Vibe Construction Suite Privacy Policy

This Policy applies to information we process when you visit our websites, create or use an account, use any application within the Vibe Construction Suite, communicate with our support or sales teams, or otherwise interact with the Services.

This Policy does not apply to third-party websites, applications, or services that are not operated by us, even where those services are linked from, integrated with, or accessed through the Services. Your use of any third-party service is governed by that party's own privacy policy.

The Services are designed for use by construction businesses. Where a company subscribes to the Services and its personnel use the Services under that company's account, the company is the controller of the project, takeoff, estimating, and other business content submitted through the Services ("Customer Data"), and we process that Customer Data on the company's behalf and in accordance with the Terms of Service.

We act as the controller of the information we collect to operate, secure, bill for, and improve the Services, including registration details, contact information, subscription and licensing records, session and device information, support communications, and usage telemetry ("Account Data").

Company administrators and owners may be able to view, export, modify, restrict, or delete information associated with users in their company account, including project records, activity history, session records, and application assignments.

We collect the following categories of information:

Information you provide to us.

• Account and profile information, such as name, email address, telephone number, job title, avatar, time zone, and locale.
• Company information, such as company name, address, industry, company size, website, logo, and business contact details.
• Authentication information, such as passwords (stored only in hashed form by our authentication provider) or identifiers supplied by a third-party sign-in provider you choose to use.
• Subscription, licensing, and seat assignment information, including the applications assigned to each user.
• Customer Data you or your company submit through the Services, including project names, job numbers, customer names, job site addresses, estimator assignments, takeoff and estimating content, uploaded files, drawings, images, and related documents.
• Application content created in the individual applications of the Vibe Construction Suite, including Insulation Takeoff Pro data, Mechanical Takeoff Pro data, Plumbing Takeoff Pro data, Bid Tracker Pro data, and Running Total Pro data, together with requests for quotation (RFQs), bid and pricing entries, running totals, notes, and the reports, summaries, and exports generated from that content. This content is Customer Data and remains owned by you or your company as described in this Policy and in the Terms of Service.
• Support, feedback, and debug reports, including the subject, description, reproduction steps, attachments, and diagnostic details you choose to include.
• Legal acceptance records, including the document accepted, its version, the acceptance timestamp, and the authentication method used.
• Photographs and images you capture or upload through the Services, including job site photographs attached to projects, takeoffs, reports, and debug reports. Where you take a photograph inside a mobile application, the application requests camera access from your device at that moment, and the camera is used only to capture the image you are adding.
• Files you upload to the Services, including drawings, plans, spreadsheets, PDFs, and other project documents, which are stored in our cloud storage on behalf of your company.
• Job site and project addresses you enter, and address suggestions returned by our address-lookup provider when you use an address field.
• Device location, only where you explicitly use a location-based feature of a mobile application (for example, attaching your current location to a job site or centering a map). The application requests location permission from your device at that time, and location is not collected in the background or when the feature is not in use.

Information collected automatically.

• Device and browser information, such as browser name and version, operating system, device type, screen size, and user agent string.
• Mobile application information where you use a Vibe Construction Suite mobile application, such as application version, build number, platform and operating system version, device model, and language settings, used to deliver the application, support offline behavior, and diagnose faults. We do not use advertising identifiers and we do not operate advertising or cross-app tracking technologies.
• Session information, such as login time, last activity time, session status, and IP address.
• Usage information, such as pages and features accessed, applications launched, projects opened, and actions recorded in activity and audit logs.
• Technical and diagnostic information, such as error messages, console errors, performance data, and request logs.
• Cookies and similar technologies as described in the Cookies section of this Policy.

Information from third parties.

• Identity information from a third-party sign-in provider when you choose to authenticate using that provider, limited to the profile fields that provider shares with us.
• Address and place details returned by mapping or address-lookup providers when you use an address field within the Services.
• Billing and payment status information from our payment processor. We do not receive or store complete payment card numbers.
• Information provided by a company administrator who invites you to join a company account.

Native mobile application: device unlock, secure storage, and offline data.

