Privacy Policy

Catalyst Restoration is an emergency property restoration company based in Hagerstown, Maryland, serving Maryland, Pennsylvania, West Virginia, and Virginia. References to “we,” “us,” or “our” mean Catalyst Restoration. References to “you” or “your” mean any person or organization that visits www.catalystrestorations.com or interacts with our services.

What we collect depends on which product or tool you use.

When you book restoration work or an inspection:

• Contact info: first and last name, phone number, email address.
• Property info: service address, city, state, ZIP, description of the loss, date of loss, affected rooms.
• Insurance info (if applicable): carrier name, claim number, adjuster name/phone/email.
• Photos and documents you upload to support your request.
• Communications: messages, calls, emails, and SMS exchanged with our team.

When you subscribe to CatalystShield, Catalyst Pro, or Catalyst Air:

• Everything above, plus billing email if different from your contact email.
• Service or property address(es) covered by the subscription.
• Stripe customer ID and subscription ID — issued by Stripe, used to manage your subscription. We do not store your card number, CVC, or full card details — those live with Stripe.
• Subscription status (active, trialing, past_due, canceled), current period end, last payment date.

When you book Catalyst Verify or rent equipment:

• Property address, customer info, preferred date/window.
• Optional referring realtor (for Verify) — name, email, brokerage.
• Stripe payment intent ID and transaction status. Card data is processed by Stripe; we don't store it.
• For rentals: items rented, quantities, delivery address (if applicable), refundable deposit amount.

When you use a free tool:

• Risk Audit — your home characteristics (year built, foundation, plumbing, water-heater age, roof age, HVAC age, sump pump status, smoke detector status, etc.) plus your contact info to deliver the report.
• Loss Analyzer — photos of damage and your written description, sent to Anthropic for AI analysis.
• 90-Second Triage Call — name, phone, brief situation description, optional location.
• Urgency Calculator outputs are computed entirely in your browser — we do not collect anything.

Across all interactions:

• Technical data: IP address, browser type, pages viewed, time spent, referring URL — collected via standard server logs and analytics.
• Device storage (browser sessionStorage) — used for the rental cart so it survives page refreshes within a single tab. No personal data is stored there; it's just item slugs and quantities.

• Confirm and schedule bookings, inspections, and equipment rentals.
• Dispatch crews, equipment, and materials to your property.
• Communicate with you about your job, subscription, or inquiry — by phone, SMS, email, and through the relevant portal.
• Charge subscription renewals, process one-time payments, refund deposits.
• Coordinate with your insurance carrier and adjuster when you authorize us to.
• Send appointment confirmations, on-route ETAs, status updates, completion notices, and review requests.
• Generate per-customer reports (drying logs, IAQ reports, Verify findings) for your records and your claim.
• Track which referring realtors send us volume so we can recognize and reciprocate.
• Detect fraud and abuse (e.g. repeat damage on rental returns).
• Comply with legal obligations and resolve disputes if any arise.

By providing your mobile number on any of our forms (booking, Triage Call, subscription signup, etc.) or by texting our number, you expressly consent to receive SMS messages from Catalyst Restoration related to your job, subscription, or inquiry. This includes:

• Booking and subscription confirmations
• On-route ETAs from our crew
• Status updates as work progresses
• Completion notices
• Renewal reminders for subscriptions
• Post-job review requests
• Direct replies from your project manager

Message frequency varies based on the stage of your job or subscription — typically 1 to 6 messages per active project. Message and data rates may apply depending on your carrier plan.

To opt out at any time, reply STOP to any message we send. We will stop sending you SMS immediately and confirm your opt-out. You can opt back in any time by replying START. For help, reply HELP.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and SMS consent are never shared or sold. All other categories of personal data are subject to the rest of this Privacy Policy. We share your mobile number only with the messaging-platform vendor required to deliver these messages (currently Twilio), and only as needed to send the messages you requested. Carriers including AT&T, Verizon, and T-Mobile are not liable for delayed or undelivered messages.

For the full SMS program terms — including supported keywords, supported carriers, and message-frequency details — see our SMS Terms of Service.

