Privacy Policy

DrawStack, Inc. ("DrawStack", "we") builds construction draw management software. This policy covers drawstack.ai, the DrawStack web application, our public tools such as the G702 generator and live demo, and the emails we send you.

Two kinds of people show up in our systems, and the distinction matters:

• Account holders — the general contractors, developers and their teams who sign up, create projects and submit draws. You control what goes into your organization.
• People your work touches — lenders, subcontractors, owners and inspectors who receive a link from you, upload a document, or appear in a project record. We process their information on your instructions, as a processor acting for your organization.

If you are in the second group and want your information corrected or removed, contact the contractor who invited you first — they control the project record. You can always reach us at support@drawstack.ai and we will help.

We do not ask for and do not want government identification numbers, bank account credentials, health information or biometric data. Please do not upload them.

• Run the platform — authenticate you, keep your organization's data separate from every other organization's, and show you your projects.
• Produce the work product: draw packets, G702 and G703 documents, reports and exports.
• Power the AI features described in the next section.
• Send transactional email — draw status changes, invitations, lender packets, bid requests and account notices.
• Take payment and manage subscriptions.
• Keep the service working and secure: monitor errors, investigate abuse, and prevent fraud.
• Understand which features get used, in aggregate, so we build the right things.
• Measure our own advertising, on our marketing pages only.
• Meet legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we never use your project or financial data to market to anyone else. Your schedule of values is not a data product.

Several DrawStack features send content to third-party AI models — invoice parsing, the draw auditor, bid scope comparison and drafted clarification letters. Being specific about that is the point of this section.

• What gets sent: the document or records the feature is operating on. Parsing an invoice sends that invoice. Auditing a draw sends the draw's line items and supporting documents. Nothing is sent until you run the feature.
• Who receives it: Google (Gemini) and Anthropic (Claude), as processors under their enterprise API terms.
• Training: content you send through these features is not used to train their models. Both providers exclude API content from model training by default.
• Human review: AI output in DrawStack is a draft. A draw audit flags things to check; it does not approve a draw, and it is not a certification. Read it before you send it to your lender.

If you would rather no content leave your account for AI processing, tell us at support@drawstack.ai and we will disable those features for your organization.

These are the companies that process data to make DrawStack work. Each is bound by its own terms and handles the categories listed here — nothing wider.

We share your information in four situations, and no others.

• Because you shared it. When you send a draw packet to a lender or invite a subcontractor, DrawStack creates a link that opens that specific record without an account. Anyone holding the link can open it, so treat it like the document itself. Links are scoped to one record and expire; you can revoke access from your dashboard.
• Inside your organization. Teammates you invite see your organization's projects according to their role.
• With the service providers listed above, to run the platform.
• When the law requires it, or to investigate fraud, abuse or a threat to someone's safety. If we are compelled to hand over your data and are legally permitted to tell you, we will.

If DrawStack is acquired or merges with another company, your data would move with the business. We would tell you before that happened and before any new privacy policy applied to it.

• Strictly necessary. Session and security cookies set by Clerk keep you signed in. The product does not work without them.
• Product analytics. PostHog records page views and named events so we can see which features are used. Automatic click capture is off.
• Advertising. Our Google Ads tag measures which campaigns lead to sign-ups and supports remarketing. It loads on public marketing pages only. It is not present in the signed-in application, on shared draw links, on invitation pages or on sign-in.

The advertising tag may count as "sharing" personal information for cross-context behavioural advertising under California law, even though no money changes hands. To opt out: use your browser's Global Privacy Control signal, Google's Ads Settings, or email support@drawstack.ai and we will suppress it for you. Opting out does not affect your account or the product.

Ask us to delete your account and associated data at support@drawstack.ai. We will confirm within 30 days. Some records are kept longer where the law requires it — tax and payment records, for example — or where we need them to resolve a dispute.

• Encryption in transit (TLS) and at rest.
• Every query scoped to your organization, so one customer cannot read another's records.
• Role-based access inside your organization.
• Documents served through short-lived signed URLs rather than public buckets.
• Tokens and secrets stripped from analytics and error reports.
• Access to production limited to the engineers who need it, with audit logging.

No system is perfectly secure and we will not claim otherwise. If you find a vulnerability, write to support@drawstack.ai with "security" in the subject — we would rather hear it from you than from an attacker, and we will not pursue good-faith researchers. If a breach affects your personal information we will notify you and any required regulator without undue delay.

Depending on where you live, some of these are legal rights. We extend all of them to everyone.

Email support@drawstack.ai. We respond within 30 days and will not charge you or degrade your service for asking. You may use an authorised agent. If we have to refuse a request we will tell you why, and you can appeal by replying to that decision.

DrawStack is operated from the United States and your data is stored and processed there. Our service providers may process data in other countries; where they do, they rely on Standard Contractual Clauses or an equivalent transfer mechanism. If you use DrawStack from outside the United States, you are sending your information to the United States.

DrawStack is a business tool and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to support@drawstack.ai and we will delete it.

When this policy changes we update the effective date at the top of the page. If a change materially affects how we handle your information — a new category of data, a new purpose, a new kind of sharing — we will email account holders at least 14 days before it takes effect. Continuing to use DrawStack after that date means the updated policy applies.