Privacy Policy

Effective September 6, 2026

1. Introduction

CurbBid Inc. (“CurbBid,” “we,” “us,” or “our”) is a Delaware C-corporation based in Texas that operates the CurbBid platform at curbbid.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and platform.

CurbBid serves two types of users: contractors who create authenticated accounts to manage their business, and customers who access estimates, invoices, and payment pages via public token URLs without creating an account.

2. Information We Collect

Information You Provide

  • Contractor accounts: Name, email address, password, or Google OAuth credentials (name, email, profile image)
  • Business profiles: Business name, address, phone number, email, and logo
  • Customer records: Name, address, phone number, and email as entered by contractors
  • Estimate acceptance: Typed name, consent text, and related signature data under the ESIGN Act
  • Waitlist and demo signups: Name, business name, email, and phone number
  • Referral program: Referral codes and associated contact information
  • Account notification recipients: Name and mobile number of each person a contractor designates to receive account alerts, plus the consent record created when that person opts in (the disclosure text they agreed to, its version, and the date, time, and IP address of the submission)

Information Collected Automatically

  • IP address, browser type, operating system, and user agent
  • Session data and authentication tokens
  • Estimate and invoice view timestamps and activity logs
  • Product analytics via PostHog (only with your consent)

Information from Third Parties

  • Google OAuth: Name, email address, and profile image when you sign in with Google
  • Google Calendar (optional): When an account owner or administrator connects Google Calendar, we list the calendars available to that Google account so you can choose by name. We access the selected calendars' identifiers, names, access permissions, timezones, and event times and status needed to determine availability. We do not request or save titles, descriptions, participants, or locations from your existing events. We store busy start/end times, selected calendar identifiers and names, authorization tokens, synchronization status, and identifiers of job events we create. Connecting Calendar is separate from signing in with Google. If you cancel or do not finish choosing calendars within ten minutes, we delete the temporary authorization credentials from our active database.
  • Stripe: Payment status and transaction identifiers. We never receive or store your full credit card numbers.

3. How We Use Your Information

  • Operating and improving the CurbBid platform
  • Processing payments through Stripe
  • Sending transactional SMS messages via Twilio and emails via Resend on behalf of contractors
  • Authenticating users and managing sessions
  • With your authorization, reading busy time from your selected Google calendars to prevent conflicting online bookings, and creating, updating, or removing Google Calendar copies of jobs scheduled in CurbBid
  • Maintaining ESIGN Act compliance records (signer identity, IP address, user agent, timestamp, document hash, consent text, and line item snapshots)
  • Analyzing product usage via PostHog (consent-gated)
  • Preventing fraud and abuse
  • Communicating product updates, launch information, and support

4. How We Share Your Information

We do not sell, rent, or share your personal data - including your phone number - with third parties for their marketing purposes. We may share information with the following parties solely to operate the Service:

  • Service providers: Stripe (payments), Twilio (SMS), Resend (email), Convex (database and backend), Turso (authentication database), Google (sign-in, Calendar synchronization, and address autocomplete) and PostHog (analytics)
  • Address suggestions: As you type an address into an autocomplete field, that text is sent to Google Maps to suggest matching addresses. Google's Privacy Policy applies to this processing. You can also enter an address manually.
  • Contractor–customer sharing: Contractors can view customer information they have entered. Customers can view contractor business information on estimates and invoices shared with them.
  • Legal requirements: When required by law, regulation, legal process, or government request
  • Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

4a. Account Notification Text Messages

CurbBid sends recurring automated account notification text messages — new lead alerts, missed-call alerts, quote activity, and payment confirmations — to contractors and to the team members they designate. We send these messages only to people who have opted in themselves: the designated person opens a private opt-in link, confirms their own mobile number, and checks a consent box that is never pre-checked. No text is sent to a number before that form is submitted.

Message frequency varies with how busy the business is. Message and data rates may apply. Consent is not a condition of purchase. Reply STOP to any message to cancel or HELP for help. Wireless carriers are not liable for delayed or undelivered messages.

