Privacy Policy

Effective October 3, 2026

Wendolo (wendolo.com, app.wendolo.com) is a product of Baker Web Solutions L.L.C., d/b/a Wendolo, a Utah limited liability company (“Wendolo,” “we,” “us”). This page explains what we collect, why, and what you can do about it.

Who this applies to

Wendolo is job-tracking and follow-up software for home-service businesses (“our customers”). Customers use it to keep track of the inquiries that reach them, follow up, quote, win jobs and get paid. Three different kinds of people show up in our data:

• Wendolo users — people who log in to run the platform for a customer business (an owner, an office manager, a caller).
• Inquirers — people who fill out a contact form on one of our customers' websites, asking about work.
• Prospects — property owners, permit holders, licensed contractors and businesses whose details Wendolo gathers from public records and directories and shows to customers so they can find work (see “Public records we gather,” below).

When we process an inquiry submitted through a customer's website, or a contact record in a customer's workspace, we're doing it on behalf of that customer business, not for ourselves. The data a customer collects belongs to that customer, and we process it on the customer's behalf to provide and secure the service (for example spam screening and backups). The customer decides who to contact and how; we provide the tools.

What we collect

If you're a Wendolo user (you log in to the platform):

• Name, email address, and a password — stored as a one-way cryptographic hash, so we never see or store your actual password.
• If you turn on text alerts: your phone number, confirmed by a one-time code we text you, and whether you've opted in or out of texts.
• Session info: a session cookie, and the IP address and browser user agent recorded when you log in.
• If you connect your Gmail: your Google account's email address and an encrypted token that lets Wendolo send email through your account — see “Google user data,” below.

If you submit an inquiry on a customer's website:

• Whatever you type into the form: your name, business name, email, phone number, and message.
• Your IP address and browser user agent, and a Cloudflare Turnstile check that confirms you're not a bot.
• Where you came from, if the site passes it along: the traffic source, the campaign, and a Google Ads click ID. That way our customer can see which marketing is working.

Public records we gather:

Separately from inquiries, Wendolo gathers public records itself: county and city building and septic permit records, state water-well records, building-permit data from Shovels.ai, contractor-licensing-board rosters, and public business directories such as a chamber of commerce member list. These records include names (of property owners, permit holders, contractors and businesses), mailing and site addresses, property details such as acreage, and phone numbers where the source publishes them. We show them to our customers so they can find and contact prospective work. The collection is run by Wendolo, and the records are not limited to one customer. This is public-record and directory data, not anything we collect from the people themselves.

How we use it

• To run the platform: show inquiries and contact records to the right customer, sort them, and let a customer's staff call, email, or otherwise follow up.
• To notify a Wendolo user by email or text when someone writes in asking for work.
• To screen incoming website submissions for spam before they are added to a customer's records — see “Automated filtering,” below.
• To keep the platform reliable and catch problems, through basic application logs.

We don't sell personal information to data brokers or other data buyers, and we don't use it for advertising.

Automated filtering of website submissions

Every inquiry submitted through a customer's website is automatically screened for spam before it's added to the customer's records. Our spam filter sends a reduced version of the submission — the business name, the domain (not the full address) of any email given, whether a phone number was given, the website, city/state, the message, the browser user agent, and which business it was submitted to — to an AI classification provider (TypeSafe AI, or Anthropic, depending on configuration) to score how likely it is to be spam. Nothing is dropped outright: a submission that looks like spam is held for a person to review rather than deleted. Your IP address is never sent to the classifier.

Text messages

Wendolo sends text messages, through Twilio, from one Wendolo phone number — only to our own signed-in users, never to the people who write in to a business or to our customers' customers:

• A one-time verification code, when you add or re-confirm a phone number.
• An account alert when a new inquiry comes in for a business you work for, so you can respond quickly.

We only text a number after you've confirmed you own it by entering a code we sent to it. Message frequency varies — you'll typically get one text per inquiry, at the pace inquiries come in. Message and data rates may apply. Reply STOP to any text to opt out, or HELP for help. You can also turn text alerts off, or remove your number, from your Notifications settings.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, other than the service provider that delivers the texts (Twilio), which receives your number solely to send them. Text messaging originator opt-in data and consent will not be shared with any third parties.

Google user data

If you connect your Gmail account so you can email a customer or inquirer from inside Wendolo, we request only:

• gmail.send — permission to send a message through the Gmail API, as you, from your own mailbox. We never request permission to read your mail, so Wendolo cannot see your inbox, your sent mail, or any reply.
• openid and email — to confirm which Google account you connected.

What we store: the connected email address and an encrypted refresh token (so you don't have to reconnect every time), plus the specific permissions Google actually granted. We don't store your Gmail password, and we don't keep a usable access token between sends. Disconnecting Gmail from Settings revokes our access with Google and deletes the stored token.

Because we never request read access to your Gmail, your Gmail content never reaches our spam filter, any other AI model, or anyone else — it isn't something we have. Google user data is not used to train any AI or machine-learning model, and it is never sold.

Wendolo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share information with

We share information with the service providers that run Wendolo, each only for what they're there to do:

• DigitalOcean — hosts the application.
• Cloudflare — sits in front of our sites for security and performance, and runs the bot check (Turnstile) on public forms.
• Resend — sends transactional email (invitations, password resets, inquiry notifications).
• Twilio — delivers the text messages described above.
• Google — only for users who connect Gmail, to send email on their behalf.
• TypeSafe AI / Anthropic — classify inquiry submissions for spam, as described above.
• Cloudflare R2 — stores nightly database backups.
• Axiom — stores application logs for troubleshooting; emails and phone numbers are stripped out before logs leave our server.
• Regrid, Shovels.ai, and the U.S. Census Bureau's geocoder — provide property, permit, and location data we use to enrich the public records we collect.

Apart from these service providers, and the public records we show to our customers as described above, we don't share information with anyone else. We don't sell personal information to data brokers or other data buyers.

Security

Passwords are stored as one-way cryptographic hashes, never in plain text. For sign-in sessions, invitation links and password-reset links, we store only a hash of each token, never the token itself. Gmail tokens are encrypted at rest. Traffic to our sites runs over HTTPS.

How long we keep information

We keep a Wendolo user's account information for as long as the account is active, and delete it on request (see “Your choices,” below). Inquiry and contact data is kept as part of the customer business's own records for as long as they use Wendolo, since it's their business data. We don't currently have a fixed deletion schedule for every category of data — for example, submissions held for spam review. If you'd like something deleted sooner, contact us and we'll take care of it.

Your choices and requests

To access, correct, or delete personal information we hold about you, email hello@wendolo.com. If you're a Wendolo user, you can also manage your own phone number, text and email preferences, and Gmail connection directly from Settings.

Cookies

The marketing site (wendolo.com) sets no cookies and loads no third-party scripts or analytics — it's a static page. The application (app.wendolo.com) sets one cookie to keep you signed in; it carries no tracking or advertising purpose.

Children

Wendolo is a business tool for people running or working at a company. It isn't directed at, and we don't knowingly collect information from, children under 13 (or under 16, where that's the applicable age).

Changes to this policy

We'll update this page as Wendolo changes, and update the effective date above when we do.

Contact

Questions about this policy, or a request about your information: hello@wendolo.com. To request access to Wendolo, see Request access.