Privacy Policy
Last updated: January 12, 2026
1. Introduction
Gunning Holdings, Inc., doing business as CraftForge ("CraftForge," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (the "Services").
This Privacy Policy applies to all users of the Services, including service professionals ("Service Providers" or "Pros") and customers seeking home services ("Customers"). By using the Services, you consent to the practices described in this Privacy Policy.
Please read this Privacy Policy carefully. If you do not agree with our policies and practices, do not use the Services. If you have questions, contact us at support@craftforge.us.
2. Information We Collect
Information from Service Providers
When you register as a Service Provider, we collect:
- Identity Information: Full name, business name, and professional credentials
- Contact Information: Phone number, email address, and business address
- Professional Information: License number, license state, service categories, and insurance status
- Financial Information: Bank account details for payment processing (collected and stored by Stripe)
- Profile Information: Business description, profile photos, and service area
Information from Customers
When you use our Services as a Customer, we collect:
- Identity Information: Name (optional during booking)
- Contact Information: Phone number and email address
- Service Information: Service address, job description, photos, and scheduling preferences
- Payment Information: Payment card details (collected and stored by Stripe, not stored on our servers)
- Communication Data: Messages exchanged with Service Providers
Automatically Collected Information
When you use the Services, we automatically collect:
- Device Information: Device type, operating system, and browser type
- Usage Information: Pages visited, features used, and interaction patterns
- Log Data: IP address, access times, and referring URLs
- Authentication Data: Session tokens stored in secure cookies
3. How We Use Information
We use the information we collect to:
- Provide Services: Facilitate connections between Service Providers and Customers, process bookings, and manage jobs
- Process Payments: Authorize payment holds, capture payments, and transfer funds to Service Providers
- Verify Credentials: Verify professional licenses against state licensing boards
- Communicate: Send booking confirmations, job updates, and service notifications via SMS and email
- Improve Services: Analyze usage patterns, troubleshoot issues, and enhance platform features
- Prevent Fraud: Detect and prevent fraudulent activity and unauthorized access
- Legal Compliance: Comply with legal obligations and respond to legal requests
- Customer Support: Respond to inquiries and resolve disputes
4. Information Sharing
We share your information with the following third parties:
Stripe (Payment Processing)
Processes all payments, manages Service Provider payout accounts, and securely stores payment card information. Stripe is PCI DSS Level 1 certified.
Data shared: Name, email, phone, payment details, business information
Twilio (SMS Communications)
Sends SMS notifications including verification codes, booking confirmations, and job updates.
Data shared: Phone numbers, message content
Resend (Email Communications)
Sends email notifications including welcome emails, job notifications, and receipts.
Data shared: Email addresses, notification content
Supabase (Database & Authentication)
Provides secure database storage and user authentication services.
Data shared: All user account data (encrypted at rest and in transit)
Shovels API (License Verification)
Verifies Service Provider professional licenses against state licensing board records.
Data shared: License number, state
Vercel (Hosting)
Hosts our web application and processes web requests.
Data shared: IP addresses, access logs
Sharing Between Users
When a booking is made, we share relevant information between Service Providers and Customers, including names, contact information (phone), service addresses, and job details. This sharing is necessary to facilitate the services.
Legal Disclosures
We may disclose your information if required by law, legal process, or government request, or to protect the rights, property, or safety of CraftForge, our users, or the public.
No Sale of Personal Information
We do not sell, rent, or trade your personal information to third parties for their marketing purposes.
5. Data Retention
We retain your information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy:
- Account Data: Retained while your account is active and for a reasonable period thereafter
- Job and Payment Records: Retained for 7 years for tax and legal compliance purposes
- Communication Records: Retained for dispute resolution and quality assurance
- Verification Codes: Automatically expire after 10 minutes
- File Attachments: Accessible via signed URLs that expire after 1 year
You may request deletion of your data as described in the "Your Privacy Rights" section below.
6. Your Privacy Rights
Depending on your location, you may have certain rights regarding your personal information. We honor privacy rights for all users regardless of location.
California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know: Request information about the personal information we collect, use, and disclose
- Delete: Request deletion of your personal information, subject to certain exceptions
- Correct: Request correction of inaccurate personal information
- Opt-Out: Opt out of the sale or sharing of personal information (we do not sell personal information)
- Non-Discrimination: Not receive discriminatory treatment for exercising your rights
Virginia Residents (VCDPA)
If you are a Virginia resident, you have the right to:
- Access your personal data
- Correct inaccuracies in your personal data
- Delete your personal data
- Obtain a copy of your personal data in a portable format
- Opt out of targeted advertising and profiling
Colorado Residents (CPA)
Colorado residents have similar rights to Virginia residents, including access, correction, deletion, portability, and opt-out rights.
Other States
Residents of Connecticut, Utah, and other states with comprehensive privacy laws have similar rights. We will honor requests consistent with applicable law.
Exercising Your Rights
To exercise any of these rights, please contact us at support@craftforge.us with the subject line "Privacy Rights Request." We will verify your identity before processing your request and respond within the timeframes required by applicable law (typically 45 days).
8. Data Security
We implement appropriate technical and organizational measures to protect your personal information:
- Encryption: All data is encrypted in transit using TLS/HTTPS and at rest using AES-256 encryption
- Payment Security: Payment card data is handled by Stripe, which is PCI DSS Level 1 certified. We never store full card numbers on our servers
- Access Controls: Row-level security ensures users can only access their own data
- Authentication: Multi-factor authentication via phone verification protects account access
- Monitoring: We monitor for security incidents and unauthorized access attempts
While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
9. Children's Privacy
The Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@craftforge.us, and we will delete such information.
10. Third-Party Links
The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party websites you visit.
11. International Users
CraftForge is based in the United States, and our Services are intended for users in the United States. If you access the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
By using the Services, you consent to the transfer of your information to the United States and the use of your information in accordance with this Privacy Policy.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
For significant changes, we will provide more prominent notice (such as email notification or an in-app announcement) at least 30 days before the changes take effect.
We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the Services after changes become effective constitutes your acceptance of the revised Privacy Policy.
13. Contact Information
If you have any questions about this Privacy Policy or our privacy practices, please contact us:
Gunning Holdings, Inc. (dba CraftForge)
5851 Via Loma
Riverside, CA 92506
Email: support@craftforge.us
For privacy rights requests, please include "Privacy Rights Request" in the subject line.