Privacy Policy

This Policy applies to personal information that BuilderFlow collects through the Service, in communications with us, and from service providers and integrations supporting the Service. It does not apply to third-party websites, services, or applications that operate under their own privacy policies.

BuilderFlow serves businesses. An account holder may upload information about its customers, employees, subcontractors, vendors, property owners, and other persons (“Customer Content”). For Customer Content processed on behalf of an account holder, the account holder generally determines why the information is submitted and how it is used. BuilderFlow generally processes Customer Content on behalf of the account holder as a service provider or processor under the Terms of Service. BuilderFlow may process certain information for its own account administration, billing, security, legal compliance, product improvement, and other independent purposes described in this Policy, subject to applicable law. If your information was submitted by a BuilderFlow customer, contact that business first regarding its privacy practices or a request concerning your information. We will assist our customer as required by law and our agreement.

The information we collect depends on how the Service is used and which features are enabled. We may collect the following categories:

2.1Account and Contact Information

• name, email address, phone number, account identifier, username, and communication preferences;
• password or authentication information, which is stored in hashed or otherwise protected form by our authentication provider;
• billing contact and administrative-user information; and
• IP address and other online identifiers associated with account access.

2.2Business and Professional Information

• company name, business address, trade or industry, contractor or license number, business phone and email, and company logo;
• subscription plan, account role, authorized users, and business preferences; and
• information you include in company profiles, templates, signatures, or branded documents.

2.3Customer, Project, Financial, and Document Information

• customer and vendor names, contact information, project locations, and property addresses;
• jobs, quotes, estimates, invoices, receipts, change orders, scopes of work, line items, allowances, payment terms, project notes, and document history;
• material costs, labor costs, pricing, taxes, totals, financial summaries, payment status, and expense classifications;
• uploaded files, construction documents, images, receipts, supporting records, and communications; and
• other information a user chooses to enter, upload, generate, or store in the Service.

2.4AI Interaction Information

• prompts, instructions, questions, uploaded content, and account context provided to an AI Feature;
• AI-generated drafts, answers, classifications, extracted data, suggestions, summaries, and other outputs;
• corrections, edits, approvals, ratings, feedback, and follow-up interactions;
• Truss conversation history and records of actions initiated through user instructions, settings, approvals, or configured workflows; and
• technical and usage information associated with AI requests, model responses, errors, safety checks, and performance.

2.5Subscription and Payment Information

• subscription plan, trial status, renewal date, billing status, payment status, and transaction history;
• limited payment metadata and identifiers received from our payment provider; and
• payment card and billing details processed directly by Stripe or another payment provider. BuilderFlow does not receive or store complete payment card numbers.

2.6Device, Usage, Log, and Security Information

• browser type, operating system, device information, IP address, approximate location inferred from IP address, and language settings;
• dates and times of access, pages and features used, clicks, session information, referring pages, and account activity;
• application logs, diagnostic information, error reports, performance information, webhook and system events, and support-related logs; and
• security, fraud-prevention, abuse-monitoring, and audit information.

2.7Communications, Support, and Feedback

• support requests, emails, survey responses, meeting notes, and other communications with BuilderFlow; and
• feedback, feature requests, corrections, and information you provide when reporting a problem.

2.8Cookies and Similar Technologies

We use session cookies and similar technologies to authenticate users, maintain sessions, remember settings, secure the Service, and operate essential functions. We do not currently use third-party advertising cookies or behavioral advertising networks. See Section 8 for more information.

2.9Sensitive Information

Certain Customer Content may include sensitive personal information under applicable law, such as account-login information in combination with credentials permitting account access; financial-account, debit-card, or credit-card information in combination with required access credentials; or the contents of mail, email, or text messages where BuilderFlow is not the intended recipient. The Service does not require users to submit Social Security numbers, full payment card numbers, government identification numbers, passwords for other services, protected health information, biometric identifiers, or other highly sensitive or regulated information. Users should not submit such information unless BuilderFlow expressly supports and authorizes the use.

We collect personal information from:

• you, when you register, use the Service, upload content, contact support, or communicate with us;
• account owners, administrators, and authorized users who provide information about other persons;
• your devices and use of the Service through cookies, logs, and similar technologies;
• service providers and integrations, including authentication, hosting, payment, communications, AI, OCR, and security providers; and
• public or third-party sources when reasonably necessary to verify information, prevent fraud, comply with law, or complete a user-directed integration.

We may use personal information to:

• provide, operate, maintain, personalize, and administer the Service;
• authenticate users, manage accounts, process subscriptions, and provide billing functions;
• create, organize, store, display, export, and transmit quotes, estimates, invoices, receipts, jobs, communications, and other records;
• provide AI Features, including drafting, extraction, classification, reconciliation, analysis, navigation assistance, communication assistance, and workflow actions initiated through user instructions, settings, approvals, or configured workflows;
• respond to support requests, provide training or guidance, and communicate about accounts, billing, security, legal terms, and Service changes;
• monitor performance, troubleshoot errors, test features, conduct quality assurance, and improve the Service;
• protect users, prevent fraud and abuse, investigate incidents, enforce our agreements, and maintain security and reliability;
• comply with legal obligations, respond to lawful requests, establish or defend legal claims, and protect rights and safety;
• complete a business transaction such as financing, merger, acquisition, reorganization, or sale of assets; and
• create and use aggregated or de-identified information for analytics, research, product development, and other lawful purposes.

We may use information for another purpose that is compatible with the context in which it was collected, as permitted by law, or with notice or consent when required.

5.1Information Processed

When a user invokes, enables, configures, or uses an AI Feature, BuilderFlow may process the user’s prompt, upload, instructions, selections, settings, approvals, and Customer Content available through the account, including account and company information, customers and contacts, projects, property addresses, quotes, estimates, invoices, receipts, scopes of work, line items, costs, pricing, notes, financial summaries, payment status, files, images, and prior Truss conversations. The information processed may vary depending on the feature, the user’s instructions, account settings, configured workflows, and the technical operation of the Service.

5.2AI and Document-Processing Providers

BuilderFlow uses provider-authorized commercial or developer services, including APIs, to operate AI and document-processing functions. Providers may include OpenAI, Anthropic, Google Cloud, and comparable AI, OCR, or document-processing providers. We may change providers, models, or configurations over time. These providers may receive and process prompts, uploaded content, relevant account context, and outputs as necessary to provide the requested function, maintain security, prevent abuse, troubleshoot errors, and comply with law.

5.3Model Training and BuilderFlow Improvement

BuilderFlow does not use Customer Content to train a general-purpose foundation model for use outside BuilderFlow. BuilderFlow does not authorize its third-party AI providers to use Customer Content submitted through the Service to train their general-purpose models unless we first provide notice and obtain consent where required by law.

BuilderFlow may use AI interactions, including prompts, outputs, corrections, edits, approvals, ratings, feedback, action history, and related technical information, to operate, test, evaluate, secure, monitor, troubleshoot, and improve BuilderFlow and its AI Features. Authorized personnel or contractors may review AI interactions when reasonably necessary for those purposes. We use aggregated or de-identified information where practical.

5.4Retention by AI Providers

AI and document-processing providers may temporarily retain inputs, outputs, safety classifications, or logs under their applicable business terms and configurations for service delivery, security, abuse prevention, troubleshooting, or legal compliance. Retention periods and available controls vary by provider, feature, endpoint, and configuration. BuilderFlow does not promise zero data retention by every provider.

5.5AI Results, Actions, and User Responsibility

AI Features may generate or assist with content, recommendations, classifications, analyses, communications, and actions. Depending on the feature and its configuration, an AI Feature may request review or approval before acting or may act automatically based on a user’s instructions, account settings, selections, approvals, or configured workflows. AI-generated or AI-assisted content and actions may be inaccurate, incomplete, misleading, outdated, duplicative, or unsuitable for a particular purpose. Users are responsible for configuring the AI Features and determining whether and how to use, approve, send, save, implement, distribute, or rely on any AI-generated or AI-assisted content, recommendation, or action.

