Privacy Policy

1. What we collect

Account details: your email address, and your name and profile picture if you sign in with Google. Your workspace name and the company profile you enter (company name, phone, address).

Your content: plan sets and other files you upload, the text we extract from them, takeoff and estimate imports, bid packages, Plan Chat questions and answers, and anything else you create in your workspace.

People you invite: when you invite a subcontractor to bid, the email, contact name and company you enter, and what they send back (prices, notes, attachments, decline or withdrawal reasons). When someone opens or comments on a share link or an embedded viewer: the name and email a commenter gives us, and which sheets were viewed and when (shown in your activity log).

Clients you send proposals to: when you send a proposal or change order, the client’s name and email and anyone you copy. When the client views, asks a question, declines or picks options, we record it. When they sign, we record the signature (typed or drawn), their name and email, the time, their IP address and browser, and a fingerprint of the document, and put them in the audit trail on the signed PDF.

Punch lists and closeout: punch items with their photos, notes and history; the companies you add to a project (name, contact and email) and what they do on their link (when they open it, items they mark fixed or not theirs, after photos, documents they upload); items an owner or architect adds on a walk link, with the name and email they give us; and completion certificates, signed the same way as proposals. Location data is removed from photos before anyone with a link can see them.

Records we keep for security and the beta: when you accept an agreement we store the version, time, IP address and browser user agent. Our servers also keep standard logs (IP address, pages requested, errors) for running and protecting the service.

Billing: if you subscribe, our payment processor handles your card details. We never see or store your full card number; we keep the subscription status and plan.

2. How we use it

To run the product: process your plan sets, answer your questions, send the emails you ask us to send (sign-in links, bid invites, reminders, notifications), and bill paid plans. We email you right away when you’re @mentioned, and send one daily digest of other activity, which you can turn off from the link in any digest.

To keep it working and safe: troubleshooting, preventing abuse, backups, and enforcing our terms.

To improve it: we look at how features are used and at feedback you send. We don’t use your plan sets or bids to build products for anyone else.

3. AI features

Some features (sheet naming, Plan Chat, reading title blocks) send the relevant part of your content, such as extracted text or a title-block image, to an AI model provider to get a result. We send only what the request needs, and every AI result shows you where it came from. Nothing an AI suggests is saved to your data until you accept it.

4. Who we share it with

Service providers that run parts of EstiMates for us, only to provide the service: server hosting (Hostinger, United States), file storage and backups (Cloudflare R2), email delivery (Resend), payments (Stripe), sign-in with Google (Google, only if you choose it), and AI model providers (see section 3).

People you choose: subs you invite see the bid package, sheets and company profile you attach, and later only their own punch items and closeout requests. Anyone with a share link you create can see what the link covers. Members of your workspace see the workspace’s content.

The law: if we are legally required to, or to protect someone’s safety or our rights.

If Codemates is sold or merged, your information may transfer to the new owner under this policy.

5. Cookies

We use a cookie to keep you signed in, one to remember a guest commenter’s name and email, and one to remember a proposal client’s name and email for questions. Your light or dark theme choice is stored in your browser. We don’t use advertising or third-party tracking cookies.

For the offline punch walk, the app keeps the drawings you choose and any items and photos waiting to upload on your device. Signing out removes the saved drawings.

6. How long we keep it

We keep your content while your workspace exists. When you delete a plan set, import, bid package or attachment, its stored files are deleted too, and a daily job removes anything left behind. Deleted data can remain in our nightly database backups until those backups are removed.

Signed proposals, signed change orders, signed completion certificates and their audit trails are the record of an agreement between you and your client, so they can’t be edited or deleted while your workspace exists.

During the beta, test data may be reset or deleted; keep your own copies (see the Beta Tester Agreement).

7. Your choices

You can export your sheet index, counts and awards at any time. To get a copy of your information, correct it, or delete your account and workspace, email codemates@gmail.com and we’ll do it within 30 days.

Subcontractors invited through BidMates can email us to have their details removed; the general contractor who invited you keeps the bid you submitted to them, and the punch items and documents you sent them.

8. Security

Connections are encrypted (HTTPS). Files are stored privately and served only to people with access. Bid, share, proposal and punch links are long random tokens, and we store only a hash of them. No system is perfectly secure; if we learn of a breach that affects you, we’ll tell you.

9. Children

EstiMates is a business tool and isn’t meant for anyone under 16.

10. Changes and contact

If we change this policy we’ll update the version and date at the top, and tell you by email or in the app if the change is significant.

Questions or requests: codemates@gmail.com.