Privacy Policy

1. Information We Collect

We collect information in the following categories:

Account and Identity Information

When you register for an account, we collect your name, business name, email address, phone number, and any other information you voluntarily provide. If you are a team member invited by an account owner, we collect the same information at the point of your registration.

Project and Business Data

In the course of using the Service, you will upload and create data related to your construction projects, including but not limited to project names and addresses, budgets and cost breakdowns, contracts and scopes of work, change orders, schedules, photos, documents, subcontractor and client contact information, and payment schedules. This data is referred to collectively as “Your Data.” You own Your Data; we process it only to provide and improve the Service.

Payment and Billing Information

Subscription payments are processed by Stripe, Inc. When you enter payment information, it is transmitted directly to Stripe. We receive only a transaction confirmation and limited non-sensitive data (e.g., card type, last four digits, billing ZIP code). We do not store full card numbers, CVV codes, or bank account details on our servers.

Usage and Technical Data

We automatically collect technical and usage information when you interact with the Service, including your IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, features used, time and duration of sessions, and error logs. This data is used to operate, maintain, and improve the Service.

Communications

If you contact us by email or through the Service, we retain your communications and our responses to assist with future inquiries and improve customer support quality.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: To create and manage your account, process transactions, deliver the features you use, and facilitate client and team collaboration.
• Improving the Service: To understand how users interact with our platform, diagnose technical issues, and develop new features and enhancements.
• Communications: To send transactional emails (account confirmations, password resets, billing receipts), product updates, and — with your consent — promotional communications. You can opt out of marketing emails at any time.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, abuse, and other unauthorized activity.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.
• AI Features: If you use AI-assisted features within the Service, your project data may be processed by our AI models to generate suggestions, documents, or analyses. This processing is governed by our data handling commitments in this policy.

We do not use Your Data to train general-purpose AI models or sell insights derived from your business information to third parties.

3. Data Storage and Security

Your Data is stored on infrastructure provided by Supabase, Inc., which in turn uses Amazon Web Services (AWS) data centers. Data is stored in the United States. Supabase provides SOC 2 Type II compliant infrastructure with encryption at rest (AES-256) and in transit (TLS 1.2+).

We implement industry-standard security measures, including:

• Row-level security (RLS) ensuring each company's data is logically isolated from other tenants.
• Encrypted connections for all data in transit.
• Role-based access controls limiting employee access to data on a need-to-know basis.
• Regular security reviews and dependency audits.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect Your Data using commercially reasonable means, we cannot guarantee absolute security. In the event of a data breach that affects your information, we will notify you as required by applicable law.

4. Data Sharing

We do not sell your personal data or Your Data to third parties. We share information only in the following limited circumstances:

• Infrastructure and Service Providers: We share data with Supabase (database, authentication, and file storage), Amazon Web Services (cloud hosting, via Supabase), Vercel (application hosting and content delivery), Stripe (subscription payments), Twilio (SMS messaging), Resend (transactional email), Anthropic (AI Coordinator features), Google (Gemini — transcription and analysis of voice notes, video, and photos submitted through the app), DocuSign (electronic signature of contracts and scopes of work), and Intuit (QuickBooks accounting sync, only if you connect it). These providers are contractually obligated to handle your data securely and only for the purposes we specify. We will update this list before adding a new provider that processes personal data.
• Client Portal: When you invite clients to view their project through the Client Portal, those clients will have access to the project data you designate. You control what is visible to each client.
• Legal Requirements: We may disclose information if required to do so by law, court order, or other governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, financing, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

5. Cookies and Analytics

We use cookies and similar tracking technologies to operate and improve the Service. Cookies are small text files placed on your device when you visit our platform.

We use the following types of cookies:

• Essential Cookies: Required for authentication and core Service functionality (e.g., keeping you logged in). These cannot be disabled without affecting Service operation.
• Preference Storage: Your in-app settings — such as theme and layout choices — are stored locally in your browser so they persist between sessions. This information stays on your device and is not transmitted to us.

We do not use analytics, advertising, or cross-site tracking technologies. The Service loads no third-party analytics scripts, no advertising pixels, and no session-recording tools, and our Content Security Policy is configured to block them. Because we set only cookies that are strictly necessary to operate the Service, no cookie consent banner is required.

