What we collect, and what we do not.

This site is published by Xenco Labs Inc., 4000 Pimlico Dr #114-321, Pleasanton, CA 94588. This page describes what happens to information when you read it or contact us. Everything below is checkable against the site itself — the cookie names are the real ones, and there are only two.

Reading the site

You can read every page here without giving us anything and without accepting any cookie. Nothing on this site is behind a sign-in, and there is no account to create.

We measure how many people read which pages, using two tools:

• Google Analytics 4. This one sets two first-party cookies — _ga and _ga_3B4GNK6YVB — which expire about thirteen months later. They hold a randomly generated number, not your name or address. Google receives your IP address as part of this and processes it as our data processor. This site has not publicly launched yet and shows no cookie banner at present, so those cookies are set when you arrive unless you have told us no by one of the means below.
• Ahrefs Web Analytics. This one sets no cookie at all and writes nothing to your browser’s storage, so there is nothing to consent to. It reports totals — page, referrer, country, device type — and cannot follow an individual between visits.

Neither tool is used for advertising. We do not run ads, we do not build profiles, and we do not use any advertising or remarketing feature of Google Analytics. Those settings are switched off explicitly in the page source, not merely left unused.

Three things still switch Google Analytics off. If your browser sends a Global Privacy Control signal, we read it and set no cookie — you have already answered the question and we are not going to ask it again. If you pressed Decline during the period the banner ran, that choice is still stored and still honoured. And you can block cookies for this site in your browser settings, or install Google’s own opt-out extension, neither of which we are able to override.

The banner comes back when the site publicly launches, and Analytics returns to being switched off until you accept it. We would rather describe what the site actually does today than show you a consent notice for a different arrangement.

Hosting and server logs

The site runs on Vercel. Like any web server, it records requests — IP address, time, page, browser string — for delivery, security and troubleshooting. We do not use those logs to identify readers, and they are not joined to anything else.

If you subscribe to the newsletter

We store your email address, the page you subscribed from, and the date. Your address is added to the list at the moment you submit the form; there is no confirmation step, so if someone else has entered your address, tell us and we will remove it immediately rather than asking you to prove anything.

The list itself runs on our own server rather than a third-party marketing platform, so your address is not handed to one to profile or resell. The messages are handed to Brevo, an email delivery service, purely to be delivered. Every email carries an unsubscribe link, which removes the record, and you can also ask us to remove it directly.

If you send us a quote to review

Sending us a quote means emailing us, so we hold whatever you chose to send: the message, the documents attached to it, and your email address. Quotes normally name a contractor, a building and a price, and sometimes name individuals.

We use that material to do the review you asked for. We do not sell it, and we do not pass it to the contractor it concerns. Where we later write about a pattern we saw, it is de-identified — no client, building, or address — which is the same rule stated on the about page: we name patterns, not parties.

Contractor records on this site

Licence numbers, classifications, and disciplinary history shown here come from public regulatory records, and a contractor’s licence is a business record rather than personal information. If you are a licensee and believe an entry about you is inaccurate, write to us and we will check it against the issuing authority and correct it if it is wrong.

Who else handles it

We use a small number of suppliers to run the site, and they only ever act on our instructions. There is no other category of recipient — we have no advertising network, no data broker, and no analytics partner beyond the two named above.

• Vercel — hosting and server logs.
• Google — Analytics.
• Ahrefs — cookieless page totals.
• Brevo — delivery of newsletter email. It carries the message; it does not get the list to use.
• Neon and Payload — the databases holding the published contractor records and the site’s own articles.

How we protect it

Everything is served over TLS, and what we store is encrypted at rest by the providers above. Credentials are held in a secrets vault rather than in the code, and access to review correspondence is limited to the people doing the review. We would rather say that plainly than claim a certification we do not hold: no site can promise that transmission over the internet is completely secure, and we are not promising it.

If a breach ever affects your information, we will tell you and the relevant authority within the time the law requires, and we will say what actually happened rather than issue a statement about how seriously we take security.

When we would hand something over

We will disclose information if a court order, subpoena, or other legally valid demand requires it, or where we need to establish or defend a legal claim. If we receive such a demand we will tell you, unless we are legally prohibited from doing so, so that you have the chance to respond to it yourself.

Where it is processed

We are a United States company and the suppliers above process data in the United States and the European Union. If you contact us from the UK or EU, your information will be transferred to the United States. Where that transfer needs a legal basis, it rests on the standard contractual clauses our suppliers operate under.

What we never do

We do not sell personal information, and we do not share it for cross-context behavioural advertising — under California law, both of those terms cover disclosures that involve no money changing hands, and neither happens here. We take no payment from contractors for placement or removal.

How long we keep things

Newsletter records last until you unsubscribe. Review correspondence is kept while the work is live and for as long afterwards as we may need it to answer a dispute about our own advice. Server logs roll off within about thirty days. Analytics is retained for fourteen months.

Your rights

If you are in California, you may ask what we hold about you, ask for a copy, ask us to delete or correct it, and you may not be treated differently for asking. If you are in the UK or EU, you have the equivalent rights under the GDPR, including objecting to processing and asking for your data to be ported. You can withdraw consent for the newsletter at any time, and you can switch analytics off by any of the means described at the top of this page.

Ask by email and we will answer within thirty days. We may need to confirm you control the address in question before acting, which is protection for you rather than an obstacle.

Children

This is a service for people responsible for commercial buildings. It is not directed at children and we do not knowingly collect anything from anyone under 16.

Changes

If this policy changes, the date at the top changes with it. If a change means we start collecting something we did not collect before, that will be said plainly here rather than absorbed into a longer document.

Contact

Privacy questions and requests: privacy@licensedfor.com, or by post to Xenco Labs Inc., 4000 Pimlico Dr #114-321, Pleasanton, CA 94588.