Privacy Policy

The short version

Punchlist does not use advertising cookies, third‑party analytics, or cross‑site tracking, and the public website sets no cookies at all. Punchlist collects only the information described in this Policy: what you send us to run a paid check, what you send us to enroll as a contractor, and what you send us when you contact us — plus the technical records our hosting and payment providers necessarily create in order to serve a website and process a payment. We do not sell personal information and we do not share it for advertising.

1. Who this applies to, and who we are

This Policy covers punchlistrebates.com (the "Site") and the services offered by Punchlist Rebates LLC, a California limited liability company (California Secretary of State entity number B20260377649) ("Punchlist," "we," "us," "our"). Punchlist Rebates LLC is the controller of the information described here.

Contact for privacy matters

• Email: will@punchlistrebates.com
• Phone: (805) 719‑8573 (Pacific time)
• Mailing address: 4168 Minnecota Drive, Thousand Oaks, CA 91360

This Policy works alongside our Terms of Service. For enrolled contractors, it also works alongside the Contractor Services Agreement; where that Agreement imposes a stricter obligation on Punchlist than this Policy, the stricter obligation controls.

Punchlist is a very small business. There is no data‑protection department; privacy requests reach Will Malinzak directly at the address above.

2. What we collect

We have separated this by how the information reaches us, because the answers are genuinely different.

2.1 Ordinary browsing of the public Site

We set no cookies. We run no analytics. We load no third‑party scripts, fonts, pixels, or tracking of any kind. The Site's Content Security Policy permits scripts, styles, fonts, images, and network connections only from punchlistrebates.com itself, which means no third party is in a position to observe your visit through our pages. Our pages do not use browser cookies, localStorage, sessionStorage, or any other client‑side store.

Our hosting provider necessarily processes technical information in order to deliver the Site to your browser — typically your IP address, the page or file requested, the date and time, the HTTP status, the referring page where your browser sends one, and your browser's user‑agent string. This is how any website works; a server cannot return a page without receiving the request. We do not use this information to build a profile of you, we do not combine it with anything else, and we do not use it for advertising.

2.2 The free ZIP and utility check

The free check on the Site (choose a state, enter a ZIP code, choose your electric and gas utility and building type) runs entirely inside your browser. The data it needs is already part of the page you downloaded. Nothing you type into the free check is sent to us, and we do not receive, see, log, or store it.

The free check asks for a ZIP code, not a street address, and it does not ask for a name, an email address, or a phone number. Where a ZIP code alone cannot determine which utility serves a location, the tool says so and asks you to name the utility from the bill.

2.3 The paid vehicle eligibility check

This one does reach our servers. When you run the paid vehicle check, the following is sent from your browser to a Punchlist server function:

• ZIP code
• State
• Vehicle class or category
• Income tier, if you provide one — a bracket, never an income figure or documentation
• Utility name, if you provide one
• Email address, only if you choose to enter one for your receipt

What happens to it. If your state and vehicle category are not in our verified data, we return a free "not covered" answer, no payment page opens, and no card is requested. Otherwise we create a Stripe Checkout session and pass those same check inputs to Stripe as metadata attached to the payment record. You are redirected to Stripe's own hosted checkout page to enter your card. When you return, we recompute the result from the inputs stored on that Stripe payment record and either capture the charge or release the authorization.

Where it is stored. The check inputs are stored with the payment record at Stripe, so that a charge can be explained and supported if you ever question it. Punchlist operates no database of its own and stores no copy of the check separately from the Stripe payment record.

Server function logs. Our server functions write operational log entries that include the Stripe session identifier and the check inputs listed above. These log entries exist so a failed payment, a stuck authorization, or a wrong result can be diagnosed and corrected.

IP address and abuse controls. Our server functions read the requesting IP address in order to apply a short‑window rate limit (a small number of requests per minute) and to reject cross‑origin requests. The rate‑limit counter is held in memory for roughly one minute and is not written to a database or used to identify or profile you. The IP address may also appear in the operational log entries described above.

2.4 Contractor enrollment ("Work with me")

The enrollment form on our Site is not submitted to a Punchlist server. When you press send, the form assembles what you typed into a pre‑addressed message and hands it to your own email program to send to will@punchlistrebates.com. Nothing is transmitted to us until you send that email yourself, and you can edit or discard it first.

What typically reaches us that way: your company name, contact name, email address, phone number, the states you work in, your approximate installs per year, and whatever you write in the message. It arrives, and is stored, in our email account.

If you email or call us directly instead, we receive whatever you choose to send or say.

We do not require, and ask you not to send, your customers' personal information. If you send us a job to look at, send the ZIP code, the utility, and the equipment — not your customer's name, street address, phone number, or utility account number.

