Your Data Stays Yours

What This Means for Your Business

As a contractor, your data is your competitive edge. Your customer lists, pricing strategies, project history, and measurement data took years to build. We understand that completely.

Google User Data (Connected Email & Calendar)

If you choose to connect your Google account to TruTec (to send proposals, quotes, and follow-ups from your own email address, or to use calendar features), here is exactly how we handle the Google user data you authorize:

• What we access: With your permission, TruTec uses the Gmail send capability to send emails you compose or schedule in TruTec from your address, and Google Calendar access to create and manage events for your jobs. We request your basic profile (name and email address) to identify the connected account.
• Reply detection (read access): If you use automated follow-up sequences, TruTec checks your mailbox for one thing only: whether a customer has replied to a message TruTec sent, so your follow-ups stop automatically. We look for messages from that customer's address after the send date. We do not display your inbox in TruTec, and we do not store, index, mine, or share the contents of your email.
• What we do NOT do: We never use your email content for advertising or model training, never sell it, and never read mail unrelated to stopping your own follow-up sequences.
• How we use it: Google user data is used only to provide the features you asked for — sending your emails and managing your calendar events from within TruTec. We do not use Google user data for advertising, and we do not sell it or share it with third parties.
• What we store: We store the secure authorization tokens Google issues (encrypted at rest), delivery records of emails sent through TruTec (recipient, subject, and message content you wrote) so your sent messages appear in your job history, and a simple yes/no result when reply detection runs — never the reply itself.
• Human access: No human at TruTec reads your Google user data except with your explicit permission (for example, when you ask support to troubleshoot a delivery), when required for security, or to comply with applicable law.
• Disconnecting: You can disconnect your Google account at any time in Settings → Email Accounts (or from your Google Account security page), which revokes TruTec's access. You may also request deletion of stored tokens and delivery records by contacting support.

TruTec's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data We Collect

We only collect what's necessary to provide our services:

• Account Information: Your name, email, company name, and contact details to create and manage your account
• Project Data: Measurements, customer information, proposals, and project details you enter — this stays exclusively yours
• Usage Data: How you interact with TruTec to improve the product (never tied to your customer data)
• Technical Data: Browser type, device info, and IP address for security and troubleshooting

AI & Machine Learning

We do not train AI models on your business data. Your customer lists, contact information, pricing, estimates, proposals, financial records, and documents are never used to train machine-learning models — ours or anyone else's.

• Measurement & detection models: Our takeoff models learn from aerial and blueprint imagery paired with geometric annotations (outlines of pavement, striping, and similar site features). This training data contains no customer, pricing, or personal information.
• Connected accounts: Data from services you connect (email, calendar, integrations) is never used for model training of any kind.
• Third parties: We do not share your data with third parties for AI training, and our service providers are contractually barred from using your data to train their models.

How We Protect Your Data

Security is foundational to everything we build:

Where we are on compliance: TruTec is actively pursuing SOC 2 Type II certification and builds to its control framework today — encryption in transit and at rest, least-privilege access, audit logging, and vendor review. We are not yet SOC 2 certified; we'll update this page and notify customers when the examination is complete. If your security team needs details in the meantime, contact us and we'll walk through our current controls directly.

Your Rights & Control

You have complete control over your data:

• Export anytime: Download all your data in standard formats whenever you want
• Delete on request: Request complete deletion of your account and all associated data
• Access your data: View exactly what information we have about you
• Correct inaccuracies: Update or fix any incorrect information
• Restrict processing: Limit how we use your data

Connected Integrations

If you choose to connect a third-party service such as Jobber, TruTec sends and receives only the customer, property, quote, job, invoice, and status data needed to provide the synchronization you requested. The connected provider processes that data under its own terms and privacy policy.

• Your choice: A workspace owner must authorize the connection, and you can disconnect it from Settings at any time.
• Limited purpose: We use connected-service data only to run the features you enabled, not for advertising or sale.
• Security: Authorization credentials are encrypted at rest and incoming provider events are authenticated before processing.
• Disconnecting: Disconnecting revokes future access where the provider supports revocation and removes TruTec's stored authorization credentials. Previously synchronized business records remain in each system unless you delete them there.

Operational Service Providers

We use carefully vetted service providers to operate TruTec. These providers:

• Are contractually bound to protect your data
• Cannot use your data for their own purposes
• Meet our strict security requirements
• Only access what's necessary to provide their specific service

Examples include payment processing (Stripe), cloud hosting (AWS), and email delivery. User-connected integrations are covered above and operate under their own terms. Each provider receives only the information needed for the service you asked us to perform.

Changes to This Policy

If we make significant changes to this privacy policy, we'll notify you via email and display a prominent notice in the app. We'll never reduce your protections without clear communication and, where required, your consent.