Privacy Policy

This Privacy Policy describes how Constimator ("we," "us," or "our") collects, uses, and shares information when you use our construction estimating platform (the "Service"). It's written to describe what actually happens with your data, in plain language — see our Terms of Service for the rest of the legal terms governing your use of the Service.

1. Information We Collect

We collect:

• Account information — your name, email address, and organization membership, managed through our authentication provider (Supabase Auth). If you sign up with Google, we receive the basic profile information Google shares for authentication.
• Uploaded documents — the plan sets, specifications, addenda, and official bid forms (PDFs) you or your teammates upload.
• Bid and estimate data— the official bid form's line items as entered (by you or extracted by our AI pipeline), your own estimate quantities and pricing, and the reconciliation results comparing the two.
• Company defaults — labor and equipment rates and markup you configure for your organization.
• AI processing records — for documents submitted for AI extraction: the extracted results, any error messages, and a log of token usage per call (this log is counts and estimated cost only — it does not contain your document content).
• Payment information — handled entirely by Stripe, our payment processor. We do not receive or store your full card number; we retain only what Stripe provides for billing purposes (like subscription status and invoice history).
• Usage and diagnostic data — standard technical logs (timestamps, error messages, request metadata) generated as you use the Service, used for security, debugging, and reliability.
• Product analytics — which pages you visit and when you complete core actions (like creating a project, uploading a document, or running a reconciliation), so we can understand how the Service is actually used and prioritize what to build next. This is tied to your account, not to your uploaded document content or bid/estimate data.

2. How We Use Information

We use the information above to:

• Provide the Service — store your projects, run AI extraction, compute reconciliation results, and generate reports;
• Operate your subscription and process payments;
• Communicate with you about your account, invites, and material changes to the Service or these policies;
• Monitor, secure, and improve the reliability of the Service (error tracking, abuse prevention, uptime monitoring); and
• Comply with legal obligations.

We do not sell your information, and we do notuse your uploaded documents or bid/estimate data to train AI models — ours or a third party's.

3. AI Processing

When you submit a document for AI extraction, its contents (rendered as images of each page) are sent to our AI provider, currently Anthropic, to extract structured line items and quantities. Anthropic processes this content to return the extraction result to us; see Anthropic's privacy policy for how they handle data submitted through their API. We do not send your account credentials, payment information, or company rate data to Anthropic — only the document content necessary for extraction.

4. Who We Share Information With

We share information only with the service providers necessary to run Constimator, each acting on our behalf and bound by their own confidentiality and data-protection obligations:

• Supabase — database, file storage, and authentication.
• Anthropic — AI-based document extraction (Section 3).
• Stripe — subscription billing and payment processing.
• Railway — hosts the background worker that processes uploaded documents.
• Sentry — error tracking, so we can find and fix bugs.
• Upstash — rate limiting, to prevent abuse of AI processing.
• Vercel Analytics and PostHog — product usage analytics (Section 1).

We don't share your information with anyone else except: with your direction or consent, to comply with a legal obligation (like a valid subpoena), to protect the rights or safety of Constimator or our users, or as part of a merger, acquisition, or sale of assets (in which case we'd require the successor to honor this Policy for information collected before the transfer).

5. Data Retention

We keep your data for as long as your account is active, so your projects, bids, and estimates stay available the way you'd expect from anything you haven't deleted yourself. When you delete a project or document, it's removed from primary storage immediately, though it may persist briefly in encrypted, automated backups before being fully purged.

After you close your account or request deletion (Section 6), we delete your documents, bid data, estimates, and account information within 30 days, subject to that same backup-purge window. We may retain aggregate, de-identified usage data that doesn't identify you or your organization for longer, for our own product analytics.

6. Your Rights and Choices

You can access and correct most of your information directly in the app. To request a copy of your data, correct something you can't fix yourself, or delete your account or specific projects/documents, email us at [support/legal contact email — confirm before publishing] with your organization name and account email. We'll confirm your request and complete it within 30 days. Depending on where you live, you may have additional rights under local law (for example, the right to know what categories of information we've collected, or to opt out of certain uses) — contact us at the address above to exercise them.

7. Data Security

We use industry-standard measures to protect your information, including encryption in transit, database-level access controls that isolate each organization's data from every other organization's, and restricted access to production systems. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.

8. Cookies

We use cookies required to keep you signed in and to remember basic preferences. We don't use cookies for third-party advertising or cross-site tracking.

9. Children's Privacy

Constimator is a business tool intended for construction industry professionals and isn't directed at children. We don't knowingly collect information from anyone under 18.

10. International Users

Constimator is operated from and primarily intended for use in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll provide notice (for example, by email or an in-app notice) before the changes take effect.

12. Contact Us

Questions about this Policy or how we handle your data? Contact us at [support/legal contact email — confirm before publishing].