ByggForge Privacy PolicyLast updated: July 28, 2026 · Effective: July 28, 2026This Privacy Policy explains how ByggForge LLC ("ByggForge," "we," "us") handles personal information.

Contractor — a business that uses ByggForge to run its operations. Our direct customer.

User — an individual authorized by a Contractor to use the Service (owner, office staff, crew).

Client — the Contractor's own customer, typically a homeowner or property owner. If you received a quote, invoice, or message from a contractor who uses ByggForge, this is you.

Contractor Data — information a Contractor puts into ByggForge, including information about its Clients.

Output — material our AI generates at a Contractor's direction, such as a draft estimate or proposal.

These match the definitions in our [Terms of Service](/terms); any other capitalized term has the meaning given there.---1. Our Two Roles — Read This FirstWe handle personal information in two different capacities, and your rights depend on which applies.1.1 We are a *processor* (service provider) for Contractor Data. When a Contractor stores information about a Client — a homeowner's name, address, phone, job photos, pricing — the Contractor decides why and how that information is used. We process it on the Contractor's instructions to provide the Service. We do not sell it, and we do not use it for our own purposes beyond §4.1.2 We are a *controller* (business) for our own business data. This includes Contractor and User account details, billing information, support communications, and how people use our website and app. We decide the purposes for that information.1.3 If you are a Client (homeowner): your relationship is with the Contractor, not with us. To exercise rights over information a Contractor holds about you, contact the Contractor. We will assist them in responding. If you contact us directly we will route your request to the relevant Contractor.---2. Information We Collect2.1 Account and business information. Name, business name, email, phone, role, and address of Contractors and their Users.2.2 Contractor Data. Everything a Contractor puts into the Service, including Client names, addresses, phone numbers, email addresses, job details, measurements, photographs, estimates, invoices, and notes.2.3 Payment information. Subscription billing details, and — where a Contractor uses ByggForge to collect from Clients — transaction records. Card numbers are handled by Stripe and never touch our systems.2.4 Communications. Support requests, and messages sent through the Service (including email and SMS we send on a Contractor's behalf).2.5 Usage, device, and website information. Pages viewed, features used, browser type, operating system, device type, language, and interaction events. On our marketing website this includes scroll depth and time on page. Our websites and our first-party analytics do not derive or store your geographic location. Our mobile app does collect location in the circumstances described in §2.7, which is the only place in the Service where location is collected.2.6 Marketing-site enquiry information. If you complete a signup or waitlist form we collect the email, name, business name, role, trade, city, state, and any free-text description you provide, along with the marketing source that referred you.2.7 Location information (mobile app only). Our mobile app collects location in three distinct ways, and they are not the same thing:

While you are using the app. The app reads your device location to show which of your job sites you are near. This is used on your device to work out the nearest site and is not sent to us or stored.

On photographs. When you capture a job-site photograph in the app, the coordinates at which it was taken are attached to it and stored with the photograph as part of Contractor Data (§2.2). Where that photograph is used for site analysis, those coordinates are sent to our AI provider as described in §4.1.

In the background, while you are clocked in. If you are a worker and you have separately and explicitly consented to workday location tracking, the app records periodic location checkpoints while your shift is open, so your employer can see arrivals at job sites and confirm on-site time. These checkpoints are sent to us and stored.

Three limits on background tracking, each enforced in our systems and not merely promised here:1. It requires your explicit consent, recorded separately from the operating-system permission. Granting the OS location permission is not by itself consent and does not start tracking. 2. Consent can be withdrawn at any time, and withdrawal takes effect immediately — every later checkpoint is refused. Today that withdrawal is actioned by your employer, who administers the consent setting for their crew; ask them to turn it off and it stops. Independently of that, you can switch off location permission for the app in your device's settings at any time, and background collection stops — that control is yours alone and does not require anyone's agreement. 3. It only runs while your shift is open — between clock-in and clock-out. Outside that window checkpoints are refused even if consent is in place and the permission is granted. We do not track your location outside your working hours.While background tracking is active your device displays a persistent notification, and your employer — the Contractor — is the party that decides whether to use this feature at all. We act as processor for that data (§1.1).2.8 Voice recordings. Where you record a voice note in our mobile app — for example after a supplier call — the audio recording is sent to us and on to our transcription provider (§5) to produce a text transcript. The transcript, and the summary derived from it, are stored as Contractor Data. Recording is always started by you, by pressing record; the app does not listen in the background and does not record unless you start it.2.9 Contacts. Where you choose to import customers, crew, or suppliers from your device's address book, the app reads your contacts on your device so you can search and select among them. Your address book is not uploaded. Only the entries you explicitly select and confirm are sent to us — name, phone number, email address, company, and postal address for those entries only — and they are then stored as Contractor Data.---3. Why We Use InformationWe use personal information to: provide and secure the Service; authenticate Users; process payments; provide support; send service and transactional messages; detect fraud and abuse; comply with law; and — as described in §4 — improve the Service.---4. AI Processing and Product Improvement4.1 How AI features work. Several features send information to third-party AI providers, which act as our subprocessors under contractual restrictions and are not permitted to use the data to train their models. Specifically:

The assistant. When you ask the assistant a question, it retrieves the business records needed to answer — which may include Client names, service addresses, phone numbers, job notes, invoice lines, and photo captions — and those records are sent to our AI provider as part of answering you. What the assistant retrieves is decided by the assistant as it works, so we cannot list the fields in advance.

Incoming email. When email arrives at a Contractor's connected inbox, we send the sender's name, sender's address, subject line, and the first 1,500 characters of the message to an AI provider to classify it. This happens automatically, without anyone at the Contractor pressing a button. See §4.5.

Site analysis. For roof and property estimates we send aerial and street-level photographs of the property, together with its address and coordinates, to an AI provider for measurement and condition analysis.

Documents and supplier records. Uploaded documents and supplier communications are sent for extraction of their contents.

Voice notes. When you record a voice note in our mobile app, the audio recording is sent to our transcription provider to produce a text transcript, and the transcript is then sent to our AI provider to summarise the call and draft any follow-up. See §2.8 and the table in §5.

4.2 What we use to improve ByggForge. We use de-identified and aggregated data derived from use of the Service to operate, analyze, and improve the Service. De-identified means direct identifiers are removed and the data cannot reasonably be re-associated with a Contractor, User, or Client.4.3 What we do not do. We do not use raw Contractor Data to train models that serve other contractors, and we do not sell it. See §5 for how we describe sharing generally.4.4 Opt-out. Contractors may opt out of §4.2 by written request to privacy@byggforge.ai without affecting their use of the Service. We will confirm receipt and apply the opt-out within 30 days.4.5 When the person is not our Contractor. Some of the above concerns people who are not our customers. If you email a contractor who uses ByggForge — including mail sent to that contractor's own business email address, where they have connected that mailbox to ByggForge — your message is processed as described in §4.1. You did not choose ByggForge and have no account with us. We act as a processor for the Contractor in that handling (§1.1), and you may contact us or the Contractor to ask what is held (§1.3, §7.5).---5. Sharing and Subprocessors5.1 We do not sell personal information for money.5.2 We disclose personal information only to the parties listed below. Each is a service provider contractually restricted to processing it on our instructions and for no purpose of its own. Under laws including the CCPA, a disclosure to a service provider under those restrictions is not a "sale" or a "share."One entry in the table is different, and we identify it there: Google Fonts. Because our marketing website loads fonts directly from Google, your browser contacts Google when a page loads. We have no service-provider agreement with Google covering that request, and it happens before you interact with the page. Everything else in the table is a contracted service provider.5.3 We do not currently use advertising pixels, ad-network tags, or cross-context behavioural tracking. If that changes, we will update this Policy before deploying it and provide the opt-out mechanism the law requires.| Subprocessor | Purpose | Data involved | |---|---|---| | Anthropic | AI model provider — assistant, email classification, site analysis, document extraction | Business records retrieved by the assistant; incoming email sender, subject and message text; property photographs with address and coordinates; uploaded document contents | | Google Cloud Speech-to-Text | Speech-to-text transcription of voice notes recorded in our mobile app | The audio recording you make, and nothing else | | Stripe | Payment processing (subscriptions and Contractor↔Client payments) | Billing and transaction data; card data handled entirely by Stripe | | Google Cloud | Application hosting and database (United States) | All Service data at rest | | Vercel | Website and application delivery | Request metadata | | Resend | Transactional and notification email | Recipient address and message content | | Twilio *(not currently in use)* | SMS notifications — this integration is not enabled and sends no messages | Recipient phone number and message content, if enabled | | Google Maps | Map display in our mobile app on Android devices | The job-site coordinates being displayed, and your device's map requests | | Google Fonts *(not a contracted service provider — see §5.2)* | Web font delivery on our marketing website | Your IP address and browser details, sent to Google when a page loads | | Microsoft Clarity *(not currently in use)* | Website analytics, heatmaps, and session replay — disabled 26 July 2026; this integration is switched off and receives no data | — |We also disclose information where required by law, to protect rights and safety, and in connection with a merger or acquisition (subject to this Policy).