1. Information We Collect

• Account information: Name, email address, company name, and phone number
• Project data: Addresses, budgets, schedules, documents, photos, and other project-related content you upload
• Financial data: Payment information processed by Stripe (we do not store credit card numbers) and bank account connections via Plaid
• Usage data: Pages visited, features used, device information, and browser type
• Product analytics:We log in-app events (which features you use and key actions you take) to understand usage and decide what to build, keep, or improve. These logs reference your account and project identifiers only — never your name, email, or document contents.
• Session recordings:We use a third-party analytics provider (PostHog) to record how the interface is used — clicks, navigation, and on-screen layout — so we can find and fix usability problems. Recordings are masked by default: every input field and all on-screen text are obscured, so financial figures, bank details, tax IDs, and other document contents are never captured or transmitted.
• Communications: Messages and emails sent through the platform
• AI interactions: Chat messages and document content submitted to AI features, processed for service delivery. We also retain a record of what our AI proposed and the corrections you made to it, which we use as labeled data to train and improve our own AI features. We do not use this data to train third-party models.

2. How We Use Information

• Provide, maintain, and improve the Service
• Process payments and subcontractor draws
• Send transactional emails including waivers, bids, notifications, and reminders
• Power AI features such as chat and document analysis
• Train and improve our own AI features using your corrections to AI-generated output
• Provide customer support
• Measure feature usage and product engagement to prioritize what we build and improve

3. Information Sharing

We share information with the following third-party service providers solely to operate the Service:

• Stripe — Payment processing
• Plaid — Bank account verification and linking
• Resend — Email delivery
• Anthropic — AI chat and document analysis processing
• PostHog — Product analytics and masked session recording
• Vercel — Hosting and infrastructure
• Supabase — Database and file storage

We do not sell your personal data. We do not share your data with advertisers.

4. Public Portals & Shared Access

TruBuildGC provides token-based portals that share specific data with third parties:

• Client portals share project-specific data with your clients via secure token links
• Bid portals share bid packets with subcontractors
• Waiver signing pages share payment and waiver data with subcontractors

As the account owner, you control what information is shared through these portals.

5. Data Security

• All data is encrypted in transit using HTTPS/TLS
• Row-level security policies enforce data isolation at the database level
• Authentication is handled via Supabase Auth using secure JWT tokens
• Public portal access uses time-limited, token-based authentication
• Passwords are never stored in plain text

6. Data Retention

• Active accounts: Data is retained for the duration of your account
• Deleted accounts: Data is removed within 90 days of account deletion
• Financial records: Retained as required by applicable law
• Backups: Rotated on a standard schedule

7. Your Rights

You have the right to:

• Access your data using the export features available in the platform
• Correct inaccurate data in your account
• Delete your account and associated data
• Opt out of non-essential email communications
• Request data portability

8. Cookies & Tracking

• We use authentication cookies required for the Service to function
• We use first-party analytics cookies and local storage (via PostHog) to measure product usage and power masked session recordings
• We do not use third-party advertising cookies
• We do not engage in cross-site tracking

9. Children's Privacy

TruBuildGC is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 30 days before they take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at privacy@trubuildgc.com or support@trubuildgc.com.