Privacy Policy

BuildRoutine is construction management software for general contractors, available at buildroutineai.com and in the BuildRoutine mobile app. It helps contractor teams send bid requests, level bids, take off quantities from drawings in the Plan Room, review subcontractor certificates of insurance, manage RFIs, submittals, schedules and budgets, and track NYC Department of Buildings permits. BuildRoutine is operated by Vantoral Logic Inc. ("BuildRoutine," "we," "us," or "our").

This Privacy Policy explains what information we collect when you visit our website or use the BuildRoutine web application and mobile app (together, the "Service"), how we use and share it, and the choices you have. Companies subscribe to the Service and invite their team members; if your company invited you, your company also controls much of the information in its workspace.

Information you give us

• Account information — your name, email address, sign-in method and password (passwords are handled by our authentication provider and are never visible to us), and your role in your company.
• Company and project information — your company name, project names and addresses, vendors and subcontractors and their contact details, bids, contract amounts, budgets, schedules, RFIs, submittals, tasks, notes and similar records your team enters.
• Uploaded files — drawings and plan sets, bid proposals, certificates of insurance, insurance policies and endorsements, W-9s, contracts and other documents you or your team upload, plus markups you make on them.
• Messages to us — what you send through our contact form or by email, such as your name, company and question.
• Email sender details — the sender name, signature and logo you set for emails sent from BuildRoutine.

Information from connected accounts

• Gmail — if you choose to connect a Gmail account, the data described in Section 6 (Google API Services).
• Microsoft Outlook — if you choose to connect Outlook, your Outlook address and name, and the ability to send mail and read and draft messages in that mailbox, used the same way as described for Gmail in Section 6.
• Payments — subscriptions are billed by our payment processor, Stripe. Your card details go directly to Stripe and are never stored on our servers. We keep the billing contact, Stripe customer and subscription references, and payment status for your company's subscription.

Information collected automatically

• Usage and device information — server logs that record requests to the Service, including IP address, browser or device type, pages and features used, and timestamps; and error reports the app sends to our own servers when something breaks.
• Cookies and local storage — see Section 9.
• Mobile app — the app uses your camera or files only when you choose to scan or upload something. Fingerprint or face unlock is handled entirely by your device; we never receive biometric data. Plans you open may be saved on your device so you can view them offline. If you allow notifications, we receive a device token used only to send you notifications.

Public information

For projects in New York City, we retrieve public permit, complaint and violation records from NYC Open Data and the NYC Department of Buildings and show them alongside your projects.

We use information to:

• Provide, operate and maintain the Service and the features you choose to use
• Create and secure your account and enforce your company's access settings
• Send the emails you ask the Service to send (for example, bid requests and insurance requests) and service emails such as daily recaps, alerts, sign-in and billing notices
• Process subscriptions, free trials and payments
• Respond to your questions and support requests
• Monitor, troubleshoot and improve the reliability and security of the Service
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information, we do not use it for advertising, and we do not share it with third parties for their own marketing.

Several features use artificial intelligence to read the documents and data you provide: drafting bid leveling sheets from bid proposals, reading drawings for Plan Room takeoff quantities, reviewing certificates of insurance, policies and broker replies against your project's insurance requirements, and drafting summaries and email text for you to review. To do this, the relevant document content and project data are sent to our AI service provider, which processes them only to return results to us.

AI results are a starting point. You decide what to send, approve or rely on; the AI does not send messages or approve insurance on its own. We do not use your content, or any data received from Google APIs, to train generalized AI or machine learning models.

We share information only as follows:

• Within your company — information in a company workspace is visible to the members of that company according to the access their administrators grant.
• With people you send to — when you send a bid request, RFI, insurance request or similar message, its contents and any attached files go to the recipients you choose, and a subcontractor portal link you share shows them the items you shared.
• With service providers who process data on our behalf to run the Service, under obligations to protect it and use it only for that purpose (see the list below).
• For legal reasons — if required by law, subpoena or court order, or to protect the rights, property or safety of our users, the public or us.
• Business transfers — if we are involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.

