Privacy Policy

Effective November 5, 2026. Version id: privacy-2026-11-05a.

Who we are

Doing Work LLC runs Doing Work, this website, and the customer pages at pages.doingwork.work. Mailing address: 212 W Ironwood Dr Ste D PMB 466, Coeur d'Alene, ID 83814. Email contact@doingwork.work. Phone (208) 274-3273.

Doing Work is offered to businesses in the United States, and homeowners anywhere in the United States can send quote requests to shops on it. This policy covers four groups: shops and their workers, the agents shops use, the shops' customers, and homeowners who send requests (and the agents they use).

Our two roles

For a shop's own account, its workers and its use of Doing Work, we decide how data is used, and this policy applies directly.

For the customer information a shop puts into Doing Work, the shop decides how it is used. We handle it as the shop's service provider, only to run Doing Work for that shop. A customer who wants their data seen, corrected or deleted should ask the shop. We help the shop do it. A customer can also email us, and we pass the request to the shop.

What we collect

Account and workers: names, work emails, phone numbers you give us, shop name and contact details, roles and what each worker can see or do.
Sign-in and security: one-time sign-in links, session records and times, your IP address for rate limits (each connection is limited, by default to 600 requests a minute), and an activity log of what changed in each shop and who or what changed it.
Shop records: customers and their contact details and addresses, jobs, visits, photos, checklists, time entries, quotes, change orders, invoices, payment status, signed documents and job records.
Photos: we keep each photo as the shop uploaded it, including the data the camera saved with it: when it was taken, the GPS location and altitude, the compass direction, and the camera and lens. We also save those details as fields so the shop and its agents can search photos by place and time and show them on a map. When we make a JPEG viewing copy of a HEIC or TIFF photo, we keep the original file too. The shop's export includes the originals, and deleting a photo deletes its original. Copies that leave the shop have that data removed: photo share links, photos on quote pages, and PDFs such as photo reports. Photos a homeowner adds to a quote request are handled differently; see "Closing a shop and deletion."
Texts and calls (only for shops that connect their own phone number): the phone numbers, the texts sent and received, call records (time, length, direction, outcome), voicemail links and length, a short call summary from the shop's own voice AI when the shop uses one, and each consent and stop record with the wording the customer agreed to.
Voice notes: we store only the words your shop's own tool transcribed and which tool it said it used. We don't keep the audio.
Signatures: the document text, the signer's typed name, their sign-in email and the time.
Payments: Stripe handles card and bank details. We never see full card or bank account numbers. We keep payment amounts, status, fees, refunds and disputes.
Homeowner requests: the homeowner's email and name, the address, what they wrote about the work and the kind of work we filed it under, photos with location data removed, which shops got the request, each shop's reply, the booking and deposit, and any no-show report with what the homeowner and the shop each told us and what we decided.
Local shops we find: when no shop on Doing Work serves an area yet, Doing Work may look up local businesses from public business listings (Google Maps) and public state license records: the business name, kind of work, address, town, state and ZIP code, phone, website, license status, and where we found it. Staff may add a business email from the shop's own website. We keep these inside Doing Work and don't show them to homeowners. We may email a found shop about a request waiting near it (never with the homeowner's details), and a person may call it. We keep a record of each email we sent and a permanent list of addresses that asked us to stop, so we never email them again.
Agents: see the next section.
Email: what we sent, to whom, whether it was delivered, and unsubscribe choices.

When a shop uses an agent, we keep:

for OAuth: the agent's registered name and redirect address, which person approved it, and the tokens we issued, with when they expire or were revoked;
for named agent keys and claims: the key's label, scopes, which owner made or approved it, the terms version they accepted, when it was made, last used and revoked. Keys themselves are shown once and stored only as a hash;
for register then claim: the agent's chosen name, requested scopes, the claim token's hash and the email it was sent to. Claim links last 24 hours, and an agent that was never claimed is deleted one day after its claim expires;
for A2A: each task an agent sends, the operation, a fingerprint of its input, the result and its state. Each task is deleted 30 days after its last update;
for every surface: what each agent did, in the shop's activity log.

An agent can read and act on a shop's data only within the access it was given. If the shop's agent runs on an outside AI service, what the agent reads may be sent to that service under that service's own terms. We don't control it.

If the shop's agent syncs with QuickBooks, the agent reads the shop's invoices, payments, refunds, customers and payouts from Doing Work and writes them to the shop's own QuickBooks account. Doing Work does not connect to QuickBooks and does not send data to Intuit. We keep the QuickBooks ids the agent saves, so it can update records instead of making duplicates.

Doing Work runs its own AI. That AI does not run on your data. We do not send your shop's data to an AI provider. Your shop's agent works the shop's records. If a shop connects its own voice AI provider to answer or place calls, the call goes to that provider under the shop's account and that provider's terms, and the provider sends us back a short summary of the call.

