Legal
Last updated · August 30, 2026
We do not sell or rent your personal information, and we do not share it for advertising.
We do not use your project content or connected-service data to train machine learning models.
Connected services like Pinterest are read-only, opt-in, and can be disconnected at any time — which deletes the stored tokens immediately.
If a contractor invited you to a project, they control that project data — we process it on their behalf.
This summary is for orientation only. The full terms below are what govern.
Candoro (“Candoro,” “we,” “us,” or “our”) is a project management platform operated by Pelican State Tech. This Privacy Policy explains what information we collect through the Candoro platform and this website, why we collect it, how we use and protect it, and the choices and rights available to you.
Candoro is used in two distinct ways, and your relationship to us differs depending on which applies:
As a customer. If your company subscribes to Candoro and uses it to run projects, we act as the controller of your account and billing information, and as a processor of the project data you put into the platform.
As a project participant. If you were invited to a project by a contractor, designer, or other Candoro customer — for example as a homeowner, subcontractor, or vendor — that customer controls the project data about you. We process it on their behalf under our agreement with them. Direct requests about that data to them first; we will assist as required.
When an account is created we collect name, email address, and the role and organization the account belongs to. Authentication is handled through our identity provider; when you sign in with a third-party account such as Google, we receive your name, email address, and profile identifier from that provider, and never your password.
Candoro stores the content you and your collaborators put into a project: selections and specifications, mood boards and images, budget lines, purchase orders and vendor records, schedule tasks and dependencies, punch list items, documents and drawings, photos, and messages. Some of this content may contain personal information about project participants — names, contact details, addresses, and job site photographs.
Candoro can connect to third-party services at your direction. When you connect one, we receive only the data the permissions you grant allow, and only after you complete that service’s authorization flow. See Section 3 for the specifics of each integration.
Our servers record standard log information including IP address, browser and device type, pages or endpoints accessed, and timestamps. We use this for security, abuse prevention, debugging, and understanding aggregate usage. We use strictly necessary cookies to keep you signed in and to protect the service; we do not run advertising or cross-site tracking technologies.
We do not collect payment card numbers directly — payments, where applicable, are handled by a PCI-compliant payment processor. We do not intentionally collect special categories of personal data, and Candoro is not directed to children.
Candoro offers an optional Pinterest integration so a project’s design inspiration can be brought into the platform instead of being retyped or screenshotted. It works as follows:
You initiate it. Nothing happens until you click Connect Pinterest and complete Pinterest’s own authorization screen. You can decline at that screen and continue using Candoro normally.
Read-only scopes. We request only boards:read and pins:read. These permit reading the boards and pins on your Pinterest account. We never request write access, and Candoro cannot create, edit, delete, or post anything to your Pinterest account.
What we receive. Your board names and identifiers, and for pins you choose to import, the pin image, its title or description, and its outbound source link.
One-time copy, not a live sync. When you select pins and import them, Candoro copies that content into your project as design selection proposals at that moment. We do not continuously poll, monitor, or mirror your Pinterest account, and later changes on Pinterest do not flow into Candoro.
Token storage. Pinterest access and refresh tokens are stored per Candoro user, encrypted, and used solely to perform imports you request.
Disconnecting. Disconnecting Pinterest in Candoro deletes the stored tokens immediately and ends our access. Content you already imported stays in your project, because it is project data at that point; you can delete it like any other selection. You may also revoke Candoro’s access at any time from your Pinterest account settings.
No secondary use. We do not use Pinterest data for advertising, do not sell or share it, do not use it to train machine learning models, and do not disclose it to third parties other than the infrastructure providers described in Section 5.
Candoro may offer optional connections to accounting, payment, e-signature, storage, and communication providers. Each requires your explicit authorization, receives only the permissions needed for the stated function, and can be disconnected at any time.
To provide, operate, and maintain the platform and the features you use.
To authenticate you and keep accounts and project data secure.
To perform the imports, calculations, and notifications you or your collaborators trigger.
To provide support, respond to questions, and communicate about the service.
To diagnose faults, prevent abuse, and improve reliability and performance.
To meet legal, tax, accounting, and insurance obligations.
We do not sell or rent personal information, do not share it for cross-context behavioral advertising, and do not use customer project content or connected-service data to train machine learning models. Candoro’s AI features operate over your own project data to produce results for you, within your own tenant.
Within your project. Content is visible to the collaborators the project owner has invited, according to their assigned role.
Service providers. Cloud hosting, database, storage, email delivery, authentication, and error-monitoring vendors that process data on our behalf under contract, and may use it only to provide services to us.
Legal and safety. Where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect rights, property, or safety.
Business transfers. In a merger, acquisition, financing, or sale, information may transfer as a business asset, subject to the commitments in this policy.
Project content is retained for as long as the account is active, and afterward for the period set out in our customer agreement, so a contractor retains the project record they may need for warranty or dispute purposes. Connected-service tokens are deleted immediately on disconnect. Server logs are retained for a short operational period. On account closure we delete or anonymize personal data within a reasonable period unless we are required to retain it by law.
Candoro is served over encrypted HTTPS connections and data is encrypted in transit. Access tokens and secrets are stored encrypted in a managed secrets service, never in source control. We apply role-based access control within projects, least-privilege access for our own personnel, structured logging with automatic masking of personal and secret values, and per-service database isolation. No system is perfectly secure, but we build and audit against a documented internal security baseline.
Depending on where you live, you may have the right to access the personal information we hold about you, correct inaccuracies, request deletion, obtain a portable copy, object to or restrict certain processing, withdraw consent, and not be discriminated against for exercising these rights. Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws, and individuals in the EEA and UK, have these rights under their respective laws.
To exercise them, email info@pelicanstatetech.com with the subject line “Privacy Request.” We will verify your identity before acting, and respond within forty-five days where California law applies or one month where the GDPR applies. If your data sits inside a project controlled by a Candoro customer, we will refer you to that customer and assist them in responding. Individuals in the EEA or UK may also lodge a complaint with their local supervisory authority.
Candoro operates in the United States and information is stored and processed there. If you access Candoro from elsewhere, your information will be transferred to the United States, where data protection law may differ from your own. Where required we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Candoro is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under sixteen. If you believe a child has provided us information, contact us and we will delete it promptly.
We may update this policy as the product and our legal obligations evolve. We will revise the “Last updated” date above, and for material changes we will provide a more prominent notice in the product or by email.
Candoro, a product of Pelican State Tech · 175 Davis Lake Rd, Columbia, LA 71418, United States
info@pelicanstatetech.com+1 318-210-7315