Our service providers, by category:

• Cloud hosting, database and file storage (Replit and its infrastructure providers)
• Sign-in and account authentication (Clerk)
• AI document processing (Anthropic)
• Payment processing and billing (Stripe)
• Transactional email delivery for service emails (Resend)
• Email providers you choose to connect (Google Gmail, Microsoft Outlook), which carry the messages you send
• Push notification delivery for the mobile app (Google Firebase Cloud Messaging)

Connecting Gmail is optional. If you connect a Gmail account, BuildRoutine asks Google for the following permissions, and uses each only for the purpose listed:

• https://mail.google.com/ — to send email from your own Gmail address when you press Send in BuildRoutine (bid requests, bid follow-ups, COI and insurance requests, submittal reminders and similar messages) (some sends go through Gmail's own mail server, which Google only allows with this permission).
• https://www.googleapis.com/auth/gmail.readonly — to read messages exchanged with the bidder, vendor and insurance broker addresses saved in your projects, so their replies and attachments appear in the Buyout Log, bid follow-ups and insurance review, and suggest Cc recipients from people you already email.
• https://www.googleapis.com/auth/userinfo.email — to identify which Gmail address you connected, so it can be shown in Settings and used as the sender.

Emails are sent only when you choose to send them in BuildRoutine. We read only messages to or from the bidder, vendor and broker addresses saved in your projects; we store those messages (sender, recipients, subject, date, body and attachments) so they appear in your workspace, and an insurance broker's reply may be sent to our AI service provider to check it against your insurance requirements (Section 4). Your Gmail access and refresh tokens are encrypted at rest (AES-256-GCM) and used only to make the calls above.

BuildRoutine's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Gmail data only to provide and improve the user-facing features described above that you chose to use.
• We transfer Gmail data to others only as needed to provide those features (such as our hosting and AI service providers acting on our behalf), to comply with applicable law, or as part of a merger or acquisition with your notice.
• We never sell Gmail data.
• We never use Gmail data to serve advertisements, including retargeting or personalized ads.
• We never use Gmail data to build user profiles for advertising or to determine credit-worthiness.
• We never use Gmail data to train generalized AI or machine learning models.
• No person at BuildRoutine reads your Gmail data unless you give us permission for specific messages (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with law, or the data has been aggregated and anonymized for internal operations.

You can disconnect Gmail at any time in BuildRoutine Settings, which deletes your stored tokens, or revoke access from your Google Account at myaccount.google.com/permissions. To have stored Gmail messages deleted as well, delete your account or email nate@buildroutineai.com.

We keep account information for as long as your account is active. Company and project information, uploaded files and stored email messages are kept while your company's subscription is active, or until they are deleted in the Service, so your team keeps its project history. Billing records are kept as long as tax and accounting laws require. Server logs are kept for a limited period for security and troubleshooting.

When your account or your company's workspace is deleted, we delete the related information from our active systems, except where we must keep it to meet legal obligations, resolve disputes or enforce our agreements. Copies in backups are removed as those backups are overwritten in the normal course.

We protect information with encryption in transit (HTTPS), encryption of email access tokens at rest, authenticated access to every request, and database-level separation of each company's data. Access within a company is limited by role. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please keep your sign-in details safe and report suspected security issues to nate@buildroutineai.com.

We use cookies and your browser's local storage that are necessary to keep you signed in, secure your session and remember your preferences.

On buildroutineai.com we also use Google Analytics to understand which pages people visit, and Google Ads conversion measurement to learn whether our ads lead to free-trial sign-ups. These Google services set their own cookies. We do not send them your name, email address or the contents of your workspace. You can block these cookies in your browser settings or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

• Access and correction — you can view and update most of your information in the Service, or ask us to do it.
• Delete your account — on the website or in the app, go to buildroutineai.com/delete-account and send the request while signed in, or email nate@buildroutineai.com from the address on your account. We will delete it within 30 days. Deleting your account removes your sign-in, profile, connected mailboxes and their tokens, sender details and notification settings, and your access to your company's workspace. Records you created inside your company's projects (such as documents, bids, tasks and markups) belong to your company and stay in its workspace; a company administrator can ask us to delete the whole company workspace.
• Disconnect integrations — disconnect Gmail or Outlook at any time in Settings.
• Email preferences — turn daily recaps and alerts on or off in Settings.
• Copies of your data — ask us for a copy of your information.

Depending on where you live (for example, California or the European Economic Area), you may have additional rights, such as to know what we collect, to obtain a portable copy, or to object to or restrict certain processing. We honor these requests as required by applicable law and will not discriminate against you for making one. To make a request, email nate@buildroutineai.com. We may need to verify your identity first. If your company manages your account, we may refer your request to your company administrator.

BuildRoutine is operated from the United States and our service providers process information in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

BuildRoutine is a business tool for construction professionals and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact nate@buildroutineai.com and we will delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page with a new effective date, and if the changes are significant we will notify account owners by email or in the Service before they take effect.

Questions or requests about this Privacy Policy or your information:

Vantoral Logic Inc.
1144 58th Street, Brooklyn, NY 11219
Email: nate@buildroutineai.com