1. Information We Collect

• Account information: Name, email address, company name, and phone number
• Project data: Addresses, budgets, schedules, documents, photos, and other project-related content you upload
• Financial data: Payment information processed by Stripe (we do not store credit card numbers) and bank account connections via Plaid
• Usage data: Pages visited, features used, device information, and browser type
• Communications: Messages and emails sent through the platform
• AI interactions: Chat messages and document content submitted to AI features, processed for service delivery

2. How We Use Information

• Provide, maintain, and improve the Service
• Process payments and subcontractor draws
• Send transactional emails including waivers, bids, notifications, and reminders
• Power AI features such as chat and document analysis
• Provide customer support
• Perform analytics and improve service quality

3. Information Sharing

We share information with the following third-party service providers solely to operate the Service:

• Stripe — Payment processing
• Plaid — Bank account verification and linking
• Resend — Email delivery
• Anthropic — AI chat and document analysis processing
• Vercel — Hosting and infrastructure
• Supabase — Database and file storage

We do not sell your personal data. We do not share your data with advertisers.

4. Public Portals & Shared Access

TruBuildGC provides token-based portals that share specific data with third parties:

• Client portals share project-specific data with your clients via secure token links
• Bid portals share bid packets with subcontractors
• Waiver signing pages share payment and waiver data with subcontractors

As the account owner, you control what information is shared through these portals.

5. Data Security

• All data is encrypted in transit using HTTPS/TLS
• Row-level security policies enforce data isolation at the database level
• Authentication is handled via Supabase Auth using secure JWT tokens
• Public portal access uses time-limited, token-based authentication
• Passwords are never stored in plain text

6. Data Retention

• Active accounts: Data is retained for the duration of your account
• Deleted accounts: Data is removed within 90 days of account deletion
• Financial records: Retained as required by applicable law
• Backups: Rotated on a standard schedule

7. Your Rights

You have the right to:

• Access your data using the export features available in the platform
• Correct inaccurate data in your account
• Delete your account and associated data
• Opt out of non-essential email communications
• Request data portability

8. Cookies & Tracking

• We use authentication cookies required for the Service to function
• We do not use third-party advertising cookies
• We do not engage in cross-site tracking
• If analytics cookies are added in the future, this policy will be updated accordingly

9. Children's Privacy

TruBuildGC is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before they take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at privacy@trubuildgc.com or support@trubuildgc.com.