Privacy Policy

ScopeToBuild ("ScopeToBuild", "we", "us") provides a multi-tenant platform that companies use to manage restoration projects — including projects, orders, change orders, estimates, documents, and signatures. The service is intended for business use by company staff and their invited collaborators, not for the general consumer public.

Because the platform is multi-tenant, the data you create in a company (tenant) is associated with that company and is visible to its other members according to their roles — Admin, Manager, Client, Subcontractor, Crew Member, or Insurance Agent. Each company controls who it invites and what each role can see. If you registered without a company, this applies once you create or join one.

Our role. For your own account information — your email, name, phone number, and sign-in activity — we act as the controller. For the business content your company puts into the platform, including information about that company's own clients and properties, we act as a processor on your company's instructions: your company decides what is entered, who is invited, and how long it is kept.

We collect the following categories of information:

• Account & profile data: email address, password (stored only as a bcrypt hash — never in plain text), first, middle and last name, name suffix, phone number, postal address (street, city, state, ZIP/postal code, country), and organization name.
• Work content you create: projects, estimates, orders, change orders, comments, and attachments such as photos, files, and documents, including floor plans and room scans captured with your device's camera or LiDAR sensor.
• Documents you import for AI extraction: when you use "Import from PDF" to turn an insurance estimate into a ScopeToBuild estimate, the PDF file you choose is sent in full to Anthropic PBC, which extracts the line items and returns them to us. The file is sent as it is — we do not strip or redact it first — so whatever the document contains (property address, insured's name, claim number, amounts) is included. Anthropic processes it on our behalf, does not use it to train its models, and retains it only for the limited period described in its own terms. The feature runs only when you start it; nothing is sent to Anthropic in the background. If our own document reader cannot read an imported PDF automatically, we may keep a copy of that PDF for up to 30 days to improve how our software reads documents, and then delete it. A company can opt out by contacting support; we then stop keeping its documents and delete any copies we already hold.
• Electronic signatures: when you sign a document, we record the signature together with the time of each signing step (opening, completing fields and signing), the IP address it was made from, and basic browser information. This record is kept with the signed document as legal evidence of who signed, and when.
• Billing information: when a company subscribes, we keep the company's billing email address and company name, its plan and billing period, the subscription's status and key dates (such as trial end, renewal and cancellation), references to its invoices and receipts, the customer identifier our payment processor assigns to it, and any promotional codes it has redeemed. Payment card details are entered directly on pages operated by our payment processor, Stripe, and go straight to Stripe — we never receive or store your full card number or security code. To calculate sales tax, Stripe collects a billing address (and a tax ID, if you choose to provide one) and uses it to determine your location for tax purposes.
• Location data: the address of a project may be geocoded so it can be shown on a map. On mobile, location permission is requested only on a "when in use" basis and only to support mapping features. Maps are rendered with Google Maps on Android and Apple Maps on iOS.
• Biometric sign-in (Face ID / Touch ID): if you choose to enable biometric sign-in on a mobile device, the biometric secret is stored locally on that device in the secure keystore (iOS Keychain / secure storage). Your biometric data and that secret are never transmitted to our servers.
• Diagnostics and product analytics: when the app crashes or an action fails, we send the error together with the screen it happened on, your user and company identifiers, the app version and the platform. We also send a small, fixed set of product events — the app being opened, a screen being viewed, and whether flows such as creating an estimate or accepting an order were completed or failed. These events carry identifiers and pre-defined values only; they never carry free text such as project names, client names, addresses or amounts. This limit applies to events only. Session recordings, described below, are a separate mechanism with their own limits.

No advertising, no cross-app tracking. ScopeToBuild does not use advertising networks or cross-app/website trackers. We do not collect advertising identifiers (such as IDFA), we do not combine your data with data from other companies' apps or websites, and we do not sell or share your personal information for advertising purposes.

We do use a third-party product-analytics provider. See "Diagnostics, product analytics and session recordings" below for what is collected, why, and where it is stored.

We use the information we collect to:

• Provide, operate, and maintain the ScopeToBuild platform and its features.
• Authenticate you and keep your account and sessions secure.
• Let you and your colleagues create, manage, and collaborate on restoration projects, estimates, orders, change orders, documents, and signatures.
• Display project locations on a map and provide directions.
• Generate and store legally meaningful records, such as signed documents with their timestamp and originating IP address.
• Process subscription payments, calculate the taxes that apply, apply promotional codes, and send invoices, receipts and billing notices such as trial-ending reminders, failed-payment notices and advance notice of price changes.
• Communicate with you about your account, including service and security notices.
• Comply with our legal obligations and enforce our agreements.

Where data-protection law requires a legal basis, we rely on: performance of our contract with your company to provide the service; our legitimate interests in operating, securing, and improving the platform; your consent for optional device permissions (such as location and biometric sign-in, which you can grant or decline); and compliance with legal obligations. Device permissions are requested at the point of use and can be changed at any time in your device settings.

We do not sell your personal information. Information is shared only as described here:

• Within your company, by role: the content you create is visible to other members of your company (tenant) based on their role (Admin, Manager, Client, Subcontractor, Crew Member, Insurance Agent) and the access that role grants.
• Infrastructure and service providers: we use trusted providers to host our servers and databases and to deliver core functionality. Mapping is provided by Google Maps (Android) and Apple Maps (iOS) when map features are used; an address sent for geocoding or display is processed by those map providers under their own terms.
• Links inside reports you share: when you generate a report that contains photos, each photo is embedded as a link that opens without signing in, so that whoever receives the report can view it. Anyone who has the link can open that photo, and the link does not expire. Only photos attached to order comments can be reached this way — contracts, estimates and other documents cannot. Share reports only with people you intend to give access to.
• Legal and safety: we may disclose information if required by law, regulation, legal process, or to protect the rights, property, or safety of ScopeToBuild, our users, or others.

Your data is stored in cloud-hosted databases on secured servers. Internally the platform separates a global database from per-tenant (company) data so that each company's records are kept distinct.

Data is transmitted over encrypted HTTPS connections, and real-time updates are delivered over a secure WebSocket connection. Authentication uses short-lived JSON Web Tokens (access and refresh tokens). Passwords are never stored in plain text — only as bcrypt hashes. While no method of transmission or storage is perfectly secure, we maintain administrative, technical, and organizational safeguards designed to protect your information.

We do not sell your personal information. Beyond sharing inside your own company by role, information reaches these providers only so the service can work:

• Infrastructure: our application servers and databases run on cloud infrastructure operated by our hosting provider, and uploaded files, images and company logos are stored in DigitalOcean Spaces.
• Electronic signature: documents sent for e-signature are processed by our own signing service, which runs on our servers at our hosting provider. It receives the document and the recipient's name and email address, and records the details of each signing step described in section 2. To certify when a document was signed, only a cryptographic fingerprint of the document, never the document itself, is sent to DigiCert's timestamping service.
• Email: all transactional email — address verification, password resets, invitations, signing requests and account notices — is delivered by Resend, which receives the recipient's email address and the contents of the message.
• Payments and tax: Stripe, Inc. (United States) processes subscription payments, calculates sales tax (Stripe Tax), and operates the checkout and customer-portal pages where card details, billing address, invoices and cancellation are handled. Stripe receives card details directly from you, together with the billing email, company name and billing address, and acts under its own terms and privacy policy for the payment it processes. We receive back the subscription and invoice information described in section 2, never the full card number.
• AI document extraction: Anthropic PBC (United States) receives the PDF files you submit through "Import from PDF", for the sole purpose of extracting their contents for you.
• Maps: Google Maps (Android) and Apple Maps (iOS) process an address when it is sent for geocoding or display.
• Push notifications: delivery uses the Expo push service together with Apple Push Notification service and Firebase Cloud Messaging.

Who receives this. PostHog Inc. receives the diagnostic events and product events described in section 2, and the session recordings described below, and stores them on infrastructure located in the United States. PostHog processes this information on our behalf. We do not use it for advertising and we do not share it with data brokers.

