Privacy Policy
Data Collection, Use, and Protection — GDPR & CCPA Compliant
1. Information We Collect
Contact & Business Information: Name, company name, email address, phone number, WhatsApp number, business address, EIN/RNC, and business license information provided during discovery consultations or form submissions.
Usage Data: Pages visited, time on site, browser type, IP address, referral source, and interaction data collected through standard web analytics.
Financial Data: We do not store payment card data. All transactions are processed securely by Square, Inc. and/or Wise (TransferWise). We may retain invoice records for accounting compliance.
Communications: Email, WhatsApp, and call records used in the delivery of contracted services and support.
2. How We Use Your Information
- To deliver, configure, and maintain contracted digital services
- To communicate project updates, invoices, and support responses
- To comply with legal, tax, and regulatory obligations
- To improve our service offerings and internal tooling
- To send relevant service announcements (you may opt out at any time)
- We do not sell or rent your personal information to third parties
3. Data Sharing & Third Parties
We share data only with service providers necessary to deliver contracted services:
Square, Inc.
Payment processing & POS catalog
Supabase / Vercel
Database & hosting infrastructure
Odoo S.A.
ERP platform services
WhatsApp / Meta
Communication platform
Google Workspace
Email & document collaboration
Wise (TransferWise)
International wire transfers
4. Your Rights (GDPR & CCPA)
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right of Access: Request a copy of all personal data we hold about you
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention obligations
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing of your data for marketing purposes
- Right to Restrict Processing: Limit how we use your data pending resolution of a dispute
To exercise any of these rights, contact us at privacy@todobuild.com. We will respond within 30 days.
5. International Data Transfers
Data is primarily processed and stored on servers located in the United States. For clients in the Dominican Republic and other LatAm jurisdictions, data transfers are conducted under appropriate safeguards including Standard Contractual Clauses (SCCs) where required by applicable law. We comply with the principles of the Dominican Republic Personal Data Protection Law (Law 172-13) to the extent applicable.
6. Data Retention
We retain client data for the duration of the active service agreement plus seven (7) years for tax and legal compliance purposes. Discovery intake data (non-converted leads) is retained for 18 months and then permanently deleted. You may request early deletion by contacting privacy@todobuild.com.
7. Cookies & Analytics
Our website uses essential cookies for functionality and optional analytics cookies (if enabled). We do not use tracking cookies for advertising purposes. You may disable cookies in your browser settings at any time without affecting your ability to access our services.
8. Security
We implement industry-standard security measures including TLS/SSL encryption for all data in transit, access controls, and regular security reviews. No method of electronic transmission is 100% secure; we cannot guarantee absolute security but commit to prompt notification in the event of a confirmed data breach.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to active clients at least 30 days before taking effect. Continued use of our services constitutes acceptance of the updated policy.
Privacy Requests
Submit any privacy-related requests to our data protection contact below.