Privacy Policy

Last updated: October 10, 2026

1. Who we are and what this policy covers

KnockPortal is operated by Abalon Construction Management LLC, a company organized in North Carolina, United States. Our registered address is 4030 Wake Forest Rd, Ste 349, Raleigh, NC 27609. Contact info@knockportal.com for privacy questions or requests.

This policy covers information used to operate KnockPortal, including information about account users, advertised businesses, prospective businesses, postcard recipients, and inspection or job addresses supplied by customers. A recipient does not need a KnockPortal account to contact us.

The service uses primarily United States-hosted infrastructure. Authorized administration and support may take place from other countries. The company's United States registration does not mean that every person accessing data is physically in the United States.

2. Information we collect and its sources

Accounts and business profiles. We collect contact and login information, business names and authorized trade names, business and return addresses, phone numbers, websites, license details, profile settings, logos, postcard text, and information you provide for support or verification.

Public records and prospective businesses. We obtain permit and address records from public government sources. We obtain contractor and license information from CSLB and may identify a contractor's website through search, checking links against license or business details. We may collect business logos, published business contact details, and website theme information from that site, including published email addresses obtained through website extraction services. A business record may contain personal information, particularly for a sole proprietor or an individual contact.

Mailing and review records. We process selected postal addresses, postcard proofs, rule settings, approvals and their versions, eligibility checks, review decisions, exclusions, suppression records, mailing quantities, provider order identifiers, production and delivery statuses, charges, and refunds.

Inspection and job records. Customers may supply a postal address, date, and an indication that an inspection or job occurred. We validate the address against the city address register and compare these records with that customer's mailing history.

Requests for a city or trade. If you ask for a city or trade that is not yet available, we keep the email address you give together with the city and trade requested, and use it only to tell you when that combination opens.

Payments. Stripe processes card and payment information. We receive payment, subscription, refund, and authorization references and limited card information such as the last four digits. We do not ordinarily store complete card numbers or card security codes.

Technical information. Hosting, authentication, security, and mapping functions may process IP addresses, browser or device information, requests, session identifiers, and error or security logs needed to provide and protect the service.

3. How we use information

We use information to provide and secure accounts, display public records, prepare and execute authorized mailings, assess sender and material eligibility, maintain mailing history and restrictions, process payments and refunds, send service notices, support users and recipients, investigate errors or misuse, and comply with legal obligations.

We use prospective-business information to verify the business, prepare a clearly identified service proposal or unlisted demo, communicate about that proposal, and handle corrections or removal requests.

Inspection and job records are used to provide the supplying company with matches against its own mailings. They are not published, used to market for another contractor, or used by us to train AI models. A match is a record comparison, not proof that a postcard caused a job.

We do not assume that an occupant-addressed card identifies a property owner or that the absence of a permit establishes a property's condition.

4. What is visible and what we disclose

The public map displays the permit and address information described in the relevant source and snapshot.

An unlisted contractor demo may display the business information and artwork included in that demo to anyone holding its link. It is not an authenticated private account. If you represent the business, you may contact us to request a correction, removal, or revocation of the link without registering. An unapproved demo is a proposal prepared by KnockPortal, not a statement that the company is our customer or endorses us.

Account records, customer-supplied inspection and job records, and detailed company mailing history are available within that company's authorized workspace and to the providers or authorized personnel needed to operate the service. Some cross-sender mailing checks produce aggregate exclusion information without disclosing another sender's identity.

For an authorized mailing, we disclose the approved artwork, recipient addresses, and order information needed by the printing and mailing provider. The resulting advertisement is intentionally delivered through the postal system and may include the advertiser's business contacts and other approved information. Submission to a provider is distinct from confirmed delivery.

We may disclose necessary information in response to applicable legal process, to comply with reporting or preservation duties, to address an incident or misuse, or to protect lawful rights. We may also disclose relevant business records in a corporate transaction subject to applicable safeguards and law.

5. Service providers

We use providers for specific functions:

Not every provider receives every category of information. Some providers, particularly payment providers, may process information for their own legal, security, or operational purposes as described in their policies.

If we add a provider for a new material processing purpose, we update the relevant disclosures before that processing begins. A planned outreach or analytics provider is not listed as already receiving information merely because we intend to use it.

