Topout Tech, LLC — Privacy Policy

What this means (plain English)

• We collect what it takes to run a construction-software platform: your name and email for sign-in, the project data your firm enters, and basic technical logs. That's it.
• We run no advertising pixels and we do not track you across other websites. Inside the apps we do measure how the Service is used — which pages you visit, what you click, and basic device and browser information — using a product-analytics tool (PostHog) so we can see where people get stuck and fix it. That includes a session replay: a reconstruction of what a page looked like as you used it. Anything you type is hidden before it leaves your browser and is never recorded. We use this only to improve the products, and we never sell it. It sets no cookies — the only cookies are the ones that keep you signed in and make the apps work.
• We do not sell your personal information, and we don't share it for targeted advertising. On our public marketing site we count page views with a cookieless, aggregate service run by our hosting provider — no cookies, no cross-site tracking, no visitor profiles.
• Your firm's project data belongs to your firm. For that data we act as a processor on your firm's instructions; requests about it usually go through your firm.
• We use a short list of vendors to run the service (identity, database, hosting, email — see the Subprocessors page). We may also use anonymized, aggregated statistics that can't identify anyone.
• Firms enter contact details of people at other companies (like subcontractor contacts). If that's you, this policy covers you too, and you can contact us about your info.
• Demo workspaces are wiped automatically when they expire.
• Questions or requests: privacy@topout.build.

1. Who we are and what this covers

Topout Tech, LLC ("Topout," "we") is a Florida company based in Fort Lauderdale. This policy covers personal information handled through topout.build and its subdomains and our products Closeout Compass, SubGrade, and the Topout dashboard (the "Service").

Two roles. For most product data, your firm (or the firm that invited you) decides what goes into the Service; for that "Customer Data" we act as a service provider / processor and handle it only on the firm's instructions. For account sign-in data, demo requests, and our own websites, we act as the business / controller.

2. Information we collect

We collect only the following. We do not collect payment card data (we have no online payments today), precise geolocation, or biometric data, and we run no advertising trackers.

You provide:

• Account and profile — name and email address (processed by our identity provider, Clerk, for passwordless sign-in; we never see or store passwords), plus the profile details you enter once on the dashboard (name, and phone if you provide it).
• Demo and contact requests — name, company, job title, email, phone number.
• Customer Data — what you or your firm put into the apps: projects, closeout checklists and submitted documents, warranty records, subcontractor evaluations and comments, and company/contact records. This can include personal information about people who don't use the Service (see Section 3).

Collected automatically:

• Log and device data — IP address, browser type, pages requested, timestamps, and error logs, generated by our hosting and identity providers in the ordinary course.
• Product analytics and session replay (in-app, cookieless) — how the Service is used: pages visited, clicks and other interactions, device, browser and screen information, your account identifier and email address, and which firm you are working in. This is processed by PostHog Inc., our product-analytics provider (see the Subprocessors page), on US-based infrastructure. It includes a session replay — a reconstruction of the pages as they appeared to you, used to see where the product is confusing or broken. Everything you type into a form is masked in your browser before anything is sent, so the contents of what you type are never recorded or available to us. No cookies and no cross-site tracking are involved, and this data is used only to operate and improve the Service. It is never sold and never used for advertising.
• Marketing-site analytics (cookieless) — aggregate page-view and performance statistics for our public marketing pages, measured by our hosting provider (Vercel Web Analytics) without cookies or persistent identifiers; no visitor profile is created and nothing follows you across other sites.
• Cookies — only those necessary for the Service to function:

No advertising, analytics, or cross-site tracking cookies are used. Because we use only essential cookies, there is no cookie banner: this table is the cookie disclosure, published in expanded form as our Cookie Policy.

Do Not Track and privacy signals: we do not track anyone across other websites and do not let third parties do so on ours. Our in-app analytics measure only your use of our own Service and set no cookies. The Service does not currently change its behavior in response to a browser "Do Not Track" or Global Privacy Control signal. We do not sell or share personal information with or without a signal.

From integrations you direct: if your firm connects Procore, we import the records you choose (for example, vendor companies and their contacts) on your instruction. We do not store your Procore credentials; the temporary access token lives in the encrypted cookie above.

3. People who don't use the Service

Firms enter information about third parties: subcontractor company contacts (name, role, work email, work phone) and evaluations that may mention individuals in a professional capacity. The firm that enters this information is responsible for having the right to do so (see our Acceptable Use Policy). If your information appears in a firm's workspace and you have questions, contact us at privacy@topout.build and we will respond and, where the data belongs to a customer's workspace, route the request to that firm.

4. How we use information

• Provide, operate, secure, and support the Service (including sending transactional email such as invites, reminders, and demo links).
• Understand and improve product usage — we analyze how firms and demo prospects use the Service, both from records we already hold (sign-in recency, counts of actions like projects created or documents submitted) and from the product-analytics and session-replay data described in Section 2, to operate, support, and improve it and to follow up on demo trials. We add no advertising or cross-site tracking of any kind, and none of it uses cookies.
• Respond to demo requests and communicate with you about the Service.
• AI features: when your firm uses an AI feature (for example, scanning an uploaded specification to suggest checklist items), the content you submit for that feature is processed by our AI provider listed on the Subprocessors page to return results to you. AI features assist and suggest under human review: they make no automated decisions with legal or similarly significant effects about any person, and they are not used to process sensitive personal information.
• Create aggregated / de-identified data (statistics and benchmarks that do not identify your firm or any person). We commit not to re-identify de-identified data and to require the same of anyone we share it with.
• Comply with law, enforce our terms, and protect the Service and its users.

We do not use Customer Data to train generalized AI models (product improvement around AI features uses aggregated accept/dismiss patterns, never the text of your documents), do not sell personal information, and do not use personal information for cross-context behavioral (targeted) advertising.

5. How we share information

• Service providers (subprocessors) — the short list of vendors that run the platform (identity, database/storage, hosting, email delivery, product analytics, and, when live, AI processing), under contracts limiting their use of data: see the Subprocessors page.
• Within your firm and projects — the Service shows data to the people your firm's configuration allows (for example, project members see project records). SubGrade evaluations are visible only within the firm that submitted them.
• Legal and protective — if required by law, subpoena, or to protect the rights, safety, or property of Topout, our users, or the public.
• Business transfers — in a merger, acquisition, financing, or sale of assets, with notice as required by law.

We have never sold or shared (as those terms are defined in US state privacy laws) personal information, and we do not do so.

6. Retention

• Account data — kept while your account is active, deleted or de-identified after account closure.
• Customer Data — kept while the firm's subscription is active; after it ends, exportable for 30 days and then deleted from production in the ordinary course (backups age out on a rolling basis).
• Demo workspaces — deleted automatically at expiry (about 14 days), including uploaded files; a nightly job permanently removes expired demo firms.
• Demo request / lead records — kept up to 24 months after last contact.

7. Your privacy rights (US state laws)

Depending on your state, you may have rights to access/know, correct, delete, port, and to opt out of sale, sharing, or targeted advertising (not applicable — we do none of those), and to non-discrimination for exercising rights, with an appeal process in some states.

To exercise rights, email privacy@topout.build from the email tied to your account (or with enough information for us to verify you). Authorized agents may submit requests where state law allows; we will verify identity (using reasonable measures proportionate to the request) and respond within the timeline the applicable law requires — as a default, we acknowledge requests within 10 business days and respond within 45 days, extendable where law allows with notice to you. If your request concerns Customer Data controlled by a firm, we will refer it to that firm and assist them.

California: in the last 12 months we collected the categories in Section 2 (identifiers; professional information; internet/network activity from logs; and any personal information contained in Customer Data your firm submits), for the purposes in Section 4, disclosed to the service providers in Section 5, and sold or shared none. We do not use or disclose sensitive personal information beyond what's needed to provide the Service.

Florida: we operate from Florida and honor the rights above for Florida residents.

Outside the US: the Service is intended for US users and hosted in the United States (primary data region: AWS us-east-1). We do not currently target the EU/UK; if that changes, this policy and our practices will be updated for GDPR before launch there. Using the Service from outside the US means your information is processed in the US.

8. Security

Server-side authorization on every request, passwordless sign-in (no password database to breach), encryption in transit, encryption at rest by our infrastructure providers, access limited to server-side code, and automatic wipe of expired demo data. Details: Security Overview. No system is 100% secure; we can't guarantee absolute security.

9. Children

The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect information from them.

10. Changes to this policy

We'll post updates here with a new version and effective date, and for material changes we'll notify you through the Service or by email.

11. Contact

Topout Tech, LLC — Fort Lauderdale, Florida Email: privacy@topout.build