Privacy, explained clearly.

1. Introduction

Bossimating Inc. ("Bossimating," "we," "us," or "our") operates a cloud-based construction management platform designed for contractors and trade professionals. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use our website, applications, and services (collectively, the "Service").

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

2. Information We Collect

Account Information

When you register for an account, we collect your name, email address, and organization details (company name, address, and contact information). If you are invited to an organization, we collect the information necessary to provision your membership.

Project and Business Data

We store data you create within the Service, including estimates, invoices, contracts, change orders, project details, field posts, photos, daily logs, and client records. This data is owned by you and your organization.

Financial Information

Payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. We do not store credit card numbers, bank account details, or other sensitive financial credentials on our servers. We retain only transaction references, subscription status, and billing history necessary to manage your account.

Usage and Analytics Data

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, and general usage patterns. This data helps us improve the product and diagnose technical issues.

Device and Browser Information

We collect device type, operating system, browser type and version, IP address, and general location data (country/region level). For document approvals, we capture IP address and user agent as part of our audit trail.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, operate, and maintain the platform, including generating estimates, invoices, PDFs, and managing projects on your behalf.
• Billing and Payments: To process subscription payments, manage invoicing, and maintain accurate billing records.
• Communications: To send transactional emails (account confirmations, invoice notifications, approval requests), and occasional product updates. You may opt out of non-essential communications at any time.
• Product Improvement: To analyze usage patterns, identify areas for improvement, and develop new features.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, fraudulent activity, and terms-of-service violations.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including responding to lawful requests from public authorities.

4. Data Storage and Security

Your data is stored in cloud-hosted PostgreSQL databases managed by Supabase, with servers located in secure, SOC 2 compliant data centers. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher.

Authentication is managed by Clerk, an enterprise-grade identity provider that supports multi-factor authentication, session management, and organization-level access controls.

Payment data is processed and stored exclusively by Stripe, which maintains PCI-DSS Level 1 compliance, the highest level of certification in the payments industry.

While we implement industry-standard security measures, including role-based access control, audit logging, and encrypted connections, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable safeguards.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal information to third parties. We share data only with the following service providers, strictly for the purposes of operating the Service:

• Clerk — Authentication, identity management, and session handling.
• Stripe — Payment processing, subscription management, and invoicing.
• Resend — Transactional email delivery (account notifications, invoice emails, approval requests).
• Anthropic — AI-powered features (estimate generation, scope writing, field summaries). These features are opt-in only. Your data is not sent to AI services unless you explicitly use an AI-powered feature.

Each third-party provider is bound by their own privacy policies and data processing agreements. We require all providers to maintain appropriate security measures consistent with industry standards.

We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with legal obligations, protect our rights, or ensure the safety of our users.

6. Your Rights

Bossimating operates in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy legislation. Depending on your jurisdiction, you may have the following rights:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your personal information, subject to our legal and contractual obligations to retain certain records.
• Data Portability: You may request an export of your data in a commonly used, machine-readable format.
• Withdrawal of Consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our support team. We will respond to verified requests within 30 days.

7. Cookies

Bossimating uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The cookies we set are strictly necessary for the Service to function and cannot be disabled without affecting core functionality.

8. Data Retention

We retain your personal information and project data for as long as your account remains active and as needed to provide the Service. If you or your organization administrator closes your account, we will delete or anonymize your personal data within 90 days of account closure, unless we are required by law to retain certain records for a longer period.

Audit logs and approval records (which may contain IP addresses and timestamps) are retained for a minimum of seven years to support legal and compliance requirements common in the construction industry.

9. Children's Privacy

The Service is intended for use by businesses and professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a minor, we will take steps to delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (sent to the address associated with your account) and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: