Privacy Policy — GPLscore

1. The short version

You upload your GPL. We email you a grade. We do not sell your data, we do not run ad networks on this site, and we don't share your GPL with anyone outside the limited list of vendors below.

2. What we collect

Your email address — so we can send you the grade and answer follow-ups.
Your funeral home name and (when you give it) state — so we can benchmark against the right region.
Your General Price List PDF — the document you upload.
Order and billing data for paid tiers (collected by Stripe; see below).
Basic, cookieless web analytics (page views, referrer, country) via Plausible — no third-party cookies, no cross-site tracking, no fingerprinting.

3. AI vendors that process your GPL

We use the Lovable AI Gateway, which routes prompts to one or more of: Anthropic (Claude), OpenAI (GPT family), and Google (Gemini family). Your uploaded PDF text and your funeral home name are sent to these providers for the sole purpose of producing your grade or report. These providers do not use GPLscore prompts to train foundation models under their current enterprise terms.

4. Other vendors

Stripe — processes payments for the Deep Audit and Done-for-You tiers. We never see or store your full card number.
Supabase / Lovable Cloud — hosts the database and encrypted file storage where your GPL lives.
Resend — sends our transactional emails (your grade, audit deliveries, payment receipts, password resets) AND manages our newsletter list and delivers the weekly newsletter if you opt in via the footer. Resend processes your email address solely to deliver these messages. You can unsubscribe from the newsletter at any time via the link in every email; transactional emails are part of fulfilling your purchase.
Plausible Analytics — cookieless, privacy-preserving site analytics.

Each vendor is bound by its own terms and applicable data processing agreements.

5. How long we keep it

Uploaded GPLs are retained for as long as your account is active, or up to 24 months from upload, whichever is shorter. Grades and reports are retained for the same period so you can re-download them. You may request earlier deletion at any time by emailing hello@gplscore.com.

6. De-identified benchmarks

We compute regional pricing benchmarks from the GPLs we grade. We only use de-identified, aggregated values (e.g., "median Basic Services Fee in Kentucky"). We never publish, share, or display an individual funeral home's prices linked to its name.

7. Marketing email

If you opt into the weekly email from the footer, you'll get one short Sunday note. Unsubscribe in any email. Transactional emails (your grade, your receipt, your audit) are sent because you asked for them and aren't subject to the unsubscribe.

8. Your rights

You may request access to, correction of, or deletion of your personal data and your uploaded GPL. California, EEA, UK, and Canadian residents have additional rights under their local privacy laws (CCPA/CPRA, GDPR, UK GDPR, PIPEDA). To exercise any of these rights, email hello@gplscore.com and we'll respond within 30 days.

9. Security

GPLs are stored in encrypted object storage with access limited to the GPLscore backend service role. Transport is HTTPS only. No system is perfectly secure; we'll notify affected users promptly if we ever detect unauthorized access.

10. Children

GPLscore is a B2B tool for funeral home owners. It is not directed to children under 16 and we do not knowingly collect data from them.

11. Changes

When we update this Policy, we'll change the effective date at the top of the page. Material changes will also be emailed to anyone with an active paid order.

12. Contact

Privacy questions, deletion requests, or anything else: hello@gplscore.com.