Privacy
What we collect, and what we don’t.
BunQo’s is at the stage where the only things we hold are what you typed into the form on the front page, what you typed into the chat beside it, and — if you messaged us on WhatsApp instead — that conversation. This describes exactly those. Last updated 3 September 2026.
What we collect
- Your postal code. All six characters. We do not ask for, and cannot store, your street address. We changed this on 28 August 2026: we used to keep only the first three characters, and that turned out to be too coarse to be useful — a single one of them can cover twenty kilometres of open country, and a group buy only works if the households in it are genuinely close together. A full postal code is more identifying than the first three characters were, particularly in rural areas where one can cover a handful of households, and we would rather say that plainly than bury it.
- Your home type, its heating fuel, and whether you own or rent — but only when the work you named actually turns on them. A heat pump quote depends on all three. A set of winter tires depends on none of them, so we don’t ask, and the record stores nothing in those fields. We changed this on 31 August 2026: we used to ask everyone all three regardless.
- What work you’re considering and roughly when. Including anything you typed in your own words rather than picked from the list, which a person reads, and your answers to the follow-up questions a category asks — the vehicle a set of winter tires is for, the age of a roof, what an electrical panel is rated at. Since 15 September 2026 that also covers the “anything else we should know?” box we ask after those questions: it is stored as you wrote it, a person here reads it, and an installer never sees it — see the section on what an installer can see below. Every one of those is optional, and a skipped one is simply not stored.
- Your email address, and your phone number if you gave one. The phone number is optional and stays optional.
- If you used the chat: what you typed, and our replies. Nothing from it is recorded until you reach the end and answer the last question — if you close the tab part way through, there is nothing to delete, because we never had it. We count which question people stop at, with no answers attached to it, so we can fix the ones that lose people.
- If you messaged us on WhatsApp: your number, the name WhatsApp shows, and what you wrote. Added 1 September 2026. We keep the messages as you wrote them, because how somebody describes a job is often the most useful thing in it, and we keep what we replied. You are usually answered by the same simple assistant that runs on this page, not by a person and not by an AI — a person reads the thread afterwards. We receive only the messages you send to our business number: we cannot see your WhatsApp account, your contacts, your profile beyond the name WhatsApp shows us, or any other conversation you have.
- Whether you ticked the consent box, when, and the exact wording you were shown — along with your browser’s user agent string and which version of the headline you saw. We keep the wording because if you ever ask what you agreed to, the honest answer is the sentence that was actually on your screen, not the one on the site today.
What we don’t collect
- Your street address, or anything narrower than a postal code.
- Your name, unless you put it in a free-text box yourself.
- Anything about your finances, your income, or your credit.
- Any payment details. We do not take payments.
What we do with it
We look for clusters: enough households in nearby postal codes planning the same work in the same season, and we show installers how many there are — never who. If an installer makes you an offer, it appears on your own page, and on WhatsApp if you have written to us there in the last day. We do not send email yet.
We do not sell your details as a lead. No installer, contractor, broker or list buyer receives your information from us, and none can buy it at any price.
There is exactly one way an installer gets your details, and you are the one who does it. An installer who can see that several households near you are planning the same work can send an offer to quote the group. It reaches you on your own page — never your inbox on their say-so — and it carries their name, their words and any figure they chose to put on it. Nothing of yours goes with it: they do not know who they have offered it to.
If you accept, and only then, we give that one installer your email address, your phone number if you gave us one, and your full postal code, so they can arrange a visit. The exact wording you were shown when you accepted is stored with the record. If you turn it down, or simply leave it, they are told nothing — not even which household declined — and the offer runs out on its own after two weeks.
Accepting is an introduction and nothing more. It is not an order, not a contract and not a deposit. No money passes through BunQo’s at any point, and you can still say no when they call.
Consent, and taking it back
Marketing email is opt-in. The box is unticked when the page loads and it stays unticked unless you tick it. The wording you agree to is:
“Yes, BunQo's can email me about group buys in my area, and about how this is going. I can unsubscribe from any message. I understand BunQo's has not signed any installers yet and is not promising me a price.”
Every email we send will carry a working unsubscribe link and our physical mailing address. You can withdraw consent at any time, by unsubscribing or by emailing us.
If you messaged us on WhatsApp, you have not opted in to anything. Starting a conversation gives us implied consent to answer you, under Canada’s anti-spam law, for six months from your message. That is a licence to reply to you — it is not a mailing list, and we record it on your file as implied rather than as the opt-in above, so the two can never be confused. If you want the emails, you have to tick the box on the form yourself. If you want us to stop replying, say so in the chat and that is the end of it.