---6. Cookies, Analytics, and Session Recording6.1 First-party analytics. On our own websites we record page views, scroll depth, time on page, and feature interactions using a randomly generated identifier stored in your browser. We hash IP addresses before storage and do not retain raw IP addresses.6.2 Session recording and heatmaps — not currently in use. Our marketing website previously used Microsoft Clarity to record interactions and produce session replays and heatmaps. It was disabled on 26 July 2026 and is not collecting data. If we re-enable session recording we will update this Policy and provide a consent mechanism before doing so.6.3 Web fonts. Our marketing website loads fonts from Google Fonts. Your IP address and browser details are sent to Google when a page loads, before any interaction.6.4 Your choices. You can block or delete cookies and similar storage through your browser settings; blocking them may affect how parts of the Service work. We do not use advertising cookies, we do not use tracking pixels, and we do not share analytics data with advertisers or data brokers — so we do not offer a separate opt-out beyond your browser's own controls. If that ever changes, we will update this Policy and provide an opt-out before the change takes effect.---7. Your Privacy Rights7.1 Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, to opt out of targeted advertising or the sale or sharing of personal information, and to appeal a refused request. We do not discriminate against anyone for exercising these rights.7.2 Iowa residents. The Iowa Consumer Data Protection Act provides access, deletion, portability, and opt-out rights, and a right to appeal.7.3 California residents. The CCPA/CPRA provides rights to know, delete, correct, and opt out of sale or sharing, and to limit use of sensitive personal information.7.4 Other states. Residents of states with comparable laws have equivalent rights, which we extend generally rather than by state.7.5 How to exercise. Contact privacy@byggforge.ai. We verify requests before acting. If your information was provided to us by a Contractor, contact that Contractor — see §1.3.---8. Canadian Residents8.1 We handle personal information in accordance with PIPEDA and, for Quebec residents, Quebec's Law 25 — including rights of access, correction, withdrawal of consent, and, where applicable, data portability and de-indexing.8.2 Commercial electronic messages are sent in accordance with CASL. Every marketing message includes sender identification and an unsubscribe mechanism.8.3 Personal information about Canadian residents is stored and processed in the United States, and is disclosed to the service providers listed in §5 (see §9).8.4 Where a Contractor uses the Service to handle their Clients' personal information, the Contractor is the accountable organisation for that information and is responsible for its own obligations under Canadian privacy law. We act on their instructions (§1).---9. Where Data Is StoredWe store and process personal information in the United States. If you access the Service from outside the US, you understand your information is transferred there, where privacy laws may differ.---10. Security and Breach Notification10.1 We use administrative, technical, and physical safeguards including encryption in transit, access controls, and audit logging. No system is perfectly secure.10.2 If a breach affecting personal information occurs, we will notify affected parties and regulators as required by applicable law. Where we act as processor (§1.1), we will notify the relevant Contractor without undue delay so they can meet their own obligations.---11. Retention11.1 We keep Contractor Data for as long as the Account is active. After termination, a Contractor may export Contractor Data for 30 days, after which we may delete it.11.2 We keep account, billing, and transaction records longer where required for tax, accounting, or legal purposes.11.3 De-identified and aggregated data (§4.2) may be retained indefinitely, as it is no longer associated with an identifiable person.---12. ChildrenThe Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.---13. Changes and Contact13.1 We may update this Policy. For material changes we will provide notice by email or in-product before the change takes effect.13.2 Contact privacy@byggforge.ai · ByggForge LLC, 317 E. Elm Street, West Union, IA 52175.ByggForge home Terms of Service Privacy Policy Payments Terms