Privacy Policy — Estimatery

Not legal, tax, or accounting advice

Estimatery is a tool for building estimates and an internal profit-and-loss view. The tax fields, margins, income set-aside, and every other calculation are arithmetic over numbers you enter. They are not professional advice, and we do not verify them — confirm anything that matters with a qualified professional. This policy is a description of our practices, not legal advice to you.

Who this policy is about

You (the “Creator”) means the person using Estimatery — anonymously in your browser, or as a signed-in account holder.
Client means your customer or prospect, whose details (name, company, address, contact info) you may type into an estimate. Estimatery has no relationship with your Clients; you control that information and are responsible for it (see Your Clients’ information).

What we collect and why

Estimatery is built to keep as little as possible on our servers. Much of the product runs entirely in your browser and never reaches us.

Information that stays in your browser (we don’t receive it). When you use the builder without signing in, your work is saved in your browser’s local storage and is never sent to us: your working estimate (the full version, including costs, margins, and internal notes), small interface preferences, and — for estimates too large to fit in a share URL — a compressed copy stored under a short key. This lives only on the device and browser you used, until you clear your site data. Because we never receive it, we cannot access, recover, or delete it for you.

Information we receive when you sign in or act:

Account email address. Signing in is by magic link: you enter your email, we send a one-time link, and clicking it signs you in. We store your email (lowercased and trimmed) as the single identifier for your account — one account per email. We do not collect or store a password. We use your email to sign you in, show which account you’re in, and contact you about your account or support requests. If you change your account email in Settings, we hold the new address as “pending” until you confirm it from that inbox; it replaces your old address only after that confirmation.
Saved estimates (cloud saves). If you save an estimate to your account, we store the full estimate as one JSON record — the complete internal version, including your costs, margins, markup, income reserve, and internal notes. A saved estimate may contain your Clients’ personal information (name, company, address, contact details you typed in). Free accounts keep one cloud-saved estimate; Pro accounts have no limit. We use saved estimates only to provide the save/sync feature to you.
Saved items (Pro only). If you build a Saved Items library, we store your reusable line items (label, category, industry, unit, rate, and optional internal cost and notes) linked to your account. We use them only to let you apply saved items to your estimates; deleting your account removes them.
Branding (Pro only). If you set up branding, we store an optional record with your business name, a contact name, address, a contact line, and a logo. We use it to place your branding on your client-facing exports. You choose how the logo is provided: paste an https image URL (kept on your own host), or upload an image, which we host for you — see Logos.
Purchase records. When you buy the one-time Pro unlock, our payment processor (the merchant of record) handles the transaction. We store only a minimal receipt: the processor’s order ID, a status (paid or refunded), the processor name, and the timestamp, linked to your account. We use it to grant and (on refund) remove Pro access. We do not store your card details, billing address, or the amount — those stay with the processor.
Contact/support messages. If you message us through the help page, we receive your email, an optional subject, and your message, and deliver them to our support inbox (with your email as reply-to). We use these to respond to you.
Marketing email (optional — only if you opt in). If you give us explicit permission — an unchecked checkbox or a setting you turn on, never something bundled into sign-in or checkout — we use your account email to send occasional product news, tips, and offers about Estimatery and other products operated by LanRus LLC (such as ProLink). Every marketing email includes a working unsubscribe link and our postal address. Unsubscribing stops marketing immediately and does not affect sign-in links, receipts, or messages about your account. We keep a record of when and how you opted in. Your Clients are not our mailing list: we never send marketing to addresses that appear inside your estimates.

Collected automatically for security and hosting. When you request a magic link or send a contact message, we read your IP address (from standard proxy headers) and use it to rate-limit those endpoints against abuse; the rate-limiter sees your IP and, for sign-in, your email — never your estimate content. Our hosting providers also process standard request metadata (such as IP address and user agent) to run and secure the service.

Page-view analytics. We use Vercel Web Analytics, a privacy-friendly, cookieless page-view counter: it records which pages are visited along with aggregated referrer, country, and device-type information. It sets no cookies, does not track you across other websites, does not build behavioral profiles, and never sees your estimate content. We do not run advertising trackers of any kind.

