Privacy Policy

1. Introduction & Overview

PinPoint Contact ("we," "us," or "our") respects your privacy and is committed to transparent data practices. This Privacy Policy describes how we collect, process, store, and protect information when you visit pinpointcontact.com, use our Vitra voice agent widget, or interact with our edge APIs and voice streaming infrastructure.

This policy applies to two groups: (1) Contractors who sign up for our services or embed Vitra on their sites, and (2) End-User Visitors who interact with Vitra on contractor websites.

2. Information We Collect

3. Microphone Access & Audio Consent

We adhere to strict privacy safeguards regarding browser audio capture:

• No Passive Listening: Vitra never accesses a visitor's microphone passively in the background. Audio access requires an explicit user gesture (such as clicking the microphone orb or "Speak" button) and explicit permission granted through the browser's native permission modal.
• Real-Time Visual Indicators: Vitra displays active pulsing animations (green listening pulse, gold speaking wave) and visual countdown timers while the microphone is active so users always know the exact listening state.
• Ephemeral Audio: Raw audio chunks are streamed ephemerally for instant transcription and are not retained as permanent raw recordings for marketing analysis.

4. How We Use Information

We use collected data solely for legitimate business operations:

• Providing, operating, and improving Vitra's sub-second conversational speech recognition.
• Dispatching instantaneous SMS and email notifications to contractors when a visitor qualifies as a high-value or emergency job lead.
• Generating custom contractor audio previews during onboarding.
• Processing recurring subscription billing and deposits via Stripe.
• Preventing abuse, DDoS attacks, and spam on Cloudflare Pages and Workers.

5. Strict Mobile Phone Number Privacy (10DLC / CTIA Compliance)

We adhere strictly to mobile carrier compliance guidelines (CTIA / 10DLC):

6. Cookies & Local Storage Technologies

We use strictly necessary cookies and browser local storage (localStorage) to deliver core website functionality:

• Essential Operational Storage: We store session tokens, intake form progress, and customer plan selections locally on your device so your progress is never lost if your connection drops or you navigate between preview steps.
• Audio & Widget State: We store audio volume preferences, live speech sandbox state, and consent status (ppc_cookie_consent) so you do not see repetitive banners on subsequent visits.
• Security & Payment Verification: Our payment processor, Stripe, uses essential fraud-prevention cookies to verify legitimate checkout sessions and comply with PCI-DSS Level 1 standards.
• No Third-Party Tracking Cookies: We do not deploy cross-site tracking pixels, third-party advertising cookies, or behavioral data brokers.

You can accept, decline, or adjust your cookie preferences at any time using our bottom consent banner or by clicking "Cookie Preferences" in the website footer. You may also clear stored data through your browser settings.

7. Third-Party Service Providers

We utilize trusted, enterprise-grade cloud providers who process data on our behalf under strict confidentiality agreements:

• Cloudflare: Global edge compute, CDN hosting, and DDoS protection.
• Google Cloud Platform (Firestore & Vertex AI): Encrypted database storage and conversational voice intelligence.
• Stripe: Secure, PCI-DSS Level 1 compliant payment processing.
• Brevo / Twilio: Automated transactional email and SMS delivery for emergency contractor alerts.

8. Data Security & Retention

We implement rigorous technical and organizational measures to safeguard information:

• All communication between browsers and our edge servers is encrypted using modern TLS 1.3 protocol.
• Stored database records in Google Cloud Firestore are protected by AES-256 encryption at rest.
• Lead records are retained for the duration of the contractor's active subscription to provide historical reporting, and are permanently erased upon verified account termination.

9. Your Privacy Rights (CCPA, CPRA, GDPR)

Depending on your jurisdiction, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal records.
• Deletion: Request permanent erasure of your personal records ("Right to be Forgotten").
• Opt-Out: Opt out of SMS dispatch communications at any time by replying STOP.

To exercise any of these rights, email your request to [email protected]. We respond to all verified requests within thirty (30) days.

10. Children's Privacy

Our Service is directed to businesses, trade contractors, and adult property owners. We do not knowingly collect personal information from children under the age of 18.

11. Contact Us

If you have any questions or concerns regarding this Privacy Policy or our data practices, please contact us at: