Privacy Policy — EstimateAI

🔒 Your Data Is Yours

We never sell your data. You own all your estimates, client information, and pricing. We collect only what's needed to provide the Service, and we isolate your data from every other user.

1. Overview

Visionary Solution LLC ("Company," "we," "us," or "our") operates EstimateAI, an AI-powered contractor estimation tool accessible at estimate.visionaryconsultant.net. This Privacy Policy describes how we collect, use, store, and protect your information when you use our Service.

We are committed to compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

2. Data We Collect

2.1 Data You Provide

Data Category	Examples	Purpose
Account Data	Name, email, company name, phone number	Account creation, billing, support
Estimate Data	Project estimates, material lists, labor calculations, pricing	Provide the core Service
Job Photos	Photos of job sites, materials, blueprints	AI analysis for estimate generation
Client Information	Client names, emails, phone numbers, addresses	Create and manage estimates for your clients
Custom Pricing	Material rates, labor rates, markup percentages	Personalize estimate calculations

2.2 Data Collected Automatically

Data Category	Examples	Purpose
Usage Data	Pages visited, features used, estimates generated, session duration	Service improvement, abuse prevention
Device Data	Browser type, OS, screen resolution, IP address	Security, debugging, analytics

3. How We Use Your Data

Provide the Service: Generate estimates, process photos, store your data securely
Improve the Service: Analyze anonymized, aggregated usage patterns to improve features and AI accuracy
Communicate: Send service notifications, billing updates, and support responses
Security: Detect fraud, abuse, and unauthorized access
Compliance: Fulfill legal obligations and respond to lawful requests

We never use your individual estimate data, client information, or custom pricing for any purpose beyond providing the Service to you.

4. Multi-Tenant Data Isolation

Your data is isolated from all other users through our multi-tenant architecture:

Every database record is tagged with your unique tenant ID
Row-level security policies enforce that only your account can access your data
API endpoints validate tenant ownership before returning any records
No user, administrator, or system process can cross-tenant access data without explicit authorization
Cross-tenant data leakage is treated as a critical security incident with immediate investigation and disclosure

5. Third-Party Services

We use the following third-party services to operate EstimateAI:

Supabase

Purpose: Database hosting, authentication, file storage

Your estimate data, account information, and job photos are stored in Supabase's infrastructure. Supabase is SOC 2 Type II certified and hosts data in the United States. Supabase acts as a data processor under our instructions and does not access