Homeowner requests

We send a request only to shops on Doing Work that turned requests on and that serve the address and do that kind of work. Before the homeowner books, those shops see the town, state and ZIP code, not the street address, plus what the homeowner wrote and the photos. When the homeowner picks a reply, that shop gets the homeowner's name, email, the phone number if they gave one, and the address, so it can do the job. That shop then holds those details as its own customer record, under "Our two roles."

Replies are listed with shops that usually reply fastest first. Price and fees never change the order. If no shop serves the area yet, the request waits, and when a matching shop turns requests on later we send it the waiting request and email the homeowner.

We email the homeowner when a shop replies, when a waiting request reaches a shop, and when we decide a no-show report. If the homeowner gives us a webhook address for their own agent, we send these events there too. It must be a public https address. Events carry ids and a status, not the request details, and are signed with a secret we store encrypted.

How we use it

To run Doing Work for each shop, sign people in, take our fees, send the emails a shop asks us to send, keep the service secure, prevent fraud and abuse, answer support requests and meet legal duties. We don't sell personal information, and we don't use a shop's customer list to market to those customers.

Customer pages

Pay, sign, quote and customer hub pages are served from pages.doingwork.work, a separate address from our app. These pages use one cookie, a secure sign-in cookie (__Host-dw_session) that scripts can't read, to keep the customer signed in. The pages tell search engines not to index them. Doing Work's app and customer pages carry no analytics, ad tags or tracking scripts.

Payments and Stripe Connect

Each shop connects its own Stripe account. Customers pay on a Stripe Checkout page, by card or US bank account, so card and bank details go straight to Stripe. When a customer pays a shop, Stripe processes the payment for the shop, and Stripe's privacy policy covers the card or bank details. We receive from Stripe the payment's amount, status, fees, refunds and disputes, and the shop's Stripe account status. Our fees are taken through Stripe from those payments.

Email, unsubscribe and do-not-email

Doing Work sends emails for shops, such as sign-in links, quotes, invoices, reminders and review requests. Every review request email has an unsubscribe link. When someone unsubscribes, their address goes on that shop's do-not-email list, and Doing Work stops sending them review requests from that shop. We keep the list so the choice sticks. Emails needed for a job, such as invoices, receipts and sign-in links, can still be sent.

Service providers that help us run Doing Work, each getting only what it needs:

Stripe, for payments;
Resend, for delivering email;
Cloudflare, for this website and our domain;
Twilio, for shops that connect their own Twilio number for texts and calls (the shop's own account);
Fly.io, our cloud hosting provider, which runs the app, its PostgreSQL database and photo storage in the United States.

The current list, with what each one handles, is at doingwork.work/subprocessors/.

We also share information if the law requires it, to protect people or the service, or if our business is sold. A buyer keeps this policy's promises for existing data.

Handing off a shop

When a shop is handed off to a new owner, the shop's data stays with the shop and the new owner gets access to it. The old owner's agent keys are revoked. Unpaid invoices are voided and reissued so customers pay the new owner's Stripe account. The record of the old invoices stays in the shop's history.

Do Not Track

Our sites do not change how they work in response to browser Do Not Track signals.

Closing a shop and deletion

Photos and details from a homeowner request that was not booked are deleted 90 days after it was sent. We remove location and camera data from request photos when they arrive, so the shops that receive a request do not see where a photo was taken.

When an owner closes a shop, we offer an export of its data first. All workers and agents lose access and customer links stop working. Agent connections and webhooks stop. For 90 days after closing, the owner who closed the shop can reopen it on a page we host, signed in with their own email. Workers are not added back and must be invited again.

After 90 days, we delete the shop's working data: photos and photo files, photo shares and tags, notes, scheduled messages, templates, saved reports, request forms, the price book, approval rules, schedules and hours, time off, invites, webhooks, agent tasks and saved cards. Each deletion is recorded in the activity log. We keep the shop's business records, because they back up payments, taxes, signatures and disputes: the activity log, invoices, payments, refunds, disputes, payouts, fees, tax rates, quotes, change orders, signatures and signed documents, job records, checklists, forms, daily logs, time entries, expenses, jobs, visits and customers. A shop's customers can still be deleted one by one as below.

When a shop deletes one customer, we remove that customer's name, email, phone and street address. Invoice amounts and the city, state and ZIP code needed for tax records stay.

Your choices and rights

The owner can export the shop's data in Doing Work at any time. To correct or delete your own information, email contact@doingwork.work from your account email. We may need to confirm who you are. Workers can also ask their shop's owner. Customers should contact the shop first.

Some state laws give residents rights to know, correct or delete personal information. We honor those requests where they apply, and we won't treat you differently for using them.

Security

Connections use HTTPS. People sign in with one-time email links. Agent keys are stored only as hashes. Roles, scopes and database rules limit who can see each shop's data. No system is perfectly secure. If a breach affects your data, we tell the owner by email as the law requires.

Children

Doing Work is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children under 13.

Changes and contact

We post changes here and update the date. For material changes, we email owners before they take effect. Questions: contact@doingwork.work, (208) 274-3273, or Doing Work LLC, 212 W Ironwood Dr Ste D PMB 466, Coeur d'Alene, ID 83814.