You can configure your browser to refuse cookies or alert you when cookies are being set. Note that disabling essential cookies will prevent you from signing in.

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information. We honor these rights regardless of jurisdiction:

• Access: You may request a copy of the personal data we hold about you, including your account information and a summary of how it is used.
• Correction: You may update or correct inaccurate personal data at any time through your account settings or by contacting us.
• Data Export: You may request an export of Your Data (projects, contracts, documents, etc.) in a machine-readable format by emailing us. This is handled manually rather than as a self-service download; we will fulfill verified export requests within 30 days.
• Deletion: You may request deletion of your account from Settings → Your Profile, or by contacting us. Your access is revoked immediately on request. We will then delete or anonymize your personal information within 30 days, except for data we are required to retain by law (e.g., billing records for tax purposes) or data necessary to resolve outstanding disputes.
• If your data was entered by a builder who uses our Service: Where you are a homeowner or subcontractor, the builder — not ElevatedBuild — decides what happens to the project records they created about you, and they may be legally required to keep signed contracts, invoices, and payment records. We act on their instructions for that data. We will pass your request to them, revoke your portal access immediately, and delete the personal data we hold about you in our own right.
• Opt-Out of Marketing: You may opt out of marketing and promotional communications at any time by clicking “unsubscribe” in any marketing email or by contacting us directly. Transactional emails (receipts, security alerts) are not subject to opt-out.
• Restriction and Objection: In certain circumstances, you may have the right to restrict or object to our processing of your personal data. Contact us to discuss your specific situation.

To exercise any of these rights, contact us at legal@elevatedbuild.ai. We may need to verify your identity before processing a request.

7. Data Retention

We retain your personal information and Your Data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account Data: Retained for the lifetime of your account, plus 90 days after account closure to allow for reactivation or data export requests.
• Project and Business Data: Retained for the lifetime of your account. After account closure, you have 30 days to request an export before deletion.
• Billing Records: Retained for 7 years as required by U.S. tax laws, even after account closure.
• Usage and Log Data: Retained for up to 90 days in detailed form, then aggregated or deleted.
• Support Communications: Retained for 3 years to assist with follow-up inquiries and service improvements.

When data is deleted, we delete it from active databases and queued for purge from backups within our standard backup rotation cycle (typically 30 days).

8. SMS Communications

ElevatedBuild uses SMS messaging exclusively for operational business communications through our AI Coordinator. SMS is used to deliver project alerts, task coordination, and operational responses to three groups: builder employees and account owners (project alerts and coordination), subcontractors (portal invitations, and reminders for lien waivers and certificates of insurance), and homeowner clients (project status updates from their builder). SMS is never used for marketing or promotional purposes.

How opt-in works: There are two routes. You can opt in directly at elevatedbuild.ai/sms by entering your mobile number and agreeing to receive messages, or you can text START to our designated number. Either way a confirmation message is sent immediately, and we record the date, time, and method of your consent. Where a builder enters a subcontractor’s or homeowner’s number on their behalf, that builder is responsible for having obtained permission to share it with us for this purpose.

• Message Frequency: Message frequency varies based on project activity and user-initiated queries. You may receive multiple messages per day during active project phases.
• Message and Data Rates: Message and data rates may apply. Please check with your mobile carrier for details.
• Opt-Out: You can opt out of SMS communications at any time by replying STOP to any message. You will receive a confirmation and no further messages will be sent to that number.
• Help: Reply HELP for assistance or contact us at support@elevatedbuild.ai.
• No Third-Party Sharing: Mobile opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes. Your mobile number and SMS consent information are used solely to facilitate the operational business communications described in this section and will never be sold, rented, or shared for any marketing purpose.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will indicate the date of the most recent revision at the top of this page.

For material changes — such as new categories of data collection or significant changes to how we use your data — we will provide at least 30 days' advance notice via email to your account address or a prominent in-app notice. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

We encourage you to review this policy periodically to stay informed about how we protect your information.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to privacy-related inquiries within five business days. For requests involving data access, export, or deletion, please include “Privacy Request” in the subject line and the email address associated with your account so we can verify your identity promptly.