Who else sees it
Two services see something of what you typed, a third hears any voice note you send us on WhatsApp, and one more only checks that you are a person. Updated 22 September 2026. When you type into the chat on this site, or message us on WhatsApp, your message is sent to a language model to work out what you meant — which category you are asking about, roughly when, what sort of home, and how you sound. Both the chat on this site and WhatsApp now use Anthropic’s Claude, and both requests go through our server rather than straight from your browser. Until today the chat on this site used Cloudflare’s Workers AI instead; it no longer does, and no message you send now reaches Cloudflare’s models.
On this site, working out what you meant is all it does: the replies you read were written by us in advance, which is why the chat tells you when it has not understood instead of inventing an answer. On WhatsApp it may also put our reply into its own words, working from a sentence we wrote; a check on our side discards its wording if it contains any figure or claim that was not in ours, and sends ours instead.
On WhatsApp, once your request is on file, the assistant can also look a few things up for you. Added 14 October 2026. If you ask, say, whether anybody has made you an offer, it can look up your own requests, the offers made to you — which installer, by business name, for what kind of work, and whether the offer is still open — and it can send you the private link to your own page. To follow what you mean it is also shown the last ten messages of your conversation with us. What it looks up goes to Anthropic as part of the same request. It is never shown an installer’s price or their own description of an offer, which are only on your offers page, and it is never shown anybody else’s phone number or email address. Nor is it shown your page link, which has your email address or phone number written into it in coded form: the assistant is told only that the link is on its way, and our server adds the link under its reply. Until 14 October 2026 the link itself did reach Anthropic. It can change two things on your request, and only when you ask: when a job is planned for, and a note on a job. It reads the change back to you first and changes nothing unless you answer yes, and we keep a note on your request of what changed, from what, to what, and when. Anything else — your postal code, your email address, or the kind of work — still goes to a person. It is off unless one setting on our side switches it on, and switching that setting off stops it straight away.
A photo you send us on WhatsApp is shown to Anthropic’s Claude, and is not kept. Added 14 October 2026. If you send a photo — of your furnace’s label, say, or your roof — our server fetches it from WhatsApp and sends it to Anthropic once, with an instruction to describe only what matters for the work you are asking about, and never people, vehicles, house numbers or anything else that could identify your home or anybody in it. We keep that short description, in our record of your conversation with us. We do not keep the photo: it is not saved to our database, to a file, or to our logs. Remember that a photo can show more than you meant it to, and only send what you are comfortable with Anthropic seeing.
A voice note you send us on WhatsApp is turned into text by Google Cloud Speech-to-Text, and the recording is not kept. Added 14 October 2026. Our server fetches the recording from WhatsApp and sends it once to Google’s Speech-to-Text service, on the same Google Cloud account our website and database already run on, to be written out as text. We then treat that text exactly as if you had typed it, and we keep it as your message, as we would a typed one. We do not keep the recording: it is not saved to our database, to a file, or to our logs. Google states that it does not keep the audio sent to this service unless the customer opts in to let it, and we have not — their terms are here. Google may process it outside Canada. You should check the current terms rather than take our word for it. If you would rather none of this happened, type instead: a voice note is never required.
Your postal code and email address are taken out of the message before it is sent. For the chat on this site they are read and removed on your own device, so they do not even leave your browser; for WhatsApp that happens on our server. Either way they do not reach Anthropic.
Anthropic states that by default it does not use inputs or outputs from its commercial products, which include the Anthropic API we use, to train its models, and that conversation content is not retained by default — their training policy is here and their retention policy is here. Their servers are in the United States. You should check the current terms rather than take our word for it.
The second is PostHog, which counts how far people get. It is told the random value described above, the name of the step somebody stopped at, and which version of the page they were shown. It is not told what you typed, your postal code, your email address, your phone number, or anything you answered. We do not load PostHog’s own tracking library on this site, which is the usual way this is done and which records clicks and form activity by default; we send it those few named things ourselves, so there is nothing else it could pick up. Its servers are in the United States.
There is also a check that you are a person, not a script. Added 22 September 2026. It is Cloudflare’s Turnstile, and it is the reason Cloudflare still appears on this page at all now that the chat no longer sends your messages to them. Most people never see it do anything. It is told your IP address and what your browser looks like, in order to answer one question — person or script — and it is never told what you typed, your postal code, your email address or your phone number. It runs on the chat and on the questionnaire, and it protects two things: the count of genuine enquiries we make decisions from, and the cost of reading messages. Their privacy note is here. If it wrongly decides you are a script, nothing you do is refused — the chat simply understands you a little less well, and the questionnaire still goes through.
