This notice explains how Cresalto LLC handles personal information in Finishwork. It covers two different people: the contractor who signs in and uses the tool, and the person who opens a document you shared with them.
The short version: we collect what the tool needs to build and deliver your documents, we don’t sell anything to anyone, there is no advertising and no third-party analytics, and the only outside companies that touch your data are the ones listed below that we need to run the service.
1. Who is responsible for what
For your own account — your name, your email, how you use the tool — we decide what’s collected, and this notice is our explanation of it.
For the information you put in about your customers — their names, addresses, phone numbers, email addresses, and the details of their jobs — you decide what goes in and who it goes to. We hold and process it on your behalf, to run the service for you, and for nothing else. If one of your customers asks us to see or delete their information, we will point them to you and let you know.
2. What we collect from you
- Account details: your name, your email address, and a hashed version of your password. We never store a readable password.
- Your company’s details, as you enter them: business name, licence number and classification, phone, email, office address, website, team members, brand colours and logo, warranty and fine-print wording, and your standard pages.
- What you upload or paste: estimates, past proposals, photos, customer reviews and quotes, and the address of your website when you ask us to read it.
- The documents you build, their versions, and their share links.
- Security records: sign-in attempts and their outcome, the IP address they came from, and how many recent failures an account has had, so we can slow down someone guessing passwords.
- Your acceptance of these documents: which version, when, from which IP address and browser.
- Ordinary server logs: requests, timestamps, IP address, and browser identification, kept briefly for security and debugging.
3. What we collect about your customers
Only what you put in, and what a document’s recipients do with the link. From you: their name, the job address, contact details you enter, the scope of work, and the prices you quote.
4. What happens when someone opens a link you shared
When a person opens a document you shared, Finishwork records the visit so we can tell you your client has read it. That record holds the date and time, which document and which link, whether they downloaded the PDF, and their browser’s identification — not their name, and no account.
The page also sets a small random cookie in that person’s browser, named fw_visitor. It contains random characters and nothing about them. Its only purpose is to tell one person coming back from a different person opening the link for the first time, so that a refresh isn’t reported to you as a second reader. It is limited to the share-link part of the site, lasts up to a year, and is not used for advertising, profiling, or tracking anyone across other websites.
If your company has questions turned on and a recipient types a question about a line, we store the question, when it was asked, and which line it was about, and show it to you. We don’t ask them for a name.
The people who receive your documents don’t have accounts and never agreed to anything with us. Telling them what you collect about them is part of your own privacy obligations to your customers.
5. Cookies
Two, both first-party and both functional. There are no advertising cookies, no third-party analytics, and no cross-site tracking anywhere in Finishwork.
- A sign-in session cookie, set when you sign in, so the tool knows it’s you. It goes away when your session ends.
- The fw_visitor cookie described above, set on the share page in a recipient’s browser.
Some browsers send a “Do Not Track” signal. Finishwork doesn’t behave differently when it sees one, because there’s nothing to switch off: we don’t follow anyone across other websites, and no third party collects information about your activity through Finishwork. The two cookies above are the whole of it.
6. Why we use it
- To build your documents and show them the way you designed them.
- To deliver a share link and, when you ask, to send it by email.
- To tell you when a client opened a document, downloaded it, or asked a question.
- To keep accounts secure — rate limits, sign-in brakes, and abuse investigation.
- To answer your questions and help you when something goes wrong.
- To fix bugs and make the product better.
- To meet legal obligations, and to keep the record of which terms you accepted.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use your content or your customers’ information to train any AI model.
7. Who else sees it
Only the service providers we need to run Finishwork. Each one gets what it needs for its job and nothing else, and each is bound by its own agreement with us.
- Fly.io — hosting. The application and the database run on their servers in the United States, and the database is continuously replicated to their Tigris object storage so it can be restored.
- OpenRouter — AI routing, and through it the model providers that answer, today Google and Anthropic. What you upload for a document — your estimate, a past proposal, the text of your website — is sent to them so a model can read it. We do not train models on your content, and we do not control these providers’ own terms.
- Resend — email delivery, when you send a document link by email. They receive the recipient’s email address and the message.
We may also disclose information if the law requires it, or to protect the rights and safety of people using Finishwork. If our business is ever sold or merged, this information may transfer with it, and this notice continues to apply until it’s replaced.
8. Where it lives, and how long we keep it
Everything is stored in the United States.
We keep your account and your content while your account is open, and delete it on request. Backups are kept for a rolling window and then age out, so deleted material can persist briefly in a backup before it’s gone. Visit records and questions live as long as the document does. Security and acceptance records are kept longer, because they are the record of what happened.
9. How we protect it
Traffic is encrypted in transit. Passwords are hashed, never stored readably. Access to production is limited to people who need it. Sign-in has rate limits and per-account pauses to slow down guessing. Every part of the tool is scoped to one company, so one contractor’s data is never served to another.
No system is perfectly secure, and we won’t pretend otherwise. If a breach affects you, we’ll tell you.
10. Your choices
Write to paul@cresalto.com and we will: tell you what we hold about you, correct it, give you a copy of your documents and your data, or delete your account and its contents. We’ll ask you to confirm who you are first, and we won’t treat you differently for asking.
If you’re a California resident, the California Consumer Privacy Act gives you the rights to know, delete, correct, and to opt out of the sale or sharing of your personal information. We don’t sell or share personal information, so there is nothing to opt out of — the other rights are exercised at the address above.
11. Children
Finishwork is a business tool for contractors. It isn’t meant for children and we don’t knowingly collect information from anyone under 16. If you think we have, write to us and we’ll delete it.
12. Changes to this notice
We’ll update this notice when what we do changes, and the effective date at the top will say so. If a change matters, we’ll ask you to accept the new version the next time you sign in.
13. Talk to us
Cresalto LLC, a California limited liability company. For anything about privacy, including a request about your data, write to paul@cresalto.com.