Why we're allowed to process this

Estimatery is operated from the United States. If you are in the European Economic Area or the UK, the GDPR applies to your data; if you are in California, the CCPA/CPRA applies. Where that framing applies, our legal bases are:

To provide the service you asked for (performance of a contract / your request): storing your account email, saving your estimates, applying your branding, and processing your Pro unlock.
Our legitimate interests: keeping the service secure and available (rate limiting, hosting logs, abuse prevention) and responding to your support messages, balanced against your privacy.
Your consent: sending you marketing email, only if you opt in. You can withdraw at any time — use the unsubscribe link in any marketing email or email us — and withdrawing changes nothing else about your account.
Legal obligation: retaining minimal records where the law requires.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are used under California law. LanRus LLC does operate other products under its own brands (currently ProLink). If you opt into marketing, your email is used by LanRus LLC across those brands as described in this policy — it is never sold, rented, or given to a separate company.

Cookies and local storage

We set two cookies, both used only to keep someone signed in — never for tracking. eg_session is your sign-in token, created when you sign in: it keeps you signed in on that device for 30 days, can’t be read by JavaScript on the page (httpOnly), is marked Secure in production, and does nothing else. eg_admin is an internal, short-lived (30-minute) sign-in token set only when one of our own administrators signs in to the site’s admin area; ordinary visitors never receive it. We don’t use advertising or tracking cookies, and our page-view analytics (Vercel Web Analytics, described above) is cookieless — it sets no cookies at all and doesn’t follow you across other websites. Because nothing here tracks you across sites, we don’t treat browser “Do Not Track” (DNT) signals any differently — there’s nothing for them to switch off. Our hosting and CDN providers (Vercel and Cloudflare) may set their own cookies for security and traffic management; see their privacy policies for details.

Local storage. The builder uses your browser’s local storage to hold your working estimate, small UI preferences and functional markers (for example, a note that you asked to save an estimate just before signing in, and a counter that limits how often we show certain prompts), and (when needed) share-link fallback data. This never leaves your browser on its own.

The privacy wall

Your client-facing outputs — client views, exports (PDF, Excel, CSV), and share links — are never built from your raw estimate. They are built from a whitelisted copy that is physically rebuilt with only client-facing fields. Costs, cost rates, margins, markup, the income reserve, internal notes, and internal-only sections are not present in that copy, and there is no toggle that can accidentally leave them in. Note that client-facing content you deliberately include — such as your Client’s name, company, and address — is part of that copy by design.

Who we share information with

We don’t sell your data. We use a small set of service providers (“subprocessors”) to run Estimatery. Each sees only what it needs:

Neon (Postgres database) — hosts all server-side data: your account email, saved estimates (including any Client details in them), branding, purchase records, and short-lived sign-in tokens.
Resend (email delivery) — sends your magic-link sign-in emails, delivers your contact-form messages to our support inbox, and — for people who opt in — sends our marketing email and stores our mailing and unsubscribe (suppression) lists.
Upstash (Redis, rate limiting) — stores rate-limit counters keyed by IP address and, for sign-in, email. It does not receive estimate content. If it is unavailable, we fall back to a per-server in-memory limit — reduced protection, but never fully off.
Vercel (hosting) — runs the app and its API, processes standard request metadata (including IP addresses) to host and secure the service, stores logo images you upload (Vercel Blob), and provides our cookieless page-view analytics (Vercel Web Analytics, described above).
Cloudflare — provides domain registration, DNS, and email routing for estimatery.com.
Payment processor / merchant of record — currently LemonSqueezy. When you buy Pro, this provider is the seller and merchant of record: it hosts checkout, collects and handles your card and billing details, remits sales tax/VAT, and issues your receipt. We send it your email (to prefill checkout and send your receipt) and an internal account reference so we can match the purchase to your account. We never see or store your card data. We may change payment processors over time; this policy names the one live at the time of your purchase.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, or security of our users or the service. If Estimatery is ever involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy.

Our providers are located in the United States and elsewhere, so your information may be processed outside your own country. For transfers of personal data from the EEA/UK to the US, our processors rely on Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the provider is certified, and other mechanisms permitted under the GDPR; email hello@estimatery.com for details.

Logos

A Pro logo can be provided two ways. If you paste an https image URL, we do not fetch, copy, or store the image on our servers — it is loaded by the browser that views or exports the estimate (yours or your recipient’s), directly from the URL you provided, and whoever hosts that URL may observe requests for it.

If instead you upload an image, we store that single file with our hosting provider (Vercel Blob) and record its URL on your branding. It is served from a public, unguessable URL and loaded the same way — by the viewer’s browser. Uploading a new logo replaces the previous one, and deleting your account removes the hosted image. A broken or unreachable URL falls back to showing your business name text.