We may disclose personal information to the following categories of recipients:

6.1Service Providers and Subprocessors

We use service providers to host, secure, maintain, and support the Service. These providers may include:

• Supabase or comparable providers for database, storage, and authentication services;
• Railway or comparable providers for application hosting and compute services;
• Stripe or comparable providers for payment and subscription processing;
• OpenAI, Anthropic, Google Cloud, and comparable providers for AI, OCR, document processing, and related infrastructure;
• email, communications, customer support, error monitoring, security, fraud-prevention, and professional service providers; and
• contractors who assist with development, testing, support, security, legal, accounting, or business operations.

Service providers are authorized to process personal information only for specified purposes and under contractual or legal obligations appropriate to their role.

6.2Account Owners and Authorized Users

Information in an account may be available to the account owner, administrators, and other authorized users according to account permissions. Business customers are responsible for managing access and permissions.

6.3At a User's Direction

We disclose information when a user directs the Service to generate, export, share, or send a document or communication; connects an integration; invites another user; or otherwise authorizes disclosure.

6.4Legal, Safety, and Rights Protection

We may disclose information when reasonably necessary to comply with law, legal process, or a lawful governmental request; investigate fraud, abuse, or security incidents; enforce agreements; protect the rights, property, or safety of BuilderFlow, users, or others; or establish, exercise, or defend legal claims.

6.5Business Transactions

We may disclose or transfer information in connection with a proposed or completed financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.

6.6Professional Advisers

We may disclose information to lawyers, accountants, auditors, insurers, and other professional advisers as reasonably necessary for their services and subject to duties of confidentiality.

BuilderFlow does not sell personal information, as “sell” is defined by the California Consumer Privacy Act. BuilderFlow does not “share” personal information for cross-context behavioral advertising, as “share” is defined by the California Consumer Privacy Act, and does not use personal information for targeted advertising. We do not knowingly sell or share personal information of individuals under 18.

If our practices materially change, we will update this Policy and provide any required notice and opt-out mechanism before engaging in the new practice.

BuilderFlow uses necessary session cookies and similar technologies to keep users logged in, secure accounts, remember settings, and operate the Service. Rejecting necessary cookies may prevent parts of the Service from functioning.

We do not currently track users across unaffiliated websites for behavioral advertising and do not permit advertising networks to do so through the Service. Because there is no uniform industry standard for browser “Do Not Track” signals, the Service does not respond to them. If we become subject to a legal obligation to recognize an opt-out preference signal for sale, sharing, or targeted advertising, we will honor the signal as required.

We retain personal information for no longer than reasonably necessary for the purposes described in this Policy, taking into account the nature and sensitivity of the information, the length of the customer relationship, user instructions, operational requirements, security and fraud-prevention needs, legal and accounting obligations, dispute and enforcement needs, and applicable limitation periods. Retention periods may differ among systems, backups, and service providers.

Deletion from active systems may not immediately remove information from backups, archives, logs, provider systems, or records retained for legal, security, fraud-prevention, accounting, dispute, or compliance purposes. When retained for those purposes, information will be limited to the applicable purpose and protected from ordinary use. We may retain aggregated or de-identified information that cannot reasonably identify an individual.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Measures may include encrypted transmission, access controls, authentication protections, restricted production access, logging, and security monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Users are responsible for protecting credentials, controlling authorized-user access, reviewing account activity, and maintaining secure copies of important records. Please notify us promptly at [email protected] if you believe an account or information has been compromised.