• Biometric unlock. Where your device supports it, a Vibe Construction Suite native application may allow you to unlock the application using Face ID, Touch ID, a fingerprint, or an equivalent device biometric or passcode method. The biometric comparison is performed entirely by your device's operating system. We do not receive, collect, store, or transmit your biometric template, facial scan, fingerprint data, or any similar biometric identifier, and no biometric data is placed into our cloud services or database. The application receives only the success or failure result reported by the operating system, which is used solely to unlock the local application experience.
• Secure device storage. The native application may store a limited set of authentication and session credentials, such as session tokens, in operating-system-protected secure storage (for example the platform keychain or keystore) so that you can remain signed in and use device unlock. This storage is specific to that device, and we do not store your raw password in ordinary device storage.
• Offline Field Mode. The native application may temporarily store construction and project data on your device so that you can keep working without connectivity. This may include project information, takeoff entries, notes, photographs and files required for offline use, and changes you create or edit locally that are queued for synchronization. This device-local data is used to provide offline functionality and synchronization, and locally created or edited content may synchronize to our cloud service when connectivity is restored.

We use the information described above to:

• Provide, operate, maintain, and deliver the Services and the applications you or your company are licensed to use.
• Create and administer accounts, companies, invitations, roles, permissions, seats, and application access.
• Authenticate users, maintain sessions, and enable single sign-on between the Hub and Suite applications.
• Process free trials, subscriptions, licensing, renewals, cancellations, invoices, and payments.
• Store, index, synchronize, and display project records across Suite applications.
• Send transactional and service communications, including verification, invitations, notifications, receipts, security alerts, maintenance notices, and release announcements.
• Provide customer support and respond to debug reports, feedback, and inquiries.
• Monitor, secure, and troubleshoot the Services, detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms of Service.
• Analyze usage in order to maintain reliability, diagnose defects, and improve the performance, quality, and features of the Services.
• Comply with legal obligations, establish or defend legal claims, and maintain records required by law.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not use Customer Data to train publicly available generative artificial intelligence models.

Where required by applicable law, we process personal information on the following legal bases: performance of a contract with you or your company; our legitimate interests in operating, securing, supporting, and improving the Services; compliance with legal obligations; and, where applicable, your consent. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Certain features of the Services may use artificial intelligence or machine learning to assist with tasks such as document interpretation, measurement assistance, summarization, or content generation. Where you use such a feature, the content you submit to that feature is transmitted to the applicable model provider solely to generate a response for you.

Outputs generated by artificial intelligence features are provided for convenience and may be incomplete or inaccurate. You remain responsible for verifying all outputs before relying on them.

We use cookies, local storage, session storage, and similar technologies that are strictly necessary to operate the Services. These technologies maintain your authenticated session, remember your active company, preserve your interface preferences such as light or dark mode, and protect against fraudulent or unauthorized activity.

We may also use limited analytics and diagnostic technologies to understand aggregate usage and detect errors. You can control cookies through your browser settings, but disabling strictly necessary cookies or storage will prevent the Services from functioning correctly.

We disclose information only as described in this Policy:

• Within your company account. Information associated with your use of the Services, including projects, activity, seats, and sessions, may be visible to owners, administrators, and other authorized members of your company account.
• Service providers. We use vendors who process information on our behalf and under contract, including cloud hosting and database providers, authentication providers, email delivery providers, payment processors, address-lookup providers, and analytics or error-monitoring providers.
• Named service providers. The Services currently rely on: Supabase and Lovable Cloud for cloud infrastructure, database hosting, authentication, and file storage; Stripe for subscription billing and payment processing (Stripe processes payment card details directly — we do not receive or store complete card numbers); Google for Google sign-in and for Google Places and Maps address lookup used in project and job site address fields; Apple for Sign in with Apple; Resend for transactional and authentication email such as invitations, verification, and password reset; Lovable error and debug reporting for application fault diagnosis; and Lovable AI for the optional artificial intelligence features described in this Policy. We do not use advertising networks or third-party marketing analytics.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
• Legal and safety. We may disclose information where we believe in good faith that disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of the Company, our users, or the public.
• With your direction. We disclose information to third parties when you or your company instruct us to do so, including through integrations you enable.