2.5 Contractor accounts and workspace

There is no live contractor account or workspace today. Punchlist operates no authentication system, no user accounts, no passwords, and no customer database. The contractor portal that appears in some Punchlist materials is a demonstration only; it is excluded from every published build of the Site, and requests to it are refused.

Accordingly, we hold no contractor sign‑in credentials and no contractor‑entered job records.

If and when Punchlist launches an authenticated contractor account, this Policy will be updated before the feature is enabled, to describe what is stored, where, for how long, and who can reach it, and enrolled contractors will be notified.

Records we keep because the law expects us to. When you sign in, we record a session with an opaque token, a hashed IP address and your browser's user-agent string, so a session can be expired or revoked. When you accept an agreement, we record who accepted it, their title, the exact version and a cryptographic hash of the document shown, the time, and the IP address and browser user-agent at the moment of acceptance. That acceptance record is proof that an agreement was formed, so it is kept for the life of the agreement and six years after it ends, and it is not deleted on request while it still serves that purpose. We tell you this plainly rather than describing it as "security data."

2.6 Payments — what Stripe does and what we get

Payments are processed by Stripe, Inc. Stripe acts as our payment processor and as an independent controller of payment data under its own privacy policy.

Punchlist does not receive, see, handle, or store your full payment‑card number, its CVC, or its full expiry. Card details are entered on Stripe's own hosted checkout page, on Stripe's systems, not on ours. Our Site's security policy does not even permit Stripe's scripts to run on our pages — the payment step is a redirect to Stripe, not an embedded form.

What Punchlist does receive from Stripe in connection with a payment:

• the Stripe checkout session and payment identifiers;
• the payment status (authorized, captured, released, failed, refunded, disputed);
• the amount and currency;
• the check inputs we ourselves attached as metadata (§ 2.3);
• the email address you supplied for a receipt, if you supplied one;
• limited card descriptors Stripe exposes on the payment record, which may include the card brand, last four digits, expiry month and year, issuing country, and the billing postal code or name where Stripe collected them for verification; and
• the outcome of any refund or dispute.

We use this to deliver your result, to capture or release the authorization, to issue refunds, to answer questions about a charge, and to keep accounting records.

Stripe also processes information about you directly, for its own fraud‑prevention and legal purposes, under Stripe's Privacy Policy at https://stripe.com/privacy. Stripe may set cookies on Stripe's own checkout page; that page is Stripe's, not ours, and Stripe's policy governs it.

3. Why we use information

We use the information described above for these purposes, and not for others:

On "improving the service." We do not analyze your personal information to profile you, to target you, or to train advertising or recommendation systems. What we do use is aggregate, non‑identifying operational fact — for example, that a particular state and measure combination is being asked about often, or that a request failed — to decide what to verify next and what to fix. We do not need to know who asked in order to learn that.

We do not use your information for automated decision‑making that produces a legal or similarly significant effect about you. A rebate eligibility result is a statement about a program's published rules applied to a location and a piece of equipment; it is not a decision about you, and it is not an approval by anyone.

4. Who we share information with

We do not sell personal information. We do not share personal information for cross‑context behavioral advertising or targeted advertising. We do not disclose personal information to data brokers, advertising networks, or list vendors. We have never done any of these things.

We disclose information only to these categories of service provider, and only to the extent needed to operate:

We have no analytics provider, no advertising provider, no customer‑relationship or marketing‑automation platform, no authentication provider, and no database provider, because we operate none of those things.

We may also disclose information:

• when required by law, regulation, subpoena, court order, or other valid legal process;
• to establish, exercise, or defend legal claims, or to enforce our Terms or agreements;
• to protect the rights, property, or safety of Punchlist, our users, or the public, including to investigate fraud or abuse; and
• in connection with a merger, acquisition, financing, or sale of all or part of the business, in which case we will require the recipient to honor this Policy for information transferred, and will note the change here.

Each provider handles information under its own terms and privacy policy. We instruct our service providers to use information only to perform services for us.

5. Cookies, Do Not Track, and cross‑site tracking

The public pages of this Site set no cookies and use no analytics, no advertising trackers and no session replay. If you proceed to Stripe’s checkout to pay, that is Stripe’s own page and Stripe may set cookies there under its policies; that is outside our Site.

The contractor application is different. Signing in at /login sets one strictly necessary cookie, pl_session. It holds an opaque random token, is HttpOnly, SameSite=Lax and Secure, and exists only to keep you signed in. It carries no personal data, is not used for analytics or advertising, and is not shared. No other cookie is set anywhere on this Site.