• Account Information: You may update certain profile and business information in the Service.
• Customer Content: You may edit, export, or delete content using available account features, subject to account permissions and retention limitations.
• Account Deletion: You may request account deletion by contacting [email protected]. We may verify the request and may retain information as described in Section 9.
• Transactional Communications: You cannot opt out of communications necessary for billing, security, legal notices, or operation of an active account.
• Marketing Communications: If we send marketing emails, you may opt out through the unsubscribe mechanism or by contacting us.
• Cookies: You may control cookies through browser settings, although disabling necessary cookies may impair the Service.

Depending on where you live and subject to legal exceptions, you may have the right to request:

• access to or confirmation of personal information we process about you;
• correction of inaccurate personal information;
• deletion of personal information;
• a portable copy of certain personal information;
• information about categories of personal information collected, sources, purposes, and recipients;
• opt-out of sale, sharing, targeted advertising, or certain profiling; and
• limitation of certain uses or disclosures of sensitive personal information.

BuilderFlow does not currently sell or share personal information for cross-context behavioral advertising and does not use sensitive personal information for purposes that require a right to limit under California law.

To submit a request, email [email protected] and describe the request. We may verify identity or authority using account information or other reasonable methods. An authorized agent may submit a request when permitted by law, but we may require proof of authorization and verification of the individual. We will not discriminate against a person for exercising a privacy right. If applicable law provides a right to appeal a decision, you may appeal by replying to our response and stating that you request an appeal.

When we process information only on behalf of a business customer, we may direct the request to that customer or assist it in responding.

This Section supplements the rest of this Policy for California residents and serves as BuilderFlow’s California Notice at Collection and annual California privacy disclosure to the extent the California Consumer Privacy Act (“CCPA”) applies. The categories below are collected or may be collected as described in this Policy and, where applicable, were collected during the preceding 12 months. We use the information for the business and commercial purposes described in Sections 4 and 5 and disclose it to the categories of recipients described in Section 6.

For each category listed below, the applicable retention period or criteria are determined by the record type in which the information appears and the corresponding retention criteria described in Section 9. Relevant factors include account status, user instructions, operational and security needs, provider and backup systems, legal and accounting obligations, disputes, and applicable limitation periods.

During the preceding 12 months, BuilderFlow disclosed the categories of personal information identified above, as applicable, to the service providers and contractors described in Section 6 for hosting, authentication, payment processing, AI and document processing, communications, support, security, troubleshooting, professional services, and the other business purposes described in Sections 4 through 6. Not every category is disclosed to every recipient.

California residents may have the rights to know, access, correct, delete, and obtain portability of personal information; to opt out of sale or sharing; to limit certain uses of sensitive personal information; and to receive equal service and pricing. BuilderFlow does not sell or share personal information for behavioral advertising. We do not use or disclose sensitive personal information for purposes outside those permitted without a right to limit. Requests may be submitted as described in Section 12.

California “Shine the Light” law permits certain residents to request information about disclosure of personal information to third parties for their direct marketing. BuilderFlow does not disclose personal information to third parties for their own direct marketing purposes.

The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information to BuilderFlow, contact us so we can review and take appropriate action.

BuilderFlow is designed and marketed primarily for businesses operating in the United States and is not localized for international use. If you access the Service from outside the United States, you understand that personal information may be processed in the United States and other locations where BuilderFlow or its service providers operate. Those locations may have data-protection laws different from the laws where you live. You are responsible for determining whether your use complies with laws applicable to your business and for obtaining any required notices, consents, or transfer mechanisms.

The Service may contain links to or integrate with third-party sites or services. Their privacy practices are governed by their own policies. We encourage you to review them before providing information or enabling an integration.

We may update this Policy to reflect changes in the Service, AI Features, providers, law, or our practices. We will post the updated Policy with a new effective date and will provide additional notice of material changes by email, in-app notice, or another reasonable method. When appropriate, we may require users to acknowledge the updated Policy or accept updated Terms before continuing to use the Service.

Questions, concerns, or privacy requests may be sent to:

BuilderFlow LLC
[email protected]
https://getbuilderflow.com