Nothing you type is recorded by us until you finish the chat. Close the tab part way through and there is nothing to delete, because we never had it. The questionnaire sends nothing anywhere until you submit it. No installer receives your details unless you accept their offer, and we do not sell, rent or trade them.
What installers do see. An installer who registers with us can see, on a page, how many households in a postal area — the first three characters only — are planning a given kind of work and roughly when. Added 2 September 2026.
They also see one row per job. Changed 6 September 2026, and this is a real change from what this page said before, so it is written out rather than folded into the paragraph above. An installer can see a list in which each thing you told us you are planning is its own line. A line carries a short code we invented for it, the kind of work, the first three characters of your postal code, the rough timeframe you picked, how long ago it arrived, and the multiple-choice answers you gave. It does not carry your name, your email, your phone or WhatsApp number, your full postal code, or anything you typed in your own words — those answers are counted on the line and never shown. None of it is in the page’s data either, not merely hidden from view.
The code on a line is not your record’s identifier and cannot be used to look you up. It is a one-way value we generate, and we can change it, which would give every line a new code and break any list somebody had kept.
Three additions, 14 October 2026. If you tell us which days you’d be free, an installer whose own free dates overlap sees those days on your line — the dates only, never who you are. When a request arrives, an installer we have approved whose trade and area match may get a short message saying a request for that kind of work arrived in that postal area, and roughly when; it carries nothing else about you. And if you came to us through an organisation’s link — an employer, a condo board, a residents’ association — we record which organisation, so we can see how many people each one brings. The organisation is not told who you are.
Why we changed it. An installer deciding whether to quote needs to know whether four jobs near each other are one week’s work or four separate trips, and a total does not answer that. An installer can also select a set of those lines and say they would like to quote for them. That reserves nothing and tells them nothing further about you.
And they can put an offer to those households. Changed 14 September 2026, and this is a real change from what this page said before, so it is written out rather than folded into the paragraph above. An installer can send an offer to the households behind a set of those lines — either by picking them, or by setting a rule in advance that goes off on its own when enough households in one area are planning the same work in the same season.
When that happens the offer appears on your own page, with their business name, their words, and any number they chose to put on it. That number is theirs, not ours, and it is not a quote for your house — we say so next to it every time. The installer still does not know who you are. If you accept, we pass that one installer your email, your phone number if we have one, and your full postal code, and the button says exactly that before you press it. If you decline or ignore it, they learn nothing and it expires after two weeks.
Only installers see this, only for the kinds of work and the areas they registered to cover, and only while signed in. It is not public, it is not indexed, and it is not sold.
One value we keep in your browser. Added 7 September 2026. When you open the front page we put a random value in your browser’s local storage. It is not a name, an email or anything about you or your device — it is a random string, generated on the spot, and its only job is to make sure you see the same version of the page on a second visit as on the first, and to stop our counting treating one person as two.
We are testing three different ways of describing what BunQo’s does, to find out which one people actually understand. That value decides which one you see. It is sent to PostHog, the analytics service that decides the split and counts the visits, alongside which step of the form people stop at — never an answer, never a postal code, never an email address, and never anything you typed. It is not stored with your request: if you send us a form, the record says which version of the page you were shown and does not say who saw it, so the two cannot be put back together.
It is not a cookie and it is not sent to anyone else. Clearing your browser’s data for this site removes it, and if your browser blocks storage — a private window, for instance — nothing is kept at all and the page still works.
Where it is stored
Your record is stored in Google Cloud Firestore, in a database provisioned in Google’s Toronto region. Sign-in records are in that same database; we do not use a separate authentication service.
Not everything runs in Canada, and we would rather say so than imply otherwise. The servers that build these pages and receive WhatsApp messages run in Google’s us-east4region in the United States, because the hosting service we use is not offered in a Canadian region. What you submit passes through those servers on its way to the Toronto database and is not stored on them. Verified 3 September 2026; if this changes, so will this paragraph.
How long we keep it
Until you ask us to delete it, or until we stop operating — whichever comes first. If BunQo’s shuts down, your records are deleted; they are not an asset to be sold on.
Deleting it
See deleting your data. It is a real process with a person at the end of it, not a form that goes nowhere.
Contacting us
Email support@bunqos.com. BunQo's, 151 Charles St W Suite 100, Kitchener, ON N2G 1H6
If we don’t resolve something to your satisfaction, you can complain to the Office of the Privacy Commissioner of Canada.