Privacy Policy

Effective September 10, 2026

RestorationGapFinder ("RestorationGapFinder", "we", "us", or "our") is a service operated by DohouGroup, a sole proprietorship registered in Ontario, Canada. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Information we collect

Account information — your name, work email address, company / organization name, and a securely hashed password. We never store your password in plain text.
Content you provide — the insurance estimates and documents you upload, photos you add, and claim details you enter (such as carrier, claim number, property address, loss type, and questionnaire answers). We use this solely to analyze the estimate and produce your gap report.
Payment information — if you purchase a paid plan, payment is processed by Stripe. Stripe handles your card details directly; we do not receive or store full card numbers. We retain only limited billing metadata (such as plan, subscription status, and the last four digits Stripe shares).
Technical information — basic server logs (such as IP address and request time) and essential cookies needed to keep you signed in.

How we use your information

To provide the service — read your estimate, check it against our rules, and generate your report.
To create and secure your account and verify your email address.
To process payments and manage your subscription (through Stripe).
To send you transactional email (such as email confirmation and team invitations).
To protect the service — including checking chosen passwords against known data-breach lists (see below).
To meet legal and accounting obligations.

We do not sell your personal information, and we do not use it for advertising.

How we share your information

We do not sell your personal information. We share it only in these limited ways:

Service providers — the trusted vendors listed below, who process data only on our behalf to run the service.
Within your organization — if you invite team members to your organization, they can access the claims, estimates, reports, and other content in that organization. Access is always scoped to your own organization.
For legal reasons — to comply with applicable law, respond to lawful requests from authorities, enforce our Terms, prevent fraud or abuse, or protect the rights, safety, and property of our users, the public, or us.
Business transfer — if DohouGroup is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any successor will remain bound by this policy or one at least as protective, and we will notify you of any change in who controls your data.

Cookies and analytics

We use only essential cookies required to keep you signed in and to operate the service. We do not use advertising or cross-site tracking cookies, and we do not run tracking pixels.

We use Vercel Web Analytics, a privacy-friendly, cookieless analytics tool, to measure aggregate usage of the site — such as page views, referring sites, and general device and country information. It sets no cookies, does not track you across other websites, and is not used to identify you individually.

Service providers

We use a small number of trusted providers to run the service. They process data only on our behalf, to provide their part of the service:

Supabase — database, authentication, and file storage.
Stripe — payment processing.
Resend — transactional email delivery.
Vercel — application hosting and privacy-friendly, cookieless web analytics.
Have I Been Pwned (Pwned Passwords) — when you set a password, we check it against known breaches using a privacy-preserving method (k-anonymity): only the first five characters of a hash of your password are sent, never your password, email, or full hash.

Where your data is stored (cross-border transfer)

Our database, authentication, and file storage are hosted with Supabase in the United States. This means your information — including content you upload — is stored and processed in the United States and may be accessible to authorities there under applicable law. By using the service you consent to this transfer. We use providers that offer industry-standard safeguards for the data they process.

How long we keep it

We keep your information for as long as your account is active and as needed to provide the service and meet legal, tax, and accounting obligations. Estimates and photos are automatically purged 90 days after a claim closes (configurable in your Settings), and you can delete data sooner at any time. We also run automated routines that purge data that is no longer required. When you close your account, we delete or anonymize your personal information within a reasonable period, except where we must retain certain records by law.

Security

We protect your information with measures including encryption in transit and at rest, hashed passwords, breach-screened passwords, and strict per-organization access controls so one organization can never see another's data. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and to limit who can access it.

Your privacy rights

Under PIPEDA you may request access to the personal information we hold about you, ask us to correct it, or withdraw your consent (which may mean we can no longer provide the service). To make a request, email privacy@restorationgapfinder.com. We will respond within the timeframes required by law. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Quebec residents (Law 25)

If you are a Quebec resident, Quebec's Law 25 (the Act respecting the protection of personal information in the private sector) also applies. In addition to the rights above, where the law allows you may ask us to stop disseminating your personal information or to de-index a link to it, and — where technically feasible — to receive the computerized personal information you provided in a structured, commonly used technological format (data portability). We have designated a person responsible for the protection of personal information (our Privacy Officer), who you can reach at privacy@restorationgapfinder.com.

If there is a privacy incident

If a confidentiality incident occurs that presents a risk of serious harm, we will notify the individuals affected and the relevant authorities (such as the Office of the Privacy Commissioner of Canada or Quebec's Commission d'accès à l'information) as required by law, and we keep a register of such incidents.

Children

The service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you.

Contact us

Questions or requests about your privacy? Contact DohouGroup (operating RestorationGapFinder), Ontario, Canada, at privacy@restorationgapfinder.com.