Legal

Privacy Policy

Last updated: May 22, 2026

This policy covers EvenQuote’s handling of personal information. It’s written to be read, not filed. If something is unclear, email info@hocusbuzz.com and we’ll answer.

Who we are

EvenQuote is a service operated by Hocusbuzz LLC, a California limited liability company with an office at 845 Applewilde Dr, San Marcos, CA 92078. When this policy says “we” or “us,” that’s the entity above.

For privacy questions, support, or any of the rights described below, contact: info@hocusbuzz.com.

What we do, in one paragraph

You tell us about a job (move, cleaning, handyman, lawn care, junk removal, electrical, or any other vertical we add later). We charge you $7.99. Our AI assistant calls local pros on your behalf, asks the questions you’d ask, records and transcribes those calls, and emails you a side-by-side comparison report. We never share your contact details with a business unless you click the “share my contact” button on the report. We never sell your data, and we don’t run third-party ad pixels.

What we collect

From you, when you submit a quote request

Identity: name, email, phone number.
Job details: addresses (origin and destination for moving, service address for any other vertical), home size or job scope, dates, flexibility, special items, and any free-text notes you add.
Authentication: an email address used to sign you in via a magic link. We do not collect or store passwords.

From your interaction with the site

Technical: IP address, browser type, referring page, and similar HTTP-level metadata. Used for abuse prevention and basic logs. Logs are retained for 30 days then rotated out.
Cookies: a small set of first-party cookies for session authentication and CSRF protection.
Analytics: we use Google Analytics 4 and the Meta (Facebook) Pixel to count how many people visit, start a quote request, and complete payment. GA4 runs with anonymize_ip on (your IP is truncated before storage) and non_personalized_ads on (your visit is not added to Google’s ads-targeting graph). The Meta Pixel is used only to measure the conversion funnel from our paid Facebook / Instagram ads — we do not maintain custom audiences, run lookalike modeling, or use Meta’s “Advanced Matching” (which would hash and send your email/phone). Events sent to either platform include the page URL (which may contain a UTM tag from an ad you clicked), an opaque request UUID, and the $7.99 transaction value — never your name, phone, email, or address.

From third parties acting on your behalf

Payment metadata from Stripe (last 4 digits of card, brand, country, and a Stripe customer/charge ID). We never receive or store your full card number.
Address suggestions from Google Places (you typed; we proxied the request server-side so Google does not see your IP).

Generated during the service

Call transcripts — text transcriptions of the AI’s calls to local pros, stored alongside each request.
Call recordings — audio of the same calls, stored short-term for quality assurance and dispute resolution.
Structured quote data — the AI extracts price ranges, availability, and notes from each transcript and stores them as fields on a quote record.

What we do NOT collect

Government IDs (SSN, passport, driver’s license).
Health or medical data.
Race, ethnicity, religion, sexual orientation, political views, union membership, or biometric identifiers.
Geolocation beyond the address you typed.
The contents of your other emails, files, or accounts.

Why we collect it

Each piece of data has a specific purpose:

Identity + job details: to run the service you paid for. (EU/UK legal basis: performance of contract.)
Payment metadata: to process and refund the $7.99. (Performance of contract.)
Call recordings + transcripts: for quality assurance, dispute resolution, and generating the report you receive. (Performance of contract; legitimate interest in QA.)
IP / browser metadata: abuse prevention and debugging. (Legitimate interest.)
Email address: authentication and report delivery. (Performance of contract.)

We do not use any of this data for behavioral advertising or profiling, and we do not transfer your data to third parties for their own marketing purposes.

Call recording disclosure

The AI assistant announces that it is an AI at the start of every call using language that identifies it as an automated assistant calling on behalf of a customer in your city. This satisfies California’s BOT disclosure law (SB 1001). The business on the other end can choose to continue or hang up.

When a pro doesn’t pick up, the AI may leave a brief voicemail on your behalf — identifying the calling party as an AI assistant calling for a customer in your city and providing a callback number that routes back to our AI (the pro never receives your phone number in the voicemail). Inbound callbacks are recorded and transcribed under the same disclosure as outbound calls.

By submitting a quote request, you authorize us to identify you (by city/state — never your full address or contact details) to the businesses we call, and to record and transcribe those calls (including any voicemails left and inbound callbacks) for the purposes listed above.

Specifically, the AI assistant we send to a service provider on your behalf does not have access to and will not disclose your first or last name, your phone number, your email address, or your street address. We strip these fields at the dispatch boundary before any call is placed. The provider only learns your service area (city, state, zip code) and the job specifics you entered (home size, dates, notes). If a provider asks the AI for any of the above, the AI is instructed to refuse.

SMS and automated calls to you

When you submit your phone number on the intake form (where the SMS consent notice is displayed), you opt in to receive automated calls and recurring text messages from EvenQuote about your quote request. We use these to:

Confirm payment and deliver your magic-link sign-in.
Notify you when your quotes are ready.
Relay callback requests from pros who responded to our voicemail (we forward their text to you if it’s a textable number).
Send follow-up quotes that land within 24 hours of your initial report.

