Legal

Privacy Policy

Last updated: 16 September 2026

This policy covers two different things, and they are worth separating. One is this website, where almost nothing happens. The other is our service, where a contractor connects their Jobber account to us and we read it and write to their customers. The second is where the real data protection questions live.

Who we are

Golden River Stone LLC is a Wyoming limited liability company. Its mailing address is 1007 N Orange St, 4th Floor, Suite 4590, Wilmington, DE 19801, USA. The person who operates the business day to day does so from Portugal, which means our processing falls under the EU General Data Protection Regulation as well as United States law. For GDPR purposes we are the controller for the website and for our own business correspondence. Contact: info@goldenriverstone.com.

Part A: this website

• No cookies are set.
• No analytics, advertising, or tracking scripts run on any page.
• Fonts are served from this domain. Nothing is fetched from Google, or from any other third party, when you load a page. Your browser talks only to goldenriverstone.com.
• There are no forms. The only way to reach us from this site is to open your own email client and write to us.

Our hosting provider, Vercel Inc., records standard request logs in order to serve and protect the site. Those logs contain technical data such as IP address, timestamp, and the page requested. We do not query them to identify visitors, and we do not combine them with anything else. They are held by Vercel under their own privacy policy and retention schedule, which we do not control.

If you email us, we receive whatever you chose to put in the message: your name, your address, your company, and the text you wrote. We use it to reply to you and for nothing else. We do not sell, rent, or share it for anyone's marketing.

Part B: the service for contractors

If you are a service contractor and you connect your Jobber account to us, more happens, and you should know exactly what.

What we read. With your approval, and using read-only permissions, we read your quotes, invoices, clients and payments from Jobber. We cannot create, edit or delete anything in your Jobber account.

What we store. Your access and refresh tokens, encrypted. A record of which follow-up we sent about which quote or invoice, and when, so that nobody is contacted twice. Your business name and the email address you gave us. We do not keep a copy of your customer database.

What we send, and to whom. Follow-up emails to your customers, about their own quotes and invoices, in your name, with replies going to your inbox and not to ours. Every message carries a working way to stop receiving them.

Who is responsible for what. Your customers are your customers. For their personal data you are the controller and we act as your processor, on your instructions, for the purpose of following up on your own quotes and invoices. If you need a written data processing agreement, ask us and we will sign one.

Opt-outs. If one of your customers asks us to stop, we record that address and never contact it again on behalf of anyone. Those records exist precisely so we can honour the request, so we keep them indefinitely; deleting them would be how the person gets contacted again.

The connection page. After you approve access in Jobber, you land on a page on this site that shows a one-time code and asks you to send it to us. That page has no backend and stores nothing; the code is single-use, expires within minutes, and is useless without a secret only we hold. It does end up in your browser history and in the email you send us, which is why the flow exists only for a small number of pilot shops and will be replaced by a server-to-server exchange.

Why we are allowed to do this

Under GDPR Article 6 our legal bases are: performance of a contract, where we are running the service you asked for; and legitimate interests, where we reply to business correspondence, keep our own records, and secure the site. Where we act as a processor for a contractor, the legal basis for contacting their customers is the contractor's, not ours, and they are responsible for having one.

How long we keep things

• Email correspondence: up to 24 months after our last exchange, then deleted, unless it documents a live commercial relationship.
• Connection tokens: for as long as the connection is live. When you disconnect, or when Jobber tells us the connection has ended, they are deleted within 7 days.
• Records of what we sent: 24 months, so that a dispute about a message can be answered.
• Opt-out records: kept indefinitely, on purpose, as explained above.
• Server logs: held by Vercel on their schedule, not ours.

Who else touches the data

• Vercel Inc. hosts this website and keeps the request logs described above.
• Google LLC provides our email on Google Workspace, so mail to and from info@goldenriverstone.com passes through and is stored on Google's systems.
• Jobber is the contractor's own system. We connect to it with their permission; we are not affiliated with Jobber.
• Anthropic PBC may be used to help draft the text of a follow-up message. Where it is, the content sent is limited to what is needed to write that message.

These are our processors. We do not sell personal data, and we do not share it for anyone else's marketing.

Data leaving Europe

We are a US company using US providers, so personal data is processed in the United States. Transfers rely on the providers' own transfer mechanisms, which for the providers named above are the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Your rights

If the GDPR applies to you, you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to info@goldenriverstone.com and we will answer within one month. You also have the right to complain to a supervisory authority. Because we operate from Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. If you are a customer of a contractor who uses us, ask them first, since for your data they are the controller, but you can always write to us and we will act on their instruction.

If you are in the United States, several states give similar rights. We apply the same process to everyone rather than asking which state you are in.

Security

Connection tokens are encrypted at rest with AES-256-GCM, bound to the record they belong to. This site is served over HTTPS only, with a content security policy that forbids third-party scripts. We are a small company and we do not pretend to hold a security certification we have not earned.

Children

This is a business service and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes

If what we do changes, this page changes with it and the date at the top moves. This document was written by the company. It has not been reviewed by a lawyer, and we would rather say so than imply otherwise.

Contact

Golden River Stone LLC, 1007 N Orange St, 4th Floor, Suite 4590, Wilmington, DE 19801, USA — info@goldenriverstone.com.