We keep a record of each opt-in and opt-out (including the exact disclosure text agreed to) to meet our carrier and legal obligations. Mobile numbers and consent records collected for account notifications are used only to deliver these alerts and are never sold, rented, or shared with third parties for their marketing purposes. See the Terms of Service for the full SMS program disclosure.

4b. Google Calendar Data and Your Choices

Calendar access is optional. After authorizing access on Google's consent screen, you choose an editable calendar by name. It receives your CurbBid jobs and its busy events block company booking availability. You can optionally select one additional calendar to block availability; CurbBid does not write job events to that additional calendar. We send job titles, start/end times, a synchronization description, and internal job identifiers to Google to maintain calendar copies. People who already have access to the calendar receiving jobs may see those job events according to its sharing settings. Public booking pages show availability without revealing the titles or details of your existing Google events. Changing the job calendar moves CurbBid's synchronized job copies to the new destination; it does not move your other Google events.

Google Calendar data is used only to provide and support the calendar features you request. We do not sell it, use it for advertising or credit decisions, or use it to train generalized artificial intelligence or machine learning models. We do not allow people to read your Google user data except with your affirmative agreement for specific data, when necessary for security or legal compliance, or in aggregated and anonymized form for internal operations as permitted by Google's policy. Our infrastructure providers process this data only as needed to operate these features.

CurbBid's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. These limits apply to Google API data even where other sections of this policy describe broader uses of other information.

In Settings → Scheduling, select Disconnect to stop synchronization and remove the stored Calendar connection, tokens, imported busy times, and synchronization records from our active database. You can also revoke permission in your Google Account connections. Disconnecting does not delete your CRM jobs or existing Google events. You can remove calendar copies directly in Google after disconnecting. For additional deletion requests, contact matt.staab@curbbid.com.

5. Cookies and Tracking

On our marketing site (curbbid.com) we use three categories of cookies and similar technologies:

  • Necessary cookies that keep the site working and remember your consent choice. Always on.
  • Product analytics from PostHog so we can understand which pages and features are useful and where the site needs improvement.
  • Marketing & retargeting via the Meta Pixel so we can show relevant CurbBid ads to people who have visited the site on Facebook and Instagram.

Analytics and marketing cookies are on by default under our implied-consent model, and you can turn either category off at any time. Use the “Cookie Preferences” or “Your Privacy Choices” link in the footer of any page, or see the Cookie Policy for the full list of cookies and durations. The CurbBid application at app.curbbid.com uses its own authentication and payment cookies, which are described separately.

6. Data Retention

  • Google Calendar connection: Authorization tokens and synchronization records are retained while connected. Imported busy-time windows are replaced on each successful sync. Disconnecting or deleting the business account removes this data from our active database. Residual backup copies follow our infrastructure providers' backup retention cycles and are not used for ongoing synchronization.
  • Account data: Retained while your account is active and for a reasonable period after deletion
  • ESIGN acceptance records: Retained indefinitely for legal compliance
  • Payment records: Retained as required by tax and financial regulations
  • Other data: Deleted upon request, unless retention is legally required

7. Data Security

We protect your information using TLS encryption in transit, secure cloud infrastructure, and access controls. While no system is 100% secure, we use commercially reasonable measures to safeguard your data against unauthorized access, loss, or misuse.

8. Your Rights

You have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data (subject to legal retention requirements)
  • Withdraw consent for analytics cookies at any time

California residents: Under the CCPA/CPRA, you have additional rights including the right to know what personal information we collect and share, the right to delete, and the right to opt out of “sharing” for cross-context behavioral advertising. We do not sell personal information for money. We do use the Meta Pixel for retargeting on our marketing site, which may constitute “sharing” under California law - you can opt out at any time using the “Your Privacy Choices” link in our footer or by turning off the “Marketing & retargeting” category in Cookie Preferences. To exercise any other rights, contact us at matt.staab@curbbid.com.

9. Children’s Privacy

CurbBid is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

11. Contact

Questions about this policy? Email us at matt.staab@curbbid.com.