Corrected 2026-08-24. Section 6 previously stated that the Site set no cookies at all. That was accurate while this was a static site and became inaccurate when the authenticated contractor application was deployed to the same domain. This section has been corrected to describe what is actually set. The remainder of this policy has not yet been reviewed against the authenticated service.

5.2 Third‑party tracking on our pages. No third party collects personal information about your online activities over time and across different websites through our Site. Our Content Security Policy restricts every script, style, font, image, and network connection to punchlistrebates.com itself, which means there is no third‑party code on our pages that could do so. Our pages send a no-referrer policy, so your browser does not tell other sites which Punchlist page you came from.

5.3 Stripe's checkout page. If you proceed to pay, you are redirected to Stripe's own hosted checkout page. That page is Stripe's, not ours, and Stripe may set cookies and process information there under Stripe's Privacy Policy. We do not control that page and we do not receive tracking data from it.

5.4 Do Not Track. Some browsers send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. There is no consistent industry or legal standard for how a website must respond to a DNT signal.

Punchlist does not conduct behavioral tracking, does not build advertising profiles, does not sell personal information, and does not share personal information for cross‑context behavioral advertising — with or without a DNT or GPC signal. Because we do not engage in the practices these signals are designed to stop, our behavior is the same whether or not you send one. We therefore do not currently take any additional action in response to a DNT signal beyond the practices already described in this Policy.

Where the law of your state treats an opt‑out preference signal such as GPC as a valid request to opt out of sale or of sharing for targeted advertising, we will honor it — noting that we do not sell or share personal information for those purposes in the first place.

5.5 If this ever changes. If Punchlist ever adds analytics, an advertising pixel, or any third‑party tracking technology, we will update this Policy before doing so, will describe what it is and what it collects, and will provide whatever notice, consent, or opt‑out mechanism the applicable law requires.

6. How long we keep information

We keep information only as long as we have a reason to, and we prefer objective criteria over vague promises.

We will not promise immediate deletion of records we are legally required to keep. If you ask us to delete information, we will delete what we are not required to retain, and we will tell you plainly what we are keeping and why.

7. How we protect information

We take these measures. We describe them accurately rather than absolutely.

• The Site is served only over HTTPS, with HTTP Strict Transport Security requiring encrypted connections.
• A strict Content Security Policy restricts what may load and execute on our pages to our own origin, with no third‑party scripts, frames, or connections permitted.
• Additional protective response headers are set, including X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, a same‑origin cross‑origin opener policy, and a permissions policy that disables geolocation, microphone, camera, and interest‑cohort features.
• There is no public database behind the Site and no user account system, so there is no login to compromise and no stored credential to steal.
• Payment‑card data never touches our systems. It is entered on Stripe's page, on Stripe's infrastructure.
• Our payment secret keys are held as server‑side environment variables, are never sent to a browser, and the amount charged is fixed on the server and never read from the client.
• Payment webhooks are signature‑verified before they are acted on.
• Our server endpoints apply request size limits, origin checks, and rate limiting.
• Access to our email and to our Stripe account is limited to Will Malinzak.

No method of storage or transmission is completely secure, and we do not claim that our systems cannot be breached. What we can say is that we deliberately hold very little: no accounts, no passwords, no database, no card numbers, and no customer identities.

If we become aware of a security incident affecting personal information, we will investigate and will notify affected individuals and regulators where the law requires it, within the time the applicable law allows.

8. Your choices and rights

8.1 What you can ask for. You may ask us to:

• tell you what personal information we hold about you, the categories of source it came from, the purposes we use it for, and the categories of third party we disclose it to;
• give you a copy of it;
• correct it if it is inaccurate;
• delete it, subject to the retention obligations in § 6;
• stop contacting you.

8.2 How to ask. Email will@punchlistrebates.com with "Privacy request" in the subject line, or call (805) 719‑8573. We will acknowledge within 10 business days and respond substantively within 45 days, and will tell you if we need a further 45 days.

8.3 Verification. So that we do not disclose your information to someone else, we will ask you to verify your identity in proportion to the sensitivity of what you are asking for — usually by replying from the email address associated with the information, or by identifying a transaction. We will not ask for more information than we need, and we will not use what you send for verification for any other purpose.

8.4 An authorized agent may make a request on your behalf if you provide written authorization we can verify.

8.5 No retaliation. We will not deny you service, charge you a different price, or provide you a lesser quality of service because you exercised a privacy right.

8.6 We do not sell or share for advertising. We do not sell personal information and we do not share it for cross‑context behavioral advertising or targeted advertising, so there is no opt‑out of those practices to offer you. If that ever changes, we will update this Policy before it does and will provide the required opt‑out mechanism.