We retain information for as long as necessary to provide the Services, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements.

Customer Data is retained for the duration of the applicable subscription and for a reasonable period afterward to permit export or reactivation, after which it may be deleted or anonymized. Certain records, including legal acceptance records, audit logs, billing records, and security logs, are retained as required for compliance and integrity purposes and are maintained as append-only records that are not modified after creation.

Account deletion by an individual user.

You may delete your account at any time from Account & Security inside the Hub, or by requesting deletion at hub.vibeconstructionsuite.com/account-deletion. When an individual account is deleted, we delete that person's authentication account and all linked sign-in identities (email/password, Google, and Apple), their Hub profile, their company membership, role, permissions, seat and application assignments, their active sessions, their notification preferences, and any pending invitations addressed to them.

Company-owned records are not deleted when an employee leaves.

Vibe Construction Suite is a business platform, and project and business records created inside a company account belong to that company rather than to the individual employee who entered them. Deleting an individual account does not delete company-owned projects, takeoffs, job records, RFQs, Bid Tracker data, Running Total data, photographs, uploaded project files, activity history, audit logs, licensing records, or billing and invoice records. Those records remain available to the company and are retained under the company's own obligations and the Data Retention & Account Deletion Policy, which provides a ninety (90) day availability window after a subscription or free trial ends, after which Customer Data may be permanently deleted. Where a departed employee is referenced in company history, the reference is detached from the deleted account.

Sole owner: closing the company and deleting your account.

If you are the last remaining Owner of a company account, the account deletion screen offers a separate destructive option, "Close Company & Delete My Account," which requires an explicit typed confirmation. That workflow cancels the company's recurring subscriptions with our payment processor, closes the company account, deletes the operational company data included in the deletion request — including projects, takeoffs, job records, RFQs, Bid Tracker and Running Total content, notes, photographs, and uploaded project files — and permanently deletes your personal Vibe account and sign-in identities. You may also contact admin@vibeconstructionsuite.com if you prefer assisted closure.

We retain a limited set of records where retention is required or permitted for legal, tax, accounting, fraud-prevention, or security purposes — including invoices and payment records, legal acceptance records, audit entries, and security logs. These records are retained after closure as disclosed in this Policy and in the Data Retention & Account Deletion Policy.

We implement administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit, access controls, row-level authorization rules, role-based permissions, session monitoring, and audit logging.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activity occurring under your account. Notify us immediately at admin@vibeconstructionsuite.com if you believe your account has been compromised.

Depending on your location, you may have the right to request access to the personal information we hold about you, request correction of inaccurate information, request deletion, object to or request restriction of certain processing, request a portable copy of your information, and withdraw consent where processing is based on consent.

You may update much of your profile information directly within the Services. To exercise other rights, contact us at admin@vibeconstructionsuite.com. We will respond within the time required by applicable law. Where you are a member of a company account, we may direct your request to your company administrator, who controls the relevant Customer Data.

You will not be discriminated against for exercising any privacy right. You may opt out of non-essential marketing communications at any time using the unsubscribe link in those messages; you cannot opt out of transactional and service communications required to operate your account.

The Services are operated from the United States, and information may be processed and stored in the United States or in other countries where we or our service providers operate. Where required, we rely on appropriate safeguards, including standard contractual clauses, for transfers of personal information out of the jurisdiction in which it was collected.

The Services are business tools intended for use by adults in a commercial setting. The Services are not directed to children under the age of eighteen, and we do not knowingly collect personal information from children. If we learn that we have collected such information, we will delete it promptly.

The Services may contain links to, or integrations with, third-party websites and services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party service before providing information to it.

We may revise this Policy from time to time. When we make material changes, we will publish the revised Policy with an updated version number and Last Updated date, and, where appropriate, provide additional notice through the Services or by email.

Each published version of this Policy is retained as a distinct, versioned document. Your continued use of the Services after a revision takes effect constitutes acknowledgment of the revised Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of personal information, contact us at:

• Vibe Supply Products LLC
• Vibe Construction Suite
• Email: admin@vibeconstructionsuite.com