Your Data Stays Yours

What This Means for Your Business

As a contractor, your data is your competitive edge. Your customer lists, pricing strategies, project history, and measurement data took years to build. We understand that completely.

Google User Data (Connected Email, Calendar & Drive)

If you choose to connect your Google account to TruTec (to send proposals, quotes, and follow-ups from your own email address, or to use calendar features), here is exactly how we handle the Google user data you authorize:

• Account connection: We request your basic profile (name and email address) to identify the connected account. We store the account identity, granted permissions and connection status, along with the authorization tokens Google issues, encrypted at rest.
• Sending email: With your permission, TruTec sends messages you compose or schedule from your connected Google account. We store delivery details and the business history created by the feature you use.
• Customer message activity: When inbox access is enabled, TruTec searches for messages from customer addresses you have emailed through TruTec, received after the relevant send time. We read message identifiers, threading headers, sender, subject, time and a short preview to associate messages with job/contact activity and stop applicable follow-ups. Matching uses thread information when available and can fall back to sender and send time. This feature does not show a general inbox or retrieve email attachments or complete message bodies, and TruTec never changes or deletes your email.
• Stored reply history: The related job and contact/company history can contain the sender, subject, time, message/thread identifiers and a preview of up to 500 characters. Authorized workspace users who can view that business history can see these records.
• Service providers: Our operational service providers process data needed to run the service. When connection analytics is enabled, connection events sent to our analytics provider include the connected email address, provider and workspace/user identifiers. These events are separate from stored email previews.
• Calendar: When you turn on direct schedule sync, TruTec creates a separate TruTec Schedule calendar and synchronizes the work visible to you. Events can include the work title, dates, location and job details/notes. Changes to tracked events can update the corresponding work order and its history. TruTec only reads and changes the TruTec Schedule calendar it created; it does not use your personal calendar or any other calendar. A separately connected booking provider may have its own calendar permissions.
• Google Drive: If you connect Google Drive for job files, TruTec creates a TruTec Jobs folder and saves job documents into it. TruTec can only see the files and folders it created; it cannot see anything else in your Drive.
• Use restrictions: We use Google user data only to provide the connected-account features described above. We do not use it for advertising, we never sell it, and we do not use it to develop, improve or train generalized artificial intelligence or machine-learning models.
• Human access: No human at TruTec reads your Google user data except with your explicit permission (for example, when you ask support to troubleshoot a delivery), when required for security, or to comply with applicable law.
• Disconnecting and retention: Disconnecting in Settings → Email Accounts removes TruTec's stored access and refresh tokens and stops future connected-account operations; TruTec also attempts to revoke Google's authorization and remove its dedicated schedule calendar. Provider errors may prevent remote calendar removal. Delivery records and filed job/contact communication history remain after disconnect; they do not automatically expire after the reply-search window. Deleting a job can leave its company/contact communication history. Contact support to request deletion of retained records.

TruTec's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data We Collect

We only collect what's necessary to provide our services:

• Account Information: Your name, email, company name, and contact details to create and manage your account
• Project Data: Measurements, customer information, proposals, and project details you enter. This stays exclusively yours
• Usage Data: How you interact with TruTec to improve the product (never tied to your customer data)
• Technical Data: Browser type, device info, and IP address for security and troubleshooting
• Optional message notifications: If you turn on mobile message notifications, we store your notification preference, an app installation identifier and a delivery token linked to your signed-in account and workspace. Delivery tokens are encrypted at rest. Apple Push Notification service or Google Firebase Cloud Messaging processes the token and routing identifiers to deliver a generic new-message alert; notification previews do not include message text, customer names or job details. You can turn notifications off in your personal settings. Signing out revokes that installation's active notification binding, and opening a notification requires a valid signed-in session.

AI & Machine Learning

We do not train AI models on your business data. Your customer lists, contact information, pricing, estimates, proposals, financial records, and documents are never used to train machine-learning models, ours or anyone else's.

• Measurement & detection models: Our takeoff models learn from aerial and blueprint imagery paired with geometric annotations (outlines of pavement, striping, and similar site features). This training data contains no customer, pricing, or personal information.
• Connected accounts: Data from services you connect (email, calendar, integrations) is never used for model training of any kind.
• Third parties: We do not share your data with third parties for AI training, and our service providers are contractually barred from using your data to train their models.

How We Protect Your Data

Security is foundational to everything we build:

Where we are on compliance: TruTec is actively pursuing SOC 2 Type II certification and builds to its control framework today, encryption in transit and at rest, least-privilege access, audit logging, and vendor review. We are not yet SOC 2 certified; we'll update this page and notify customers when the examination is complete. If your security team needs details in the meantime, contact us and we'll walk through our current controls directly.

Your Rights & Control

You have complete control over your data:

• Export anytime: Download all your data in standard formats whenever you want
• Delete on request: Request complete deletion of your account and all associated data
• Access your data: View exactly what information we have about you
• Correct inaccuracies: Update or fix any incorrect information
• Restrict processing: Limit how we use your data

How Long We Keep Data

• Your account and workspace data (customers, jobs, measurements, estimates, proposals, photos and files): kept while your account is open, and after you cancel so you can come back to it. Ask us to delete it and we remove it within 30 days.
• Backups: Deleted data can stay in our encrypted database backups for up to 14 days, then it is gone.
• Security and activity logs: kept for 12 months, then deleted.
• Connected apps and API keys: access lasts until you disconnect the app or revoke the key under Settings › API keys.
• Connected email, calendar and Drive: as described in the Google User Data section above.
• Billing records: kept by us and our payment processor (Stripe) as long as tax and accounting law requires.

Connected Integrations

If you choose to connect a third-party service such as Jobber, TruTec sends and receives only the customer, property, quote, job, invoice, and status data needed to provide the synchronization you requested. The connected provider processes that data under its own terms and privacy policy.

• Your choice: A workspace owner must authorize the connection, and you can disconnect it from Settings at any time.
• Limited purpose: We use connected-service data only to run the features you enabled, not for advertising or sale.
• Security: Authorization credentials are encrypted at rest and incoming provider events are authenticated before processing.
• Disconnecting: Disconnecting revokes future access where the provider supports revocation and removes TruTec's stored authorization credentials. Previously synchronized business records remain in each system unless you delete them there.

AI assistants (ChatGPT, Claude): A workspace owner can connect an AI assistant to TruTec. When you ask it something, it reads the workspace records it needs (customers, jobs, estimates, schedule, takeoffs) and, only if the owner allowed changes, creates or updates records. What it reads is sent to that assistant's provider (OpenAI or Anthropic) and handled under their privacy policy. Disconnect it any time under Settings › API keys.

Operational Service Providers

We use carefully vetted service providers to operate TruTec. These providers:

• Are contractually bound to protect your data
• Cannot use your data for their own purposes
• Meet our strict security requirements
• Only access what's necessary to provide their specific service

Examples include payment processing (Stripe), cloud hosting (AWS), email delivery, aerial imagery, and AI model providers that power features such as takeoff details and document reading. User-connected integrations are covered above and operate under their own terms. Each provider receives only the information needed for the service you asked us to perform.

Changes to This Policy

If we make significant changes to this privacy policy, we'll notify you via email and display a prominent notice in the app. We'll never reduce your protections without clear communication and, where required, your consent.