Session recordings. To understand where people get stuck, the mobile app can record a small set of screens while you use it. A recording is a series of screenshots taken roughly every two seconds, together with the taps and scrolls you make. Recordings are linked to your account and are kept for 30 days. In the current version of the app only navigation screens are recorded: the projects list, the company hub, the company settings catalogues (including document templates), help, and the dates and floor-plan pages of a project. All text on those screens is blanked out, including names, email addresses, addresses and amounts shown in lists and headers. Screens whose main content is client details, money, messages, documents, your profile, billing or the camera are never recorded, and a new screen is not recorded until we add it on purpose.

What a recording contains. Text on screen is blanked out, as are photographs, images, the text you type and the system photo and contact pickers. A recording shows the layout of the screen and where you tapped, not what the screen says. This is also how we protect information about your clients: their names, email addresses and property addresses do not appear in a recording in readable form.

AI review of recordings. We may use AI to summarize recordings and find where people get stuck. This is done by PostHog's Replay Vision, which sends the recording to Google's Gemini models on PostHog's behalf, and by Anthropic PBC when we review recordings with Claude. Both receive the blanked-out recording only.

Older versions of the app. Earlier versions of the mobile app recorded differently: versions 1.0.x recorded all screens and did not blank out text, and version 1.2.2 blanked out text but could also record the documents page of a project and, briefly, parts of other screens while moving between them. If you use one of those versions, please update the app.

We do not use advertising or tracking cookies. The application stores a small amount of data on the device you use it on, purely so it can function: authentication tokens so you stay signed in, your light/dark preference, unsent drafts, and — if you enable Face ID or Touch ID — the biometric secret, which is held in the device keystore and never transmitted. Signing out clears the tokens; clearing browser storage or uninstalling the app removes the rest.

You can request deletion of your account from within the application. When you do:

• There is a 7-day grace period during which the deletion can be reversed if you change your mind or the request was made in error.
• After the grace period, your personal data is anonymized: identifying fields such as your email, name, phone number, and address are erased, and your devices, sessions, and any locally stored biometric secret are removed.
• Business records that belong to the company (such as projects, estimates, orders, change orders, and signed documents) are retained, but the author is anonymized. This preserves the integrity of records that other users and the company rely on, and supports legal and record-keeping obligations.
• If you were the only owner of a workspace, the workspace is deleted with your account, and the files stored in it — photos, floor plans, room scans, documents and other uploads — are erased from our file storage shortly afterwards. If you were a member of someone else's workspace, that workspace and its files are not affected by your deletion; only your authorship is anonymized.

Billing records. Invoices, payment records, tax calculations and the related subscription history are kept for as long as tax and accounting laws require us to keep them, including after a subscription is cancelled and after an account is deleted. These records belong to the company that subscribed. A cancelled or unpaid subscription never causes us to delete your company's work content.

We otherwise retain personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements.

Depending on where you live, you may have rights to access, correct, or delete your personal data, and to object to or restrict certain processing. You can:

• Access and update most profile information directly in the app.
• Request deletion of your account from within the app, as described above.
• Export a copy of your personal data from your profile (Profile → Export my data). We email you a link to download it.
• Manage device permissions (location, biometrics) in your device settings.
• Contact us to exercise any applicable data-protection right.

Some content you created may be retained in anonymized form, as explained in the retention section, even after your account is deleted.

ScopeToBuild relies on cloud infrastructure and service providers that may process and store data in countries other than your own. Where personal data is transferred across borders, we take steps intended to ensure it remains protected in accordance with applicable law.

Your information is stored and processed in the United States. This applies to the files you upload (DigitalOcean Spaces, US region), to diagnostic events and session recordings (PostHog Inc., US), to documents you submit for AI extraction (Anthropic PBC, US), and to payment and billing information (Stripe, Inc., US), regardless of where you use the service.

ScopeToBuild is a business tool and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law (for example, under 13, or under 16 in some jurisdictions). If you believe a child has provided us personal information, please contact us so we can remove it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the service after an update means you accept the revised policy.

If you have questions about this Privacy Policy or how your data is handled, contact us at info@scopetobuild.com.