We use a small number of trusted vendors to operate our business. Each receives only the information they need to do their job:

• Stripe — processes all paid transactions across CatalystShield, Catalyst Pro, Catalyst Air, Verify, and Direct Rental. Your card data is collected on Stripe's pages and stored in Stripe's vault, never on our servers. Stripe also stores your billing address, last-four card digits, and Stripe-issued customer ID. See Stripe's Privacy Policy.
• Resend — sends transactional emails (booking confirmations, subscription welcomes, payment receipts, renewal notices, PM updates).
• Twilio — sends and receives SMS for booking confirmations, ETAs, completion notices, renewal reminders, dispatcher pages.
• Microsoft — calendar and email infrastructure for our dispatch team.
• Vercel — website hosting and serverless functions.
• Neon — Postgres database that holds bookings, subscriptions, rentals, inspections, IAQ records, and portfolio data.
• Anthropic — powers our AI Loss Analyzer (only the photos and description you submit to that tool).
• Independent accredited labs — process Catalyst Air sample collections (only the sample IDs and lab paperwork; no customer-identifying info beyond facility name).
• Google — Business Profile, reviews, and analytics.
• Your insurance carrier and adjuster — only when you have authorized an insurance claim and only the documentation needed to process it.
• Your referring realtor — for Verify bookings, the inspection report (if you listed the realtor on your booking form).

We do not sell your personal information. We do not share it with advertisers, data brokers, or any party not listed above.

All paid transactions on our website (subscriptions, inspections, rentals) are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Your card information is collected on Stripe-hosted checkout pages and stored only in Stripe's vault. Catalyst never receives or stores your full card number, CVC, or PIN.

What we receive and store from Stripe:

• Stripe customer ID and subscription ID (used to look you up).
• Subscription status, current period end, last payment date.
• The last four digits of your card and the brand (Visa, Mastercard, etc.) for display purposes only.
• Stripe-issued payment intent IDs for one-time charges.

To update your card on file, view past invoices, or cancel an auto-renewing subscription, use the Stripe Customer Portal accessible from your member or PM portal — we never see or handle your new card details.

Several of our portals are token-authenticated, meaning the URL itself acts as the credential — there are no passwords. This applies to the customer portal /portal/[token], the adjuster portal /adjuster/[token], the member portal /member/[token], and the PM portal /pm/[token].

Tokens are 16-byte random hex strings (about 38 decimal digits of entropy). They are generated once, stored in our database, and emailed to you. Treat these URLs like a password. If you suspect a token has been shared inappropriately, email zshoemaker@catalystrestorations.com to request a rotation.

Portals are marked noindex so search engines do not index them. Most browsers will not auto-fill cached portal URLs in unrelated sessions.

All booking, subscription, and account data is stored in an encrypted Postgres database. Access tokens for any third-party integrations (Stripe, Twilio, Microsoft) are encrypted at rest using AES-256-GCM. Employee access is limited to the dispatch team and project managers assigned to your job or subscription. Our website uses HTTPS for all traffic. Webhooks from Stripe are verified with signed signatures before any side-effects fire.

No system is perfectly secure, but we follow industry-standard practices and respond quickly if anything goes wrong.

Booking records, job photos, and documents are retained for 7 years after job completion — long enough to support warranty claims, insurance audits, and tax recordkeeping.

Subscription records are retained for the life of the subscription plus 7 years after cancellation, to support refund disputes and tax filings.

Verify reports and Air sample results are retained for 5 years to support real-estate transaction history and compliance audits.

Rental records are retained for 3 years.

Free-tool submissions (Risk Audit, Loss Analyzer, Triage Call) are retained for 24 months unless you become a paying customer, in which case the records roll into your customer file.

Anonymous analytics data is retained for 24 months.

You may request deletion of your personal data at any time, subject to our legal obligation to retain certain records (tax, contract disputes, regulatory).

You have the right to:

• Request a copy of the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information (subject to legal retention requirements).
• Cancel any subscription at any time through the Stripe Customer Portal.
• Opt out of marketing communications at any time.
• Withdraw consent for SMS by replying STOP to any message.

To exercise any of these rights, email zshoemaker@catalystrestorations.com. We will respond within 30 days.

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), or another state with consumer privacy laws, you have additional rights including the right to know what personal information is collected, to delete it, to correct it, to opt-out of certain data uses (we do not sell or share for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights. Contact us at the email above to make a request.

Our services are directed at adults responsible for property and at organizations. We do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it promptly.

We use a small number of cookies: a session cookie for our admin login, plus standard anonymous analytics cookies. We do not use third-party advertising trackers.

We also use browser sessionStorage in one place: the Direct Rental shopping cart. The cart persists across page refreshes within a single tab so you don't lose what you've added. Cart contents are cleared automatically when you close the tab. No personal data is stored — only item slugs and quantities.

You can disable cookies and storage in your browser settings — the public site will continue to work, though the rental cart and admin login require these features to function.

We will update this page when our practices change. The “Last updated” date at the top reflects the most recent revision. For material changes affecting existing customers or subscribers, we will email everyone with an active job or subscription at the time of the change.

Catalyst Restoration
Hagerstown, MD
Phone: 240-291-8439
Email: zshoemaker@catalystrestorations.com