Privacy policy
Last updated October 27, 2026
This policy covers your Tools for Builders account and every tool you use with it: JobTools, PondTools, RoofTools, PoolTools, LawnTools, CST Tools, Builder Sites and the tools we add later. It says what we keep, why, who helps us run the service, and how you can get your data out or delete it.
Who runs it
Tools for Builders runs the service. Privacy questions go to hello@toolsforbuilders.com.
What we keep
- Your account: your name, email, a scrambled (hashed) copy of your password, and your Google name and picture if you sign in with Google. Also when and where you signed in (IP address and browser), which tool you signed up from, where you first came to us from (the ad or link you clicked and the page you landed on), and your credit history across every tool.
- Your business, in the tools that need one: its name, contact details, logo and settings, and your team's logins.
- Records you enter about your customers: clients, designs, proposals, signatures (with the signer's name, IP address and browser), jobs, visits, invoices, payments, time entries, expenses and your price book.
- Uploaded files: photos and receipts you or your crew upload.
- AI receptionist calls: caller phone numbers, call recordings and transcripts, call summaries and what callers asked for.
- Website messages: what visitors send through the forms on your Builder Sites website, with the page they sent it from and their IP address.
We use all of this to run the service for you and to fix problems. We don't sell it. The only parts used for advertising are the Reddit, Google Ads and Nextdoor measurement described under Cookies.
Your customers' data
The details you keep about your customers are yours to manage, and you are responsible for them. We store and process them only to provide the service to you. If one of your customers contacts us about their data, we will pass the request to you.
Claude and other AI connectors
The Tools for Builders connector lets an AI app you choose, such as Claude, ChatGPT or Codex, use your account to read and change your records. You add it yourself and sign in with your Tools for Builders account. This section covers what that adds to what we keep.
What we collect.
- When you connect an app: its name, the address it asked us to send you back to, and when it connected and was last used. Its sign-in tokens are stored only as hashes. An access token lasts an hour and a refresh token 60 days.
- For each request that changes something (not for requests that only read): which tool it was in (JobTools, WebTools, PondTools and so on), the name of the action (for example create_client), the time, whether it worked, and only the names of the fields the app set and the numbers of the records it pointed at (for example "fields: name, phone; ids: client_id 12"). The values themselves, such as a client's name or the text of a note, are not kept in this record. We do not receive your prompts, your conversation or the assistant's replies.
- The records the app changes are saved in the tool the same way as if you had changed them yourself, and the tool's activity log marks them as made through the connector.
- A short record of the steps of connecting: that you started connecting, made an account or pressed Allow, which kind of app it was (Claude, ChatGPT, Codex or other), the name of the first tool it used and the first tool that changed something, and when. This tells us whether the connector works for people. It holds no prompts and no values.
How we use it. To sign you in, to enforce your settings (who has the connector switched on, and the owner's rules), to show you what the app did on your Account page and in your activity log, to limit abuse, to see whether the connection steps work, and to fix problems. We do not sell it.
What the AI app receives. When you ask the app something, it calls our tools, and whatever the tool returns (for example a client's name and phone number, or an invoice total) goes to the AI company that runs the app you chose. That company handles it under its own terms and privacy policy, which you should read. Choose carefully what you ask it to look up.
Who else sees it. We do not share connector data with anyone beyond the service providers listed above. When you confirm that the app should email a proposal or an invoice, Resend sends that email. If you have connected CompanyCam, the app's requests about CompanyCam photos and projects go to CompanyCam with your CompanyCam sign-in. The connector never sends text messages or charges a card.
How long we keep it. Sign-in tokens stop working when they expire or when you press Disconnect. The record of changes and the record of connection steps are deleted when you delete your account. Records the app created or changed stay in your tools, like any other record, until you delete or archive them.
Your controls. The owner of a business can switch Claude off for any person on the team, and can set each send to Ask every time, Auto-allow or Never under Settings, Claude rules. Anyone can press Disconnect under Connected apps on their account page, which ends that app's access at once. Deleting your account removes the tokens, codes, change records and connection steps.
Questions or requests. Write to hello@toolsforbuilders.com.
Who helps us run it
- Anthropic (Claude, through Claude Code) runs AI features. It sees what that feature needs, such as a call transcript or your request to change your website.
- ElevenLabs gives the AI receptionist its voice and hears the call audio.
- Telnyx provides the receptionist's phone numbers and carries the calls.
- Stripe handles payments. Card details go straight to Stripe and never touch our servers.
- Resend sends our emails, such as the welcome email, email confirmations, password resets and website messages, and, only if you ticked the box when you signed up or turned it on in your account, updates about new features and tools. Every update email has a one-click unsubscribe link.
- Google signs you in if you choose Google sign-in.
- Reddit measures our ads. When you sign up or pay, we tell Reddit that it happened, with your IP address, browser and Reddit's own visitor and click ids, so Reddit can match it to an ad you saw there. We never send your name, email or anything you keep in the tools.
- Google Ads measures our ads on Google. Its tag on our pages tells Google which pages you open, and when you sign up, pay (with the price) or ask for a pro through Find a Pro, with an order number for that event. We don't send Google your name, email or anything you keep in the tools.
- Nextdoor measures our ads on Nextdoor. Its pixel on our pages tells Nextdoor which pages you open, and when you sign up, pay (with the price) or ask for a pro through Find a Pro, with an order number for that event. We don't send Nextdoor your name, email or anything you keep in the tools.
Each of them gets only what it needs for its part of the job. We may also share information if the law requires it.
Cookies
One cookie on toolsforbuilders.com and its tool addresses keeps you signed in across the tools. Google sign-in sets its own cookies if you use it. Our pages also load Reddit's pixel, Google's ads tag and Nextdoor's pixel, which set their own cookies to count visits, sign-ups, purchases and pro requests that came from our ads on Reddit, Google and Nextdoor, and we keep a cookie with the ad or link that first brought you to us.
How long we keep it
We keep your data while your account is open. When you delete your account, your account, your credits and every tool's records for it are removed from the live service straight away. Backups are kept for 30 days, so copies in them are erased within 30 days.
Getting your data out, and deleting it
Your account page downloads what your account holds and deletes the account. Each tool downloads its own records from inside it; in JobTools, the owner of a business downloads all of its data from Business settings as a ZIP with a spreadsheet for each kind of record, plus the uploaded photos. You can also email us to ask for either.
Security
Connections are encrypted, passwords are stored hashed, sign-in tokens are stored only as hashes, and each business can only see its own records. No system is perfectly secure, so if something goes wrong that affects your data, we will tell you.
Early access
The service is in early access and provided as is. See the terms of service.
Changes
If we change this policy in a way that matters, we will tell you by email or in the tools before it takes effect. This policy is governed by the laws of the State of Oregon, USA.