Privacy Policy

LienBuild has two parts. The free document generators — lien waivers, demand letters, and pay applications — need no account and store nothing you type. The Recovery Plan, a paid per-project workflow for an unpaid final invoice, needs an account and keeps the project record you build with it. This policy covers both, and says which part each statement applies to.

LienBuild is not a law firm and does not provide legal advice. What the service does with the information you enter is set out in the Terms of Service and the Disclaimer.

The values you enter in a free generator are sent to our server only to build the document you asked for, inside that one request. They are not written to a database, not attached to an account, and not used to build a profile of you. When the PDF reaches your browser, the request is over and there is nothing left on our server to look up. The one exception is what a Clarity recording can show on these pages — see Analytics below.

Our hosting platform keeps standard request logs (the pages requested, the IP address, and the time) for security and capacity. On the free tools those logs are not tied to an account, because there is no account.

The Recovery Plan is the only part of LienBuild that needs an account. You sign in with Google or with an email sign-in link — there is no LienBuild password. For either method we store the name, email address, and profile picture the sign-in provider gives us, plus your active sign-in sessions.

We send only service emails: the sign-in link; step emails to your customer that you personally confirm — each one also CC'd to your own sign-in address, so your mailbox receives the same message the project timeline records; and reminder emails about your own plan — addressed to you, never to your customer — when reminders are turned on for the deployment. Your payment receipt comes from the payment processor, not from us. There is no newsletter and no marketing list.

A Recovery Plan stores the project facts you enter (project name, customer name, your company, the project state, the unpaid amount, and the original due date), and for each step email it stores the delivery record — recipient address, status, the document version that was sent, and the time. That record is the product: one permanent, uneditable timeline of what was sent, and the plan workspace shows it to you exactly as it is stored. The timeline also exports as a plain-text file.

What a sent step said exists where it went: in the email itself, and — for the demand and notice steps — in the PDF you can download from the document editor; the reminder step is text in the workspace. Your working drafts — a document you are still editing, and the action-checklist checkoffs — live in the workspace page while you work on it; they are a local aid and are not stored on our servers.

Before you pay, the free preview lives in your browser's session storage only. It is scoped to the tab, it is gone when the tab closes, it is never written to local storage, and it never reaches us until you choose to activate a plan.

Payment for a Recovery Plan is processed by our payment processor on its own secure pages. We never see, receive, or store your card or bank details, and we never hold or advance funds on your behalf. What we keep is the transaction record: our order id, the processor's order id, the amount and currency, the order status, and the plan facts needed to unlock your plan after the payment succeeds.

Refunds follow the Terms of Service.

• We do not sell your personal information.
• We do not send marketing messages — only the service emails listed under Your account.
• We do not use what you type in the free generators for anything beyond the document you asked for.

While you are signed in, the sign-in service keeps a first-party session cookie so you stay signed in. The homepage's state picker remembers your selection (Texas, California, or Florida) in your browser's local storage. A free Recovery Plan preview lives in session storage until the tab closes — see Recovery Plan data. The analytics consent answer (reject all / analytics only / accept all) and the opt-out flag live in local storage, not cookies; clear them and the consent banner asks again. Third-party analytics cookies are described under Analytics.

We use Google Analytics 4 to see which pages are visited, which sites send people here, and in broad terms which devices and regions visitors use. The events we send are enumerations only — which button was clicked, which state was picked, which document type, which funnel step. The analytics layer accepts only event names on a fixed allowlist, drops any parameter whose name is known to be able to carry personal or project facts, and cuts every string parameter off at 100 characters — so no names, amounts, addresses, or document text reach the analytics tools.

We use Microsoft Clarity to record sessions and heatmaps on the public pages, so we can see how pages are actually used — for example, where someone gives up halfway through a form. Clarity does not load at all on the Recovery Plan pages where your project facts appear: the plan landing page and workspace, the sign-in page, and the checkout pages. On those pages Google Analytics 4 still runs, with the enum-only events described above. A Clarity recording does capture what is on screen on the pages where it runs, so use sample names and amounts when you are only trying the forms out.

Both tools collect the identifier in the cookie they store, the page address, the site you came from, browser and device type, and an approximate location worked out from your IP address. Google uses your IP address only long enough to work out that location, then discards it. What these tools report is kept only as long as each tool's own retention settings allow, is used only to understand and improve the site, and is processed for us by Google and Microsoft under their own privacy policies (Google, Microsoft).

The first time you visit, a banner asks what to allow — every choice is a single tap. Reject all loads neither tool, Analytics only loads Google Analytics, and Accept all loads both Google Analytics and Microsoft Clarity. The site works the same under any of them. Your answer is remembered in your browser until you clear it. You can also block these cookies in your browser settings or with an ad-blocker, or add ?no-track=1 to the address of any page. That browser then stops loading both tools until you add ?no-track=0. Cookies already in your browser stay until you delete them.

Our servers keep a first-party log of page visits so we can count visitors and tell whether advertising brings people here. Each entry is the page address, the site that sent you (reduced to its origin), any campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), and a daily-rotated hash of your IP address and of your browser's user-agent string. The raw IP address and browser string are never stored, and the hash key changes every day, so yesterday's entries cannot be re-linked to today's. What you type into any form is never written to this log — it contains no names, amounts, addresses, or document text. The account workspace and checkout pages are not logged at all, and entries are deleted about 90 days after the visit.

If you email support@lienbuild.com, we receive your email address and whatever you write, and we keep it only as long as it takes to answer you and keep a record of the exchange. Ask us to delete it and we will.

Account data — your sign-in details, plans, and step email records — is kept while your account exists. Email us and we will delete your account and the data attached to it.

Order records are kept while your account exists, and they are deleted when your account is deleted.

What you type in the free generators is kept for no longer than the single request that builds your document. Clarity recordings expire about 30 days after your visit. Google Analytics reports are kept for the retention period set in the Google Analytics console. First-party page-visit logs are deleted about 90 days after the visit — see Page visit logs.

You can ask us what information we hold about you, ask for a copy of it, or ask us to delete it, by emailing support@lienbuild.com. In practice that is your account data and the emails you have sent us; the request logs our hosting platform keeps roll off within days. Page-visit log entries are daily-rotated hashes with no name attached and cannot be matched to a person, and they roll off within about 90 days — see Page visit logs. Analytics records are tied to a cookie in your browser, not to your name: a Google Analytics record can only be matched by the identifier in your _ga cookie — send us that value and we will delete what is tied to it. A Clarity recording cannot be deleted separately and cannot be looked up by name, but it expires about 30 days after your visit. Where we cannot match a record, we will tell you so.

If your state has its own privacy statute, you may have additional rights over your personal information, and we will honor the rights that apply to you.

Some pages show statutory text compiled from official state legislative websites, with the date that text was last verified. Those sites are not ours, and a source can change or be withdrawn at any time.

Account data is protected by the sign-in session and is only reachable through it; the free generators keep no document archive to lose. Clarity recordings sit inside Microsoft's systems under its security, not ours. If an incident ever affects information we do hold, we will notify you and the authorities where the law requires it. If we learn of a breach at Google, Microsoft, or our payment processor that affects what was recorded about your visit, we will tell you the same way.

If this policy changes, the date at the top of the page changes with it. For a material change, the new policy is published on this page before it takes effect.

Questions about this policy or about your data: support@lienbuild.com.