8.7 Marketing email. We do not run marketing email campaigns. If we ever send commercial email, it will identify itself, will say who sent it, and will contain a working unsubscribe link that we honor promptly, as the federal CAN‑SPAM Act requires.

9. State privacy laws

9.1 Rights vary by state, and by whether a law applies to us. Several U.S. states have comprehensive consumer privacy laws — including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others. Most of these laws apply only to businesses that exceed thresholds based on revenue or on the number of consumers whose data they process.

As of 2026-08-20, Punchlist Rebates LLC does not meet the applicability thresholds of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and does not meet the thresholds of the other comprehensive state privacy laws. Those thresholds turn on revenue and on how many consumers' data a business handles, not on what kind of entity it is — becoming a limited liability company changed nothing about whether these laws reach us. We say this plainly rather than claiming a compliance status we do not have — and we date it, because it is a statement about our size rather than about our intentions, and our size changes.

We re-check this at least annually and on any material change in revenue or in the number of consumers whose data we process. Two states deserve particular attention when we do: Texas and Nebraska set no volume or revenue threshold at all, turning instead on a federal small-business test, so growth reaches them before it reaches California.

Whether or not a statute compels it, we honour the access, correction and deletion rights described above for anyone who asks.

We nevertheless offer the core rights in § 8 — to know, to access, to correct, to delete, and not to be retaliated against — to every user, in every state, as a matter of practice, regardless of whether a statute requires it of us. Where a statute does apply to us, we will honor the rights and timelines that statute requires, which may exceed what § 8 describes.

Residents of certain states may have additional privacy rights where applicable, including rights to opt out of targeted advertising, sale, or profiling, and a right to appeal a refused request. We do not conduct targeted advertising, sale, or profiling. To exercise any right, or to appeal a decision we make on a request, write to will@punchlistrebates.com; we will respond to an appeal in writing with our reasons.

9.2 California — CalOPPA. Regardless of the CCPA thresholds, the California Online Privacy and Protection Act applies to commercial websites that collect personally identifiable information from California residents. As CalOPPA requires:

• this Policy is conspicuously posted and linked from the footer of every page of the Site, using the word "Privacy";
• § 2 identifies the categories of personally identifiable information we collect and § 4 identifies the categories of third party with whom we may share it;
• § 8 describes how you may review and request changes to your information;
• § 11 describes how we notify you of changes to this Policy;
• the Effective Date and Last updated date appear at the top of this Policy and on the published page; and
• § 5.4 discloses how we respond to Do Not Track signals, and § 5.2 discloses whether third parties may collect personally identifiable information about your online activities over time and across different websites through our Site — they may not.

9.3 California — "Shine the Light." California Civil Code § 1798.83 lets California residents ask a business whether it disclosed personal information to third parties for those third parties' direct marketing. Punchlist does not disclose personal information to third parties for their direct marketing purposes.

9.4 Categories of personal information, for reference. Using the CCPA's category labels — offered for clarity, not as a claim that the CCPA applies to us:

We have not sold or shared any category of personal information in the preceding twelve months, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

10. Children

The Services are directed to businesses and to adults acting in the course of business. The Site is not directed to children, is not designed to appeal to children, and offers nothing intended for a child.

You must be at least 18 years old to use the Services. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from a child under 13.

We do not represent that Punchlist is subject to, or compliant with, the federal Children's Online Privacy Protection Act (COPPA). COPPA applies to operators of sites directed to children under 13, or who knowingly collect information from them; we believe Punchlist is neither. Our 18‑and‑over requirement is a term of service, not a COPPA compliance claim.

If we learn that we hold personal information from a person under 18, we will delete it. A parent or guardian who believes we hold their child's information should write to will@punchlistrebates.com and we will delete it promptly.

11. Changes to this Policy

If we change this Policy, we will update the "Last updated" date at the top of this document and on the Privacy page of the Site, and both will show the same date.

For a material change — one that expands what we collect, changes why we use it, adds a category of recipient, introduces tracking, or reduces your rights — we will:

• post the updated Policy before the change takes effect;
• describe the change in plain language at the top of the Policy for at least 30 days; and
• notify enrolled contractors and, where we hold an email address and the law requires it, affected individuals, by email.

Material changes take effect when posted, or on the later date we state. Continuing to use the Services after a change takes effect means the updated Policy applies to you.

12. Contact

Questions, a privacy request, or an appeal:

Punchlist Rebates LLC — a California limited liability company (CA entity no. B20260377649) will@punchlistrebates.com · (805) 719‑8573 · Pacific time 4168 Minnecota Drive, Thousand Oaks, CA 91360