Privacy Policy

1. Who we are and what this covers

Grudar, LLC ("Grudar", "we", "us") runs the Grudar website (grudar.com), web application (app.grudar.com) and scan service (together, the "Service"). This policy explains what information we collect, how we use and share it, and the choices you have. It applies to the Service and to grudar.com, including people who only visit grudar.com or join our waitlist. This policy covers grudar.com and Grudar for Architects, our scan product. It does not cover a version of Grudar that is not open yet, or people outside Grudar who open an e-signature or submittal link someone sent them. Our Terms of Service (grudar.com/terms/) use the same defined words.

Grudar is a business service. Two kinds of information are involved:

• Account information — about the people and companies who use Grudar (names, emails, billing details, usage), and about visitors to grudar.com. We decide how this is used, as described here.
• Customer Content — the documents, drawings, photos and other material a customer uploads, and the reports and assistant conversations made from it. We process Customer Content on the customer's behalf, to provide the Service to that customer. The customer controls it.

2. Information we collect

You give us:

• Account and contact details: your name, email address, password (stored by our authentication provider, never by us in readable form), company name, company type, and optional company phone and address.
• Billing details: when you buy scan credit, you enter your card details on our payment processor Stripe's own page. We never see or store your full card number. We keep a Stripe customer reference and a record of each purchase (amount, date, what was bought).
• Customer Content: construction documents, drawings, specifications and site photos you upload; project details you enter (such as the project name, site address and the owner's name); and what you type or say to the in-app assistant.
• Support messages you send us.
• "Coming soon" waitlist. If you try to sign up in the Grudar app for a version of Grudar that is not open yet, you can leave your email address. We collect that address, which version you are waiting for, the language of the app page (English or Spanish), any post tags that came with your visit, the date you first joined, the date you last submitted, and how many times you have submitted. We don't add your name or company to the list. Joining the waitlist does not create an account.

Collected automatically when you use the Service:

• Photo metadata. Photos taken on phones and cameras often carry hidden data. When you upload a photo, we read and store its GPS location, the time it was taken, and the camera model, so photos can be placed and dated on your project. The original photo file you upload is stored as-is, including that hidden data, unless it had to be rotated. If you don't want location stored, turn off location tagging on your camera before taking the photo. Your browser may also send your device's location when you upload, if you allow it.
• Voice. If you use voice with the assistant, your speech is streamed to our speech-to-text providers to be turned into text. We do not store the audio recording. We do store the resulting transcript, as part of your assistant conversation. In live voice, OpenAI hears your speech and produces the assistant's spoken replies.
• Usage and device data: the pages and features you use, scan and credit activity, and diagnostic and error information. Our servers log each request with the time, the address requested, the result, your user and company identifiers and your IP address; when a request fails, the log also includes your browser's request headers (such as its user-agent), but never your password or login tokens. This includes a waitlist submission, which is sent to our servers like any other request.
• Acceptance records: when you accept our Terms, we record who accepted, which version, when, and the IP address and browser user-agent used.
• Where you came from (post tags). Links we post (for example on social media, in an email or in an ad) can carry tags in the web address, such as utm_source=linkedin, that name the site, post or campaign the link came from. When you arrive on grudar.com with such tags, our site keeps the first set it sees in your browser's session storage (which your browser clears when you close the tab or window), and adds them to our links to the Grudar app. If you then create a new company account on Grudar, we save those tags, and the address of the first app page you opened (without anything after the "?"), on your company's record, so we know which posts bring us customers. If you join an existing company by invitation, nothing is saved. The tags name a post or campaign; they don't identify you. We don't use cookies for this.
• Cookies and browser storage. grudar.com sets no cookies; it uses session storage only for the post tags above. The app (app.grudar.com) uses your browser's local storage to keep you signed in and remember your settings. We use no cookies for analytics or advertising, we do not track you across other websites, and the app loads no analytics or advertising tools.

From public sources, during a scan:

• If a project has a site address or an owner name, a scan may search the web for public information about the property and the project — for example property and parcel records, year built, assessed value and recent listings or sales, zoning and permit records, county GIS pages, and public information about the project owner (for a company or public body: public profiles and funding announcements; for an individual: only whether they hold a registered business or contractor license). The search terms (which can include the site address and owner name) are sent to our web search provider, and our servers may open up to a few of the public web pages it finds. What is found is saved to the project, with its source links, and may appear in the report. We instruct the AI not to collect personal details about individuals beyond that, such as credit, criminal or social media information.

3. How we use information

We use information to:

• Provide the Service: run the scans you start, produce reports, answer your questions in the assistant, store your projects, and send you service emails (such as "your report is ready", which you can turn off, and sign-up and invitation emails).
• Process payments and credit, including holding a scan's price when it starts and releasing the hold automatically if the scan fails.
• Support you when you ask for help.
• Tell you when your version opens. If you join the waitlist, we use your email address only to send you a notice when the version of Grudar you are waiting for opens. We send nothing else to that address, and each notice tells you how to unsubscribe.
• Learn which posts work. We use post tags, added up across visitors and sign-ups, to see which posts and campaigns bring people to Grudar.
• Keep the Service secure: prevent fraud and abuse, scan uploads for viruses, and investigate problems.
• Run and improve the Service using information about how it operates (such as scan times, error rates, pages read and which kinds of findings users open, mark useful or dismiss), in a form that does not identify you, your projects or your clients and does not include the content of your documents or your prices. We will not try to re-identify it.
• Comply with law and enforce our Terms.

What we do not do:

• We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not sell, rent or share the waitlist.
• We do not use Customer Content to train, fine-tune or otherwise build AI models.
• We do not show or share one customer's documents, drawings, photos, reports or prices with another customer.
• We do not combine a Scan customer's prices with other customers' data.

If you are in the European Economic Area, the United Kingdom or Switzerland. Grudar is offered to businesses in the United States, but you may visit grudar.com from anywhere. Where those laws apply, we rely on: your consent for the waitlist (you can withdraw it at any time by unsubscribing; that does not affect what we did before); our legitimate interest in running and securing our website and learning which of our posts work, for post tags and server logs; and performance of our contract with you, and our legal obligations, for account, billing and acceptance records. You can object to processing based on legitimate interest by emailing support@grudar.com. You also have the rights described in section 9, and the right to complain to your local data-protection authority.

4. AI providers

Grudar's results are produced by AI models run by outside companies. To produce them, we send those companies the parts of your Customer Content needed for the task: document text and page images, drawings, photos (as uploaded, which can include their hidden metadata), project details, assistant messages and voice transcripts, and public information found during a scan. Our main AI provider is Anthropic. We also use Google (for photo analysis, text recognition in scanned documents, and as a backup model), OpenAI (for search indexing of your documents and conversations, voice transcription and live voice, and as a backup model), xAI (as a backup model) and Deepgram (speech-to-text). When our main provider is unavailable, the same request may be sent to a backup provider so your scan can finish. The full list, with what each receives, is on our Subprocessor List (grudar.com/subprocessors/).

Under their business terms, Anthropic and OpenAI do not use our API data to train their models, and keep it for a limited period (generally up to about 30 days) for abuse monitoring, unless the law requires longer. Google, xAI and Deepgram handle the data they receive under their own terms.

5. How we share information

We share information only:

• With our service providers (subprocessors), who host, process and deliver the Service for us. They process the information to provide their services to us, under their own terms. They are listed, with what each receives, on our Subprocessor List (grudar.com/subprocessors/). We update that list, with its date, when we add or replace one.
• Inside your company's account. People your company adds can see the projects they are given access to. Your company's account owner can read all assistant conversations in the company's account, including other users' conversations; other users see only their own.
• With people you choose to share with, such as when you download a report and send it to others.
• With search providers and public websites, during a scan, as described in section 2: the search terms go to our search provider, and our servers request public pages it finds.
• For legal reasons: to comply with law, a court order or other legal process; to protect the rights, safety or property of Grudar, our customers or others; or to enforce our Terms.
• In a business transfer: if we are involved in a merger, acquisition or sale of assets, subject to this policy's protections.
• With your consent or at your direction.

The waitlist and sign-up post tags are seen only by Grudar staff. They are not visible to customers, other visitors or the public.

Our staff. Grudar staff can access account information to run the business, and access Customer Content only when needed to provide support you ask for, look at a finding or photo your users flag to us for a second look, investigate a security, abuse or service problem, or comply with law.

6. How long we keep information

7. Security

We protect information with reasonable administrative, technical and physical safeguards suited to a business of our size, including: encryption in transit (HTTPS/TLS); storage with providers that encrypt data at rest; separation of each customer's data in our database by company, enforced in the database and in our application; role-based access within each customer account; virus scanning of uploads; and limited staff access. The waitlist can be read or changed only by our own servers, not through any customer or public access. No system is perfectly secure, and we cannot guarantee that information will never be accessed, used or disclosed without permission.

8. If there is a security breach

If we learn of a security breach affecting your information, we will notify affected customers without unreasonable delay, and notify regulators where the law requires (for example, North Carolina requires notice to affected people and to the State Attorney General).

9. Your choices and rights

• Access, correction, download and deletion. You can view and correct your account details in Settings, download a copy of your personal data from Settings, and delete files, photos, projects and assistant conversations yourself. To ask us to access, correct, export or delete other personal information, email support@grudar.com. We will verify your identity before acting and answer within 45 days.
• Your company controls Customer Content. If you use Grudar through your employer, your company's account owner and administrators control the account, and some requests may need to go through them.
• Emails. You can turn off "report ready" emails in Settings. To leave the waitlist at any time, email support@grudar.com and tell us the address, or use the unsubscribe instructions in any notice we send. We remove you promptly when you ask. Removal is done by a person, not automatically, so while we usually act right away, the promise we make is that your entry is deleted within 10 business days. We send no other marketing emails; if we ever do, every one will have an unsubscribe link.
• Post tags. Post tags are cleared when you close the grudar.com tab or window, and none are kept if you arrive without them.
• Closing your account. The account owner can close the company account in Settings (see section 6).
• State privacy rights. Depending on where you live, you may have additional rights under state law, such as the right to know, correct or delete personal information, and not to be discriminated against for using them. We honor requests where those laws apply, and we will not treat you differently for making one.

10. Do Not Track and Global Privacy Control

We do not track you across other websites and do not allow third parties to do so through the Service. So browser "Do Not Track" and Global Privacy Control signals do not change how the Service works.

11. Children

Grudar is for businesses and is not for anyone under 18. We do not knowingly collect information from children under 13. If we learn we have, we will delete it.

12. Where information is processed

Grudar is offered to businesses in the United States. Our database and files are hosted in the United States (Amazon Web Services, U.S. East region, through Supabase), and our servers run in the United States. Some providers on our Subprocessor List may process information in other countries, under their own terms. If you visit or use Grudar from outside the United States, your information is transferred to and processed in the United States.

13. Changes to this policy

We may update this policy. If a change is material, we will email your company's account owner and show a notice in the app at least 14 days before it takes effect, and the new policy will be presented for acknowledgment at your next sign-in. We will not apply a material change to the use of information we already hold without that notice. The effective date at the top shows when it last changed. Earlier versions are available on request.

14. Contact us

Grudar, LLC · 1858 Highway 11 55, Kinston, NC 28504
Privacy questions, requests and support: support@grudar.com