds a random session identifier and nothing else. There is no analytics cookie and no advertising cookie, which is why this site has no cookie banner to click through.

Email. Marketing email requires you to opt in, and the platform keeps a permanent do-not-contact list that overrides everything else. Contacts imported from a purchased or third-party list are excluded from automated sending outright.

To price the work you asked us to price; to decide whether a trade account should be opened, which is what the verification documents are for; to quote, schedule, produce and invoice the work; to keep the business records a job creates — quotes, orders, documents, payments and refunds; to keep the platform secure, which is what session records, rate limiting and the audit log are for; and to meet tax and accounting obligations.

Inside the business, the people handling your job. Uploaded files are held in private storage and opened through a link that expires within minutes, issued only to an administrator — nothing you upload is reachable by a public URL.

Outside it, the service providers that run the platform, each acting on our instructions: the hosting provider that serves this site, the database and file storage provider that holds the data, an email delivery provider for messages sent from the platform, and a payment processor where a payment is taken. Beyond those, information is disclosed only where the law requires it.

[FOR REVIEW: the reviewed version should name each processor and confirm the data processing agreement in place with it. The named providers are Vercel (hosting), Supabase (database and file storage), Resend (email delivery) and Stripe (payments). Email sending and payments are both switched off in this deployment today.]

Quotes, orders, invoices and the audit record are business records and are kept for as long as the account exists and for as long afterwards as tax and accounting rules require. Everything operational is kept on a shorter clock: expired sessions and used one-time links are removed within days; the body of a password-reset or invite message is deleted a week after it is written, because it contains a working link; usage events are removed after thirteen months; delivered webhook payloads after ninety days.

[FOR REVIEW: those periods are implemented as a database routine. Do not publish this section as a promise until the scheduled job that calls it has been observed running.]

Ask for a copy of what we hold about you, ask us to correct it, ask us to delete what we are not required to keep, or ask us never to contact you again. Ask through the contact page or by phone, and we will answer. Business records attached to work already done — quotes, invoices, orders — are kept even after an account closes, because they have to be.

[FOR REVIEW: response deadlines, identity verification, and which state privacy statutes apply to this business are for counsel to state.]