Privacy Policy
Effective date: February 4, 2026. Last updated: February 4, 2026.
Contents
1. Introduction
2. Information we collect
3. How we use your information
4. When we share information
5. How long we keep information
6. Your rights
7. Children's data
8. Security
9. International users
10. Changes to this Policy
11. How to contact us
1. Introduction
Gulf Coast Work ("GCW," "we," "us") respects your privacy. This Privacy Policy explains what personal information we collect, how we use it, when we share it, how long we keep it, and the rights you can exercise. It applies to the gulfcoastwork.com website, the associated APIs, our email and SMS communications, and the admin/staff tooling.
2. Information we collect
2.1 Account information
Email, password (stored as a bcrypt hash — the plaintext password is never persisted), display name, first and last name, phone number (optional, used for account recovery and Twilio SMS notifications once live), profile picture, roles held (customer / provider / team_member / staff), two-factor auth (TOTP) secrets you enable, and the U.S. state you operate in.
2.2 Provider profile information
Business registration name, business type, tax classification (self-selected), Employer Identification Number (EIN) or SSN placeholder (when required for 1099 reporting; stored encrypted at rest), physical business address, service areas, categories and skills, credentials you submit (licenses, certifications, insurance certificates, background-check receipts), years of experience, languages spoken, links you provide (website, social profiles), and portfolio media.
2.3 Transaction information
Bookings, orders, requests, proposals, custom offers, milestones, invoices, receipts, refund records, tip records, and their associated ledger entries. Each transaction record includes a fee snapshot capturing the exact commission, service fee, and processing fee split at the moment of capture.
2.4 Messaging
All conversations that occur inside the platform are stored so we can moderate, mask contact-detail leakage that undermines payment protection, and provide evidence during a dispute. Moderators and support agents can access messages only under the access rules encoded in server-side permissions.
2.5 Payment information
Payments are processed by Stripe, Inc. GCW does not store your card number, CVC, bank account number, or bank routing number. Stripe issues us a session identifier and — once payment settles — a payment intent identifier; we store those, along with the amount, currency, purpose, and target record, in the payments collection. Refund identifiers are stored in the same way.
2.6 Location data
For local bookings we store the service address you enter and its city/state/ZIP. Provider profiles include a service radius plus custom service areas (also stored). GCW does not access precise device GPS without your explicit permission.
2.7 Device and session information
Session records include the session token identifier, IP address, user-agent string, and the times you signed in and out. You can review your active sessions and revoke individual devices under Account settings → Security. We also record account activity events (login, password change, 2FA enable/disable) so you can audit access to your account.
2.8 Cookies and local storage
See the separate Cookie Policy at /cookies for the enumerated cookies and localStorage keys we set (session token, preference flags, brand overrides).
3. How we use your information
We use your information to (a) operate the platform (authenticate you, route bookings, deliver messages, calculate fees, complete payments and payouts, generate receipts, run 1099 reports); (b) enforce these Terms and our other policies (fraud prevention, dispute resolution, verification, background-check ingestion); (c) improve the platform (aggregate analytics, feature experiments); (d) communicate with you (transactional email, in-app notifications, SMS once Twilio is live — always with an opt-out); and (e) satisfy legal obligations (tax reporting, subpoena response, records retention).
4. When we share information
We share personal information only in these categories:
• With the counterparty to a transaction — customers see the provider profile they book from and vice versa. Full contact details are exchanged only after a payment is captured and only to the extent needed to complete the service.
• With service providers we use to run the platform — Stripe (payments), Twilio (SMS, once live), our transactional email provider, our cloud hosting and object storage provider, and moderation / support tooling. These providers process data on our behalf under written agreements.
• With verification providers when you consent to a background check or identity verification.
• In response to a legally valid subpoena, court order, or law-enforcement request, with notice to you where permitted.
• In a merger, acquisition, or asset sale, subject to notice and continued application of this Policy.
We do not sell personal information for money or trade it for other value.
5. How long we keep information
Account records: for as long as your account is active, plus the retention windows required by tax and consumer-protection law (generally 7 years for U.S. tax records). Transaction records: 7 years. Messages: for the life of the associated transaction plus 3 years, unless legally required to keep them longer. Session logs: 12 months. Support tickets: 3 years after closure. Backups: routine backups are purged on a rolling 90-day cycle.
6. Your rights
Account access and export — you can download a JSON archive of your account information, profile, and transactions from Account settings → Privacy → "Request my data." We generate the archive within 30 days.
Correction — you can edit account information and provider profile details directly, or reach support to correct records you cannot edit.
Deletion — you can request account deletion from Account settings → Privacy → "Delete my account." Deletion moves your account to `deleted` status and removes personally identifying fields from public listings. Records we are legally required to retain (tax, dispute, anti-fraud) remain in restricted storage.
Marketing opt-out — every marketing email carries an unsubscribe link and every marketing SMS (once Twilio is live) carries STOP-to-opt-out language. Transactional email cannot be turned off while you hold an active transaction.
State-specific rights — residents of California and other states with privacy statutes have additional rights outlined at /california-privacy.
7. Children's data
Gulf Coast Work is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a child has provided information to us, contact privacy@gulfcoastwork.com and we will delete it promptly.
8. Security
Passwords are hashed with bcrypt. Session tokens are httpOnly + Secure. Payment credentials never touch our servers. Provider tax identifiers and background-check attachments are stored encrypted at rest with restricted access. Access to production data is scoped by role and audited (see /admin/audit-logs — visible to staff only). No system is perfectly secure; if you learn of a vulnerability, please report it to security@gulfcoastwork.com.
9. International users
Gulf Coast Work serves customers and providers in the United States. If you access the platform from outside the U.S., your information will be transferred to and processed in the United States.
10. Changes to this Policy
Material changes will be announced in your account notifications and by email at least 30 days in advance (or immediately when required by law).
11. How to contact us
Data-protection questions and rights requests: privacy@gulfcoastwork.com · General support: /contact.
Related policies
→ Cookie Policy — /cookies
→ California Privacy Rights — /california-privacy
→ Terms of Service — /terms
→ SMS Terms & Consent — /sms-terms
Questions about this policy? Reach us at legal@gulfcoastwork.com or via /contact.