Privacy Policy

1. Information We Collect

We collect information in the following categories:

Account and Identity Information

When you register for an account, we collect your name, business name, email address, phone number, and any other information you voluntarily provide. If you are a team member invited by an account owner, we collect the same information at the point of your registration.

Project and Business Data

In the course of using the Service, you will upload and create data related to your construction projects, including but not limited to project names and addresses, budgets and cost breakdowns, contracts and scopes of work, change orders, schedules, photos, documents, subcontractor and client contact information, and payment schedules. This data is referred to collectively as “Your Data.” You own Your Data; we process it only to provide and improve the Service.

Payment and Billing Information

Subscription payments are processed by Square, Inc. When you enter payment information, it is transmitted directly to Square. We receive only a transaction confirmation and limited non-sensitive data (e.g., card type, last four digits, billing ZIP code). We do not store full card numbers, CVV codes, or bank account details on our servers.

Usage and Technical Data

We automatically collect technical and usage information when you interact with the Service, including your IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, features used, time and duration of sessions, and error logs. This data is used to operate, maintain, and improve the Service.

Communications

If you contact us by email or through the Service, we retain your communications and our responses to assist with future inquiries and improve customer support quality.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: To create and manage your account, process transactions, deliver the features you use, and facilitate client and team collaboration.
• Improving the Service: To understand how users interact with our platform, diagnose technical issues, and develop new features and enhancements.
• Communications: To send transactional emails (account confirmations, password resets, billing receipts), product updates, and — with your consent — promotional communications. You can opt out of marketing emails at any time.
• Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, abuse, and other unauthorized activity.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.
• AI Features: If you use AI-assisted features within the Service, your project data may be processed by our AI models to generate suggestions, documents, or analyses. This processing is governed by our data handling commitments in this policy.

We do not use Your Data to train general-purpose AI models or sell insights derived from your business information to third parties.

3. Data Storage and Security

Your Data is stored on infrastructure provided by Supabase, Inc., which in turn uses Amazon Web Services (AWS) data centers. Data is stored in the United States. Supabase provides SOC 2 Type II compliant infrastructure with encryption at rest (AES-256) and in transit (TLS 1.2+).

We implement industry-standard security measures, including:

• Row-level security (RLS) ensuring each company's data is logically isolated from other tenants.
• Encrypted connections for all data in transit.
• Role-based access controls limiting employee access to data on a need-to-know basis.
• Regular security reviews and dependency audits.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect Your Data using commercially reasonable means, we cannot guarantee absolute security. In the event of a data breach that affects your information, we will notify you as required by applicable law.

4. Data Sharing

We do not sell your personal data or Your Data to third parties. We share information only in the following limited circumstances:

• Infrastructure and Service Providers: We share data with Supabase (database and authentication), AWS (cloud hosting), Stripe (payment processing), Twilio (SMS communications), and Anthropic (AI features). These providers are contractually obligated to handle your data securely and only for the purposes we specify.
• Client Portal: When you invite clients to view their project through the Client Portal, those clients will have access to the project data you designate. You control what is visible to each client.
• Legal Requirements: We may disclose information if required to do so by law, court order, or other governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, financing, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

5. Cookies and Analytics

We use cookies and similar tracking technologies to operate and improve the Service. Cookies are small text files placed on your device when you visit our platform.

We use the following types of cookies:

• Essential Cookies: Required for authentication and core Service functionality (e.g., keeping you logged in). These cannot be disabled without affecting Service operation.
• Analytics Cookies: Used to understand aggregate usage patterns, feature popularity, and performance. These help us prioritize improvements. Analytics data is collected in a way that does not identify individual users.
• Preference Cookies: Store your in-app settings and preferences between sessions.

You can configure your browser to refuse cookies or alert you when cookies are being set. Note that disabling certain cookies may impair functionality of the Service. We do not use third-party advertising cookies or cross-site tracking technologies.

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information. We honor these rights regardless of jurisdiction:

• Access: You may request a copy of the personal data we hold about you, including your account information and a summary of how it is used.
• Correction: You may update or correct inaccurate personal data at any time through your account settings or by contacting us.
• Data Export: You may request an export of Your Data (projects, contracts, documents, etc.) in a machine-readable format. We will fulfill export requests within 30 days.
• Deletion: You may request deletion of your account and associated personal data. Upon a verified deletion request, we will delete or anonymize your personal information within 30 days, except for data we are required to retain by law (e.g., billing records for tax purposes) or data necessary to resolve outstanding disputes.
• Opt-Out of Marketing:You may opt out of marketing and promotional communications at any time by clicking “unsubscribe” in any marketing email or by contacting us directly. Transactional emails (receipts, security alerts) are not subject to opt-out.
• Restriction and Objection: In certain circumstances, you may have the right to restrict or object to our processing of your personal data. Contact us to discuss your specific situation.

To exercise any of these rights, contact us at legal@elevatedbuild.ai. We may need to verify your identity before processing a request.

7. Data Retention

We retain your personal information and Your Data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account Data: Retained for the lifetime of your account, plus 90 days after account closure to allow for reactivation or data export requests.
• Project and Business Data: Retained for the lifetime of your account. After account closure, you have 30 days to request an export before deletion.
• Billing Records: Retained for 7 years as required by U.S. tax laws, even after account closure.
• Usage and Log Data: Retained for up to 90 days in detailed form, then aggregated or deleted.
• Support Communications: Retained for 3 years to assist with follow-up inquiries and service improvements.

When data is deleted, we delete it from active databases and queued for purge from backups within our standard backup rotation cycle (typically 30 days).

8. SMS Communications

ElevatedBuild uses SMS messaging exclusively for operational business communications through Leo, our AI operations coordinator. SMS is used to deliver project alerts, task coordination, and operational responses to registered employees and account owners. SMS is not used for marketing or promotional purposes.

How opt-in works:A company owner registers an employee’s phone number within the ElevatedBuild platform under Settings › Team. The employee then texts “START” to our designated Leo number to confirm their consent. A confirmation message is sent immediately: “You’re now connected to Leo, the ElevatedBuild AI coordinator. Reply STOP to unsubscribe at any time. Msg & data rates may apply.” No messages are sent until this two-step consent is completed.

• Message Frequency: Message frequency varies based on project activity and user-initiated queries. You may receive multiple messages per day during active project phases.
• Message and Data Rates: Message and data rates may apply. Please check with your mobile carrier for details.
• Opt-Out: You can opt out of SMS communications at any time by replying STOP to any message. You will receive a confirmation and no further messages will be sent to that number.
• Help: Reply HELP for assistance or contact us at support@elevatedbuild.ai.
• No Third-Party Sharing: Mobile opt-in data and consent will not be shared with any third parties or affiliates for marketing or promotional purposes. Your mobile number and SMS consent information are used solely to facilitate the operational business communications described in this section and will never be sold, rented, or shared for any marketing purpose.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will indicate the date of the most recent revision at the top of this page.

For material changes — such as new categories of data collection or significant changes to how we use your data — we will provide at least 30 days' advance notice via email to your account address or a prominent in-app notice. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

We encourage you to review this policy periodically to stay informed about how we protect your information.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to privacy-related inquiries within five business days. For requests involving data access, export, or deletion, please include “Privacy Request” in the subject line and the email address associated with your account so we can verify your identity promptly.