Privacy Policy

Effective November 6, 2026 · [Legal entity name]

1. Who we are

[Legal entity name] (“Numerate,” “we”) provides construction estimating and project-controls software to businesses. This policy explains how we handle personal information on numerate.build, in the Numerate web and desktop apps, and when you contact us. Questions: privacy@numerate.build, or [Street address, City, State ZIP].

2. Our role

For account, billing and website information, Numerate decides how the information is used (we're the “controller” or “business”).

For Customer Data — what our customers store in Numerate, such as projects, estimates, documents and their own client and staff contacts — we act on the customer's instructions as its service provider / processor. If you're a customer's employee or client and have a question about that data, please contact that company first; we'll help them respond.

3. What we collect

We don't collect sensitive personal information (such as government IDs, health or financial account data) and ask that you not upload it. We don't use advertising or analytics trackers on the website or in the apps.

4. How we use it

• To provide, maintain and support the Service, including the features your company turns on.
• To secure accounts: sign-in, two-step verification, lockouts, fraud prevention and the audit log your company relies on.
• To bill you and keep financial records.
• To send service messages such as password resets, security alerts, receipts and important changes. These aren't marketing; you'll receive them while you have an account.
• To comply with law and enforce our Terms.

If we ever send product news or marketing email, it will include an unsubscribe link, and we'll honor opt-outs promptly. We don't use Customer Data to train AI models or for advertising, and we don't sell or “share” personal information for cross-context behavioral advertising.

Legal bases (EEA/UK): performing our contract with you; our legitimate interests in securing and improving the Service; compliance with legal obligations; and consent where we ask for it.

5. Who we share it with

We use a small number of service providers (“subprocessors”), under contracts that limit their use of the data to providing services to us:

We'll update this list before adding a subprocessor that handles Customer Data, including any AI provider used for AI takeoff. We may also disclose information when required by law, to protect rights and safety, or in connection with a merger or sale of the business (subject to this policy).

6. How long we keep it

• Account and Customer Data: while your company's account is open. When an owner deletes the account, it's permanently erased after a 30-day grace period, and backups age out within 30 more days.
• Audit log: kept while the account is open and for one year after deletion as a security record, then erased.
• Sessions and security tokens: sessions expire after 14 days; reset links after 1–24 hours; rate-limit records after a day.
• Billing records: kept by Stripe and us as long as tax and accounting law requires.
• Removed users: deleted from the account when an administrator removes them; their past actions remain in the company's audit log.

7. Your rights and choices

Depending on where you live (including California, other US states with privacy laws, the EEA and the UK), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to not be discriminated against for using these rights.

• Company owners can export all data or delete the company account in Settings → Company data.
• Users can update their name and password and manage two-step verification in Settings → Security; administrators can correct or remove users.
• Anyone can email privacy@numerate.build. We'll verify the request, respond within the time the law requires (generally 30–45 days), and, for Customer Data, work with the relevant customer. You may use an authorized agent.

We don't sell personal information or use it for targeted advertising, so there's nothing to opt out of; we treat Global Privacy Control signals as an opt-out request anyway. EEA/UK residents may also complain to their data protection authority.

8. Security

Each customer's project data is kept in a separate database. Data is encrypted in transit (TLS) and at rest by our hosting provider. Passwords are stored as salted PBKDF2 hashes; session tokens are stored only as hashes. Access inside an account is controlled by roles and project scope, financial figures are withheld from roles that shouldn't see them, accounts lock after repeated failed sign-ins, two-step verification is available (and can be required), and security-relevant activity is recorded in a tamper-evident audit log. No system is perfectly secure; if we confirm a breach affecting your information we'll notify you as the law requires.

9. International transfers

Numerate is operated from and hosted in the United States. If you use it from elsewhere, your information is transferred to the US, where we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Children

Numerate is a business service for adults. It isn't directed to children, and we don't knowingly collect personal information from anyone under 18 (or under 13 for the purposes of the US Children's Online Privacy Protection Act). If you believe a child has provided us information, contact privacy@numerate.build and we'll delete it.

11. Cookies

We use only cookies that are strictly necessary to sign you in and protect the Service. See the Cookie Policy.

12. Changes to this policy

We'll post updates here and change the effective date. For material changes we'll notify account owners by email or in the app before they take effect.