Privacy Policy

1. Who this policy applies to

ScopeToBuild ("ScopeToBuild", "we", "us") provides a multi-tenant platform that companies use to manage restoration projects — including projects, orders, change orders, estimates, documents, and signatures. The service is intended for business use by company staff and their invited collaborators, not for the general consumer public.

Because the platform is multi-tenant, the data you create is associated with the company (tenant) you belong to and is visible to other members of that company according to their role — Admin, Manager, Client, Subcontractor, or Insurance Agent. Your company controls who is invited and what each role can see.

Our role. For your own account information — your email, name, phone number, and sign-in activity — we act as the controller. For the business content your company puts into the platform, including information about that company's own clients and properties, we act as a processor on your company's instructions: your company decides what is entered, who is invited, and how long it is kept.

2. Information we collect

We collect the following categories of information:

• Account & profile data: email address, password (stored only as a bcrypt hash — never in plain text), first, middle and last name, name suffix, phone number, postal address (street, city, state, ZIP/postal code, country), and organization name.
• Work content you create: projects, estimates, orders, change orders, comments, and attachments such as photos, files, and documents, including floor plans.
• Electronic signatures: when you sign a document, we record the signature together with the time it was made and the IP address it was made from. This is retained as legal evidence of who signed, and when.
• Location data: the address of a project may be geocoded so it can be shown on a map. On mobile, location permission is requested only on a "when in use" basis and only to support mapping features. Maps are rendered with Google Maps on Android and Apple Maps on iOS.
• Biometric sign-in (Face ID / Touch ID): if you choose to enable biometric sign-in on a mobile device, the biometric secret is stored locally on that device in the secure keystore (iOS Keychain / secure storage). Your biometric data and that secret are never transmitted to our servers.

No advertising or third-party tracking. ScopeToBuild does not use third-party analytics, advertising networks, or cross-app/website trackers. We do not collect advertising identifiers (such as IDFA) and we do not sell or share your personal information for advertising purposes.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the ScopeToBuild platform and its features.
• Authenticate you and keep your account and sessions secure.
• Let you and your colleagues create, manage, and collaborate on restoration projects, estimates, orders, change orders, documents, and signatures.
• Display project locations on a map and provide directions.
• Generate and store legally meaningful records, such as signed documents with their timestamp and originating IP address.
• Communicate with you about your account, including service and security notices.
• Comply with our legal obligations and enforce our agreements.

4. Legal bases and consent

Where data-protection law requires a legal basis, we rely on: performance of our contract with your company to provide the service; our legitimate interests in operating, securing, and improving the platform; your consent for optional device permissions (such as location and biometric sign-in, which you can grant or decline); and compliance with legal obligations. Device permissions are requested at the point of use and can be changed at any time in your device settings.

5. How information is shared

We do not sell your personal information. Information is shared only as described here:

• Within your company, by role: the content you create is visible to other members of your company (tenant) based on their role (Admin, Manager, Client, Subcontractor, Insurance Agent) and the access that role grants.
• Infrastructure and service providers: we use trusted providers to host our servers and databases and to deliver core functionality. Mapping is provided by Google Maps (Android) and Apple Maps (iOS) when map features are used; an address sent for geocoding or display is processed by those map providers under their own terms.
• Legal and safety: we may disclose information if required by law, regulation, legal process, or to protect the rights, property, or safety of ScopeToBuild, our users, or others.

6. Data storage and security

Your data is stored in cloud-hosted databases on secured servers. Internally the platform separates a global database from per-tenant (company) data so that each company's records are kept distinct.

Data is transmitted over encrypted HTTPS connections, and real-time updates are delivered over a secure WebSocket connection. Authentication uses short-lived JSON Web Tokens (access and refresh tokens). Passwords are never stored in plain text — only as bcrypt hashes. While no method of transmission or storage is perfectly secure, we maintain administrative, technical, and organizational safeguards designed to protect your information.

Service providers we use

We do not sell your personal information. Beyond sharing inside your own company by role, information reaches these providers only so the service can work:

• Infrastructure: our application servers and databases run on cloud infrastructure operated by our hosting provider, and uploaded files, images and company logos are stored in DigitalOcean Spaces.
• Document preparation and signature: PandaDoc is used to prepare, edit and route documents for signature. Documents you send through that flow, and the recipient details needed to deliver them, are processed by PandaDoc under its own terms.
• Maps: Google Maps (Android) and Apple Maps (iOS) process an address when it is sent for geocoding or display.
• Push notifications: delivery uses the Expo push service together with Apple Push Notification service and Firebase Cloud Messaging.

Storage on your device

We do not use advertising or tracking cookies. The application stores a small amount of data on the device you use it on, purely so it can function: authentication tokens so you stay signed in, your light/dark preference, unsent drafts, and — if you enable Face ID or Touch ID — the biometric secret, which is held in the device keystore and never transmitted. Signing out clears the tokens; clearing browser storage or uninstalling the app removes the rest.

7. Data retention and account deletion

You can request deletion of your account from within the application. When you do:

• There is a 7-day grace period during which the deletion can be reversed if you change your mind or the request was made in error.
• After the grace period, your personal data is anonymized: identifying fields such as your email, name, phone number, and address are erased, and your devices, sessions, and any locally stored biometric secret are removed.
• Business records that belong to the company (such as projects, estimates, orders, change orders, and signed documents) are retained, but the author is anonymized. This preserves the integrity of records that other users and the company rely on, and supports legal and record-keeping obligations.

We otherwise retain personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, or delete your personal data, and to object to or restrict certain processing. You can:

• Access and update most profile information directly in the app.
• Request deletion of your account from within the app, as described above.
• Manage device permissions (location, biometrics) in your device settings.
• Contact us to exercise any applicable data-protection right.

Some content you created may be retained in anonymized form, as explained in the retention section, even after your account is deleted.

9. International data transfers

ScopeToBuild relies on cloud infrastructure and service providers that may process and store data in countries other than your own. Where personal data is transferred across borders, we take steps intended to ensure it remains protected in accordance with applicable law.

10. Children's privacy

ScopeToBuild is a business tool and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law (for example, under 13, or under 16 in some jurisdictions). If you believe a child has provided us personal information, please contact us so we can remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the service after an update means you accept the revised policy.

12. Contact us

If you have questions about this Privacy Policy or how your data is handled, contact us at info@scopetobuild.com.