Message frequency varies but is typically 1–5 messages per quote request. Message and data rates from your carrier may apply. We use Twilio (and Vapi where SMS is part of a call flow) to deliver these messages.

Reply STOP to any message to unsubscribe from all further SMS from EvenQuote, or HELP for help. Unsubscribing from SMS does not cancel your quote request (you’ll still receive your report via email) but removes you from any future SMS contact.

We do not share your phone number with the businesses we call. We do not sell, rent, or transfer your phone number to advertising networks or data brokers.

Who we share it with

We share data only with these specific service providers, only for the purposes they need:

Supabase (database, auth) — all stored data; bound by their data-processing agreement.
Vercel (hosting) — HTTP traffic in transit; application hosting only.
Stripe (payments) — payment + email; for processing the $7.99.
Resend (email) — recipient email + email body; for sending the magic link and your report.
Vapi (voice AI) — transcript + recording + business phone; for running the calls.
Twilio (telephony, via Vapi) — phone number connectivity; for placing the calls.
Anthropic (LLM) — call transcripts (text only); for extracting structured quotes. Per Anthropic’s enterprise terms, transcripts are NOT used to train models.
Google Places — address strings you typed; for address autocomplete and business directory data.
Google Analytics 4 — visit, start, paid, and delivered counts, with anonymized IP and ad-personalization turned off. Never your name, phone, email, or address. See the “Cookies” bullet above for details.
Meta (Facebook) Pixel + Conversions API — pageview, lead, purchase, and quote-delivered event counts from visitors who arrived via our Facebook or Instagram ads, used to measure ad performance. No Advanced Matching, no custom audiences from your visit. The Conversions API (server-side fan-out) sends only the SHA-256 hash of an opaque request UUID as the user identifier — never your name, phone, email, or address. See the “Cookies” bullet above for details.

We do not share your data with:

Advertising networks
Data brokers
Marketing companies, or analytics companies beyond GA4 as described above
Other quote-shopping or referral services

We share your contact information with a specific business only when you click “Share my contact” on a quote in your dashboard. Until you do, that business knows only your city and the job parameters.

Sale or sharing of personal information (CCPA/CPRA)

We do not “sell” your personal information as defined by the CCPA, and we do not “share” it for cross-context behavioral advertising. California residents have the right to opt out of any future sale or sharing — but there is nothing to opt out of today. If we ever change that, we will give 30 days’ notice and an opt-out link.

How long we keep it

We retain personal information only as long as we need it to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

Quote requests, transcripts, and associated data: kept while your account is active and for a reasonable period after, in case you want to reference a past report. You can request deletion at any time.
Call recordings: kept short-term for quality assurance and dispute resolution, then deleted.
Payment records: retained for at least 7 years to comply with U.S. tax and accounting law.

We’re still refining the specific retention windows for each category based on real launch usage and will publish concrete day-counts in the next revision of this policy. In the meantime, if you want your data deleted sooner, email info@hocusbuzz.com and we’ll handle it within 30 days.

Your rights

Email info@hocusbuzz.com to:

Get a copy of the data we have about you.
Correct something we have wrong.
Delete your data (subject to the 7-year payment-record exception required by tax law).
Receive your data in a portable format (JSON).
Opt out of any non-essential processing (today there is none).
Withdraw consent for call recording, which stops future calls on your behalf.

We respond within 30 days. If you’re in the EU, UK, or California, you also have the right to lodge a complaint with your local data protection authority (CNIL, ICO, the California Attorney General).

Security

All traffic is HTTPS-only.
Database access enforces row-level security; administrative credentials never reach the browser.
Payment card data never touches our servers — Stripe handles it end-to-end and we receive only metadata.
We use industry-standard hashing for any sensitive lookups.
If we learn of a data incident affecting your information, we notify you within 72 hours where required by law (GDPR; many U.S. state laws).

No security is perfect. If you spot something concerning, email info@hocusbuzz.com with “security” in the subject.

International transfers

Our hosting (Vercel, Supabase, Stripe, Resend, Vapi, Anthropic) is primarily in the United States. If you submit a request from the EU, UK, or anywhere outside the U.S., your data is transferred to and processed in the U.S. We rely on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework where applicable.

Children

EvenQuote is not intended for children under 13 and we do not knowingly collect information from them. If you believe we have, please email us and we’ll delete it.

Changes to this policy

We update the “Last updated” date when we change this policy. For material changes (anything affecting your rights or what we collect beyond the existing list), we email everyone with an active account at least 14 days before the change takes effect.

Contact

Privacy questions, security disclosures, support — one address: info@hocusbuzz.com.

Mailing address: Hocusbuzz LLC, 845 Applewilde Dr, San Marcos, CA 92078.