Legal
Privacy policy
Last updated: October 1, 2026
This policy explains what information Plumb Report collects, why, and what happens to it. It covers this website (www.plumbreport.com) and the application (app.plumbreport.com).
What we collect
Account details. Name, email address, business name and address, and the logo and colors you choose for reports. We need these to run your account and to put your branding on your reports.
Your inspection content. The photos you upload, the items, comments, captions and picklist values you enter, your comment library, and the PDF reports rendered from them. This is the purpose of the Service.
Billing information. Payments are handled by Stripe. We store your Stripe customer and subscription identifiers, invoice summaries and the per-inspection charges we calculate. We never see or store your full card number.
Sign-in and security data. Password hashes, passkey public keys, refresh tokens, recent sign-in attempts and the IP address and browser of sessions, to keep accounts secure and to detect misuse.
Usage and diagnostics. Server logs, error reports and basic usage metrics (for example, how many inspections and exports an account has made) so we can keep the Service running and improve it. This marketing website uses Google Analytics to count visits and see which pages are read; the application does not. We do not run advertising or sell data to advertisers on either site.
Messages you send us. If you use the contact or request-access forms we keep your name, email, what you wrote, and a hash of your IP address (to spot spam), so we can reply.
How we use it
To provide the Service and your reports; to bill you; to keep accounts secure; to answer your messages; to send account emails such as confirmations, sign-in codes and password resets; and to understand how the Service is used so we can improve it. We send no marketing email without your agreement.
AI drafting
If you choose "Draft report with AI" for an inspection, the photos for that inspection, the wording in your comment library and the relevant item structure are sent to our AI provider, Anthropic, which processes them to return suggestions. Anthropic processes this data under its commercial terms and, under those terms, does not use it to train its models. Inspections you complete by hand are never sent to an AI provider. The AI cost of each draft is recorded on your billing page.
Who else handles your data
We use a small number of providers to run the Service, each only for the purpose shown:
- Microsoft Azure hosts the application, database and file storage.
- Stripe processes payments.
- SendGrid (Twilio) delivers account email.
- Anthropic processes AI drafts, only for inspections where you request one.
- Netlify hosts this marketing website.
- Google provides address suggestions when you type an inspection address in the application, and Google Analytics measures visits to this marketing website.
We do not sell personal information, and we do not share it with anyone else except where the law requires it or to protect the Service and its users.
Where your data is
Data is stored in the United States. If you use the Service from elsewhere, your data is transferred to and processed there.
How long we keep it
Your account data and inspection content are kept for as long as your account is open. After an account is closed we keep its content for 30 days so an export can be requested, then delete it from active systems; backups age out within a further 35 days. Billing records are kept as long as tax and accounting rules require. Server logs are kept for 30 days. Messages sent through the website forms are kept until we have dealt with them and for a reasonable period afterwards.
Your choices and rights
You can view and change your account details and branding in the app. You can export any report at any time. You can close your account from the app or by asking us. Depending on where you live you may have rights to access, correct, delete or receive a copy of your personal information, or to object to certain uses; ask through the contact page and we will respond within the time the law requires.
Cookies and local storage
The application keeps a sign-in token in your browser's local storage so you stay signed in; signing out removes it. This marketing website uses Google Analytics, which sets cookies (such as _ga) to tell returning visitors from new ones; see how Google uses data from sites that use its services. Blocking those cookies in your browser does not affect anything on the site.
Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their information.
Changes
We will announce material changes to this policy by email or in the app before they take effect, and update the date at the top. Questions about privacy can be sent through the contact page.