6. Retention and deletion

We retain information for the purpose concerned and use the following ordinary periods:

• Account and business-profile information while the account and service relationship remain active, subject to deletion requests and the necessary exceptions below.
• Inspection and job records until the supplying company deletes them or the relevant service relationship ends, except for information specifically needed for a legal obligation or documented dispute.
• Unactivated demo and prospective-business records for 90 days after the last relevant outreach, or after creation if no outreach occurs, unless a correction or removal request requires earlier action or the business becomes a customer.
• Recipient-level mailing records and sent mailpiece content for 24 months after mailing.
• Ordinary rejected drafts for 90 days after the final decision and other inactive drafts for 90 days after their last activity.
• Minimum review records for five years after the decision.
• Payment authorization records needed to establish the agreed rule, method, and terms for five years after the last related payment under that authorization, or after the authorization was given if no payment followed.
• Accounting records for seven years after the close of the relevant financial year.
• Requests for a city or trade until the combination opens and we have told you, or until you ask us to delete them.
• Minimum suppression and stop-contact information for as long as the applicable restriction or preference needs to be enforced.

Accounting or review retention does not require every full recipient list, inspection record, or logo to be retained for the same period. Where appropriate, we separate minimum event records from removable content and address details.

We may retain specific records longer for a legal requirement, a documented dispute, or an investigation, and may delete them earlier where applicable law requires. Special preservation duties override routine deletion for the affected material.

Deletion from active systems may precede deletion from isolated backups, which are replaced under their normal rotation and are not used for ordinary business access. Relevant deletion instructions are reapplied if a backup is restored.

We may retain statistics that have been deidentified so they cannot reasonably be linked to a person or household. A hash or removed name alone is not necessarily deidentification.

7. Cookies, tracking, and communications

We use session or similar technologies needed for authentication, settings, security, and service operation. Mapping and other providers receive the technical requests necessary for their functions.

The kp_anon cookie contains a random identifier used to associate a guest mailing draft with your browser. The cookie expires after 180 days; draft retention is described below. When you sign in, your available draft is transferred to your workspace.

We currently do not use advertising pixels or website analytics to track visitors for marketing. We do not currently operate a QR campaign analytics feature through KnockPortal. If this changes, we update this policy and any required choices or notices before the new collection begins.

Our present service does not undertake cross-site behavioral advertising. Browser Do Not Track signals do not alter the session, security, or map requests necessary to provide the current service. We honor opt-out signals where applicable law requires and the signal applies to our processing.

We send payment-authorization records, payment or production notices, daily Autopilot summaries, and other service messages. A daily summary reports the company's recent Autopilot activity. Receiving a summary does not authorize additional charges or cancel a rule or subscription; use the relevant cancellation control or contact us for help.

8. Your requests and applicable rights

You may contact info@knockportal.com to ask about information, correct business or demo details, request deletion or link removal, report a mailing concern, or ask us to stop relevant future contact. You do not need an account to make a request.

We may ask for information reasonably necessary to verify identity, business authority, or the address concerned. We do not require more information than reasonably needed. Some requests concerning records supplied by a customer must be handled with that customer, whose instructions govern the records, subject to applicable law.

Where the relevant privacy law applies, rights may include access, correction, deletion, portability, restriction, objection, withdrawal of consent, and rights concerning sale or sharing. We apply the legal requirements, verification rules, time limits, and exceptions governing the request. We do not promise that every right from every jurisdiction applies merely because a person resides there.

We do not sell personal information or share it for cross-context behavioral advertising within the meanings of the CCPA. When processing inspection and job records for a customer, we limit their use to the customer-directed service and applicable security or legal purposes. If additional California notice or request obligations become applicable to our own processing, we provide the required notices and procedures.

Where EEA or United Kingdom data-protection law applies, processing must have an applicable lawful basis, such as performing a contract, a legitimate interest appropriately assessed, compliance with a legal obligation, or consent where required. Affected individuals may contact the relevant supervisory authority. Any required safeguards for international access or transfers must apply before the processing concerned.

These conditional statements do not represent that we have voluntarily certified all processing as subject to the CCPA or that every visitor is within the territorial scope of GDPR or UK GDPR.

9. Security, children, and changes

We use access restrictions and other measures appropriate to the information and service. No service can guarantee absolute security. We address relevant incidents and legally required notifications under applicable law.

The account service is intended for adults acting for businesses, not children. We do not solicit children's personal information or permit prohibited sexual material. Ordinary deletion periods do not replace any special legal reporting or preservation duty.

We post the current policy and its effective date. If we materially change how we process existing account information, we provide an appropriate notice before the new processing where required and obtain consent when required. Contact info@knockportal.com for questions or requests.