How long we keep information

Browser-only data (working estimates): kept in your browser until you clear your site data. We never receive it, so we can’t set a retention period for it.
Sign-in (magic-link) tokens: stored only as a one-way hash, single-use, and expiring 15 minutes after they’re issued.
Account email, saved estimates, saved items, branding, and purchase records: retained for as long as your account exists. We do not automatically delete inactive accounts or expire this data; it persists until you delete your account. When you delete your account it is disabled immediately, any logo we host is removed right away, and the remaining data is permanently erased from our database within 30 days.
Marketing preferences and consent records: if you opt into marketing, we keep a record of when and how you opted in for as long as your account exists — including after you unsubscribe — so we can show the emails we sent were permitted. If you delete your account, that record is erased with everything else within 30 days, as described above. Separately, whether you unsubscribe or delete your account, we keep your email address on a suppression list used only to make sure we never send you marketing again.
Session cookie: expires 30 days after sign-in, or immediately when you sign out.
Rate-limit counters and hosting logs: short-lived operational data, retained per each provider’s own policy.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising them. Here’s how those work with Estimatery — most of them self-serve, directly in the app:

Access / export / portability. Self-serve: Settings → Download my data gives you a structured, machine-readable JSON copy of everything tied to your account — your profile, saved estimates, saved items, branding, and purchase records (fulfilling data-portability rights such as GDPR Article 20). You can also export any single estimate at any time via Export → Download JSON (the full internal version) or the PDF/Excel/CSV exports, entirely in your browser.
Correction. You can edit your estimates and branding directly in the app, and change your account email yourself in Settings → Change email (we confirm the new address before switching). For anything you can’t change yourself, email us.
Deletion. Self-serve: Settings → Delete account (you’ll type your email to confirm). Your account is disabled immediately — sign-in stops working and any logo we host is removed right away — and its data (saved estimates, saved items, branding, purchase records) is permanently erased from our database within 30 days. Prefer email? Write to hello@estimatery.com from the address you signed up with and we’ll do it for you. Anonymous, browser-only data isn’t ours to delete — you remove it by clearing your browser’s site data.
Marketing opt-out. Every marketing email we send has an unsubscribe link; using it stops marketing without affecting sign-in links, receipts, or account notices. You can also email us to be removed.
Signing out. Signing out immediately expires your session cookie on that device.

To make any request, email hello@estimatery.com. We’ll verify the request against your account (typically by confirming it comes from your signed-up email) before acting, and aim to respond within the time required by applicable law. If you’re in the EEA or UK and believe we’ve mishandled your data, you may also lodge a complaint with your local data-protection authority.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request deletion of information we collected from you; to correct inaccurate information; and to not be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of, and we do not use or disclose sensitive personal information for purposes that would require a right to limit. We use your information to provide the service and — only with your opt-in consent — to send our own marketing. To exercise a right, use the self-serve tools in Settings (Download my data, Delete account) or email hello@estimatery.com; we will verify your identity (typically via your signed-up email) before responding.

Your Clients' information

Estimates you create may contain personal information about your Clients (names, companies, addresses, contact details) that you typed in. For that information:

You are the controller (or “business”) — you decide to collect it and put it into an estimate. Estimatery processes it on your behalf as your service provider, to store and display the estimate for you.
You are responsible for having the right to provide that information to us and to include it in estimates, exports, and share links, and for handling any requests your Clients make about their own data. If you need a formal processor arrangement, see our Data Processing Addendum.
Remember that anything you place in a client-facing view, export, or share link is visible to whoever receives it (see Share links).

Security & incident notification

We take reasonable measures to protect information: sign-in tokens are hashed and single-use with a short lifetime; session tokens are signed and delivered as httpOnly cookies; access to your saved data is scoped to your own account; client-facing outputs are built from the whitelisted copy described above; and the payment processor handles card data so we never hold it. No method of storage or transmission is perfectly secure, and we can’t guarantee absolute security — in particular, share links are readable by anyone who has them, by design.

If a data breach affects your personal information, we will notify you as required by applicable law — including California Civil Code §1798.82 for California residents — by email to your account address, without unreasonable delay. For security concerns, contact hello@estimatery.com.

Children

Estimatery is a business tool for adults — our Terms require users to be at least 18 — and it is not directed to children. We do not knowingly collect personal information from anyone under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us information, email hello@estimatery.com and we’ll delete it.

Changes to this policy

We may update this policy as the product changes (for example, if we change payment processors or add features that touch personal data). When we do, we’ll revise the effective date above, and for material changes we’ll take reasonable steps to let account holders know. Questions or requests about this policy or your data: hello@estimatery.com. Governing law: California, USA.