1. Who this policy covers
This policy applies to everyone who uses the GridlineX web application, including members of an organization that has subscribed to GridlineX, clients and lenders invited to view a project, and external collaborators such as general contractors and consultants. It also covers people who send email to a project's GridlineX ingest address, even if they never sign in.
2. Information we collect
Account information. When you are invited to GridlineX we store your name, email address, the organization you belong to, and your role within it. If you sign in with a password, the password is stored only as a salted hash by our authentication provider.
Project information. Organizations upload or email construction project records to GridlineX: budgets, pay applications, change orders, schedules, contracts, RFIs, submittals, meeting minutes, and supporting documents. These records may include the names, email addresses, company names, and contract values of parties to the project.
Email you send to a project. Each project has a unique ingest email address. When a document is emailed to it, we store the sender address, subject, message body, attachments, and the authentication results of the message so that a reviewer can confirm who sent it.
Usage and technical information. Our hosting providers record standard server logs, including IP address, browser type, the pages requested, and timestamps. We use these to keep the service secure and running, not to build advertising profiles.
Fonts. The application's typefaces are loaded from Google Fonts. Your browser sends Google its request for the font files, which includes your IP address and browser type; Google does not receive your identity or anything you type.
Address lookups. When you type a project address during project setup, the text you type is sent to OpenStreetMap's Nominatim service to suggest matching addresses. Nominatim receives only the address text, not your identity.
3. How we use information
- To provide the service: parsing the documents you upload, staging them for human review, and showing the resulting budget, schedule, and risk views to the people authorized to see them.
- To secure the service: authenticating you, enforcing organization and role boundaries, detecting abuse, and keeping a record of who reviewed and confirmed each document.
- To communicate with you: invitations, password resets, and notifications you or your organization have turned on.
- To support you when you contact us.
We do not sell personal information and we do not use your project data to train machine-learning models for other customers.
4. Who we share information with
We use a small number of service providers to run GridlineX. Each processes data only on our instructions:
- Supabase — database, authentication, file storage, and realtime updates.
- Vercel — hosting for the web application.
- Cloudflare — network routing and protection for our API services.
- Postmark — receiving email sent to project ingest addresses and delivering transactional email from us.
- OpenStreetMap Nominatim — address suggestions during project setup, as described above.
- Google Fonts — the typefaces the application is displayed in, as described above.
Within GridlineX, project information is visible to the members of the owning organization and to the clients, lenders, and collaborators that organization has invited, according to the role each person has been given. We may also disclose information when required by law or to protect the rights and safety of GridlineX, our customers, or others.
5. Cookies and local storage
GridlineX sets only strictly necessary cookies. Our authentication provider stores your sign-in session in cookies whose names begin with sb- (a long session may be split across several). They are marked Secure and SameSite, expire after eight hours of inactivity, and are removed when you sign out. A short-lived cookie of the same family is set while a password-reset link is being completed. We also use your browser's local storage to remember interface preferences: whether you have dismissed the cookie notice, whether the sidebar is collapsed, and which project you last had open. We do not use advertising or third-party analytics cookies.
6. How long we keep information
Project records are financial records. Unless the owning organization asks us to delete them sooner, we keep them for seven years after a project is closed, which is the retention period our customers typically need to meet lender and audit obligations. Account information is kept for as long as your account is active and for a short period afterwards to allow reactivation. Server logs are kept for a limited period for security purposes.
7. Security
All traffic to GridlineX is encrypted in transit. Data is encrypted at rest by our storage providers. Access to project data is enforced at the database level for every request, so that one organization can never read another's records. Please report any suspected security issue to support@gridlinex.ai.
8. Your rights and choices
You can view and update your own name and password from your profile. Depending on where you live, you may also have the right to request access to, correction of, export of, or deletion of your personal information. Because most project information is controlled by the organization that subscribed to GridlineX, we will usually refer requests about it to that organization; we will help them respond. Contact us at support@gridlinex.ai and we will reply within one business day.
9. Children
GridlineX is a business service and is not directed at anyone under 18.
10. Changes to this policy
When we make a material change we will update the effective date above and notify account holders by email or by a notice inside the application before the change takes effect.
11. Contact
GridlineX
support@gridlinex.ai