Privacy Policy

1. What This Policy Covers

This Privacy Policy describes how Armorstack collects, uses, and shares information when you use ArmorDraft. It applies to all users, including those on free and paid plans.

2. Information We Collect

Information you provide directly

• Account information — name, email address, and organization name collected at sign-up via Clerk authentication.
• Project data — project names, addresses, jurisdiction, occupancy class, system types, and design parameters you enter.
• Drawings and files — PDFs and images you upload for AI-assisted takeoff. These are stored securely in Cloudflare R2.
• Estimate inputs — device counts, node types, labor rates, and pricing overrides you enter during estimation workflows.

Information collected automatically

• Usage data — pages visited, features used, error events, and performance metrics collected via Vercel Analytics and Sentry.
• Log data — IP address, browser type, and request timestamps logged by our API server on Fly.io.
• Audit events — all significant actions (sign-in, estimate runs, exports, ToS acceptance, design status changes) are recorded in an append-only tamper-evident audit log.

Information from third parties

• Clerk — authentication provider. Clerk may collect additional information per Clerk's Privacy Policy.
• Stripe — payment processor. Stripe handles payment card data; we never see or store full card numbers. See Stripe's Privacy Policy.

3. How We Use Your Information

• To provide, operate, and improve the ArmorDraft Service.
• To authenticate your identity and maintain your session.
• To run AI-assisted takeoff and extraction on your uploaded drawings.
• To improve AI model accuracy using anonymized, aggregated detection results (never your project identifiers or business-sensitive data).
• To send transactional emails (account activation, billing receipts, password reset).
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell your personal information or project data to third parties. We do not use your data for behavioral advertising.

4. How We Share Your Information

We share data only in these circumstances:

• Service providers — our subprocessors (listed in §5) process data on our behalf under data processing agreements.
• Legal requirements — if required by law, regulation, or valid legal process (e.g., a court order).
• Business transfer — in the event of a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity, subject to the same privacy protections.
• With your consent — for any other purpose with your explicit consent.

5. Subprocessors

We use the following subprocessors to deliver the Service:

6. Data Retention

For our full data retention schedule, see the Data Retention Policy. Summary:

• Active project data: retained while your account is active.
• Drawings and uploaded files: retained for 2 years after project close.
• Estimate runs and BOM exports: retained for 7 years (for dispute resolution).
• Audit logs: retained for 7 years (immutable).
• Account data: deleted within 30 days of account termination request.

7. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, least-privilege database access controls, append-only audit trails, and regular security scanning. However, no system is perfectly secure. Notify us immediately at privacy@armorstack.ai if you discover a security vulnerability.

8. Your Rights

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your account and associated data (subject to retention requirements).
• Portability — receive your project data in a machine-readable format.
• Objection — object to certain processing activities.

To exercise any of these rights, email privacy@armorstack.ai. We will respond within 30 days. For GDPR requests, we will respond within the required 30-day window. For CCPA requests, we will respond within 45 days.

9. Cookies and Local Storage

ArmorDraft uses browser localStorage (not cookies) to cache your onboarding state (org ID and user ID) so the app loads instantly on return visits. This data contains no sensitive personal information and can be cleared via your browser settings.

Vercel Analytics may set a minimal analytics cookie to count unique visitors. No advertising or cross-site tracking cookies are used.

10. Children's Privacy

ArmorDraft is not directed to children under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us at privacy@armorstack.ai.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app notice at least 14 days before the effective date.

12. Contact Us

Privacy questions or requests: privacy@armorstack.ai