Privacy Policy

Last updated: October 4, 2026

This policy explains what CommonTape collects through commontape.com, why, and what we do with it. In this policy, “CommonTape,” “we” and “us” mean CommonTape.

Where we are today

commontape.com is a pre-launch site with two data-collecting features: a waitlist form, and a booking service that AI agents use to book jobs with businesses. Section 6 covers the booking service.

1. What we collect

Waitlist form. When you submit the founding-merchant or trade waitlist form, we collect what you type into it: business name, trade, service area and email address. We also record which form you used and when you submitted it. Nothing else is requested.

Email you send us. If you write to hello@commontape.com, we keep your message and address so we can reply.

Hosting logs. Our host, Vercel, processes standard request data (such as IP address and browser type) to deliver and protect the site; that is governed by Vercel’s own privacy terms.

Sign-in requests. When someone asks for a sign-in link, we keep a one-way code made from the requesting IP address with a secret key (never the address itself), only to stop one person from sending sign-in emails to many addresses. It is deleted after about a day.

2. What we do not collect

• No advertising trackers or analytics pixels run on the site.
• The site’s own code sets no cookies, so there is no cookie banner. Our hosting provider may set technical cookies for delivery or bot protection that we don’t control.
• We don’t collect payment information. CommonTape doesn’t take payment for jobs (see our Terms).
• We don’t sell personal information or share it for advertising.

3. How we use it

To contact you about the founding-merchant program or your trade’s waitlist, to decide who to onboard first, to reply to your emails, and to keep the site secure (for example, filtering bot submissions). We don’t use it for anything else without telling you first.

4. Where it’s stored and who can access it

Waitlist data is stored in a Supabase Postgres database. Row-level security is on, and the table has no browser-side read or write access at all: only our server, using a secret key that is never sent to your browser, can read or write it. The site is served by Vercel over HTTPS.

We share personal information only with the service providers that run the site for us (Vercel, Supabase and Resend, our email provider), or where the law requires it. These providers may process data in the United States and other countries where they operate.

5. How long we keep it

Waitlist entries are kept until you ask us to delete them or 24 months after you submitted them, whichever comes first.

The code kept for a sign-in request is deleted within 25 hours. When an email to a business or a sign-in link does not go out, or a sign-in link is held back by that limit, we keep a note of when and why (and which job) for 90 days, never the address, the IP address or the message.

For each insurance, license or rating, we keep the email address of who recorded it. The same goes for the check that switches a business on. These records stay with the business and aren’t deleted on a timer.

6. Bookings made through AI agents

When an AI agent books a job with a business through CommonTape, the agent sends us the customer’s name, phone number, service address and, optionally, email address, along with the service requested and the price quoted. We use this only to complete the booking: we share it with the business that will do the job (by email) so they can show up, and we keep a record of the job (service, price, times, status, ZIP code and home description) so the booking can be managed. We don’t sell it or use it for advertising.

Anyone can try CommonTape with a public demo key, against a pretend business. Details typed into a demo booking go to nobody and are deleted within about 25 hours.

If a job is declined, expires or is cancelled, the customer’s contact details are deleted automatically. For completed jobs we keep them for 24 months after the booking, then delete them. Anything the customer typed as a special request is deleted 24 months after the booking. The record then shows only that a request was made. The ZIP code and the home’s description stay with the business’s job history. They aren’t deleted on a timer, so a past price can still be explained. The AI agent or platform you used to make the booking has its own privacy terms, which we don’t control. CommonTape doesn’t take payment for jobs; you pay the business directly.

Some copies sit outside this deletion. Resend, our email provider, keeps copies of our emails under its own terms. The business also keeps the job emails in its own inbox. Our hosting and database providers keep short-lived caches and backups. These expire on their own schedule.

7. Your choices

Email hello@commontape.com to see, correct or delete the information you gave us. We’ll respond within 30 days. We can also delete a booking’s details and requests before the 24 months are up. If you live somewhere with a statutory privacy right (for example, California), those rights apply and we will honor them through the same address.

8. Children

The site is for businesses and isn’t directed at children under 13; we don’t knowingly collect their information.

9. Changes

We’ll post changes here with a new date. If a change materially affects data we already hold, we’ll tell waitlist members by email.

10. Contact

hello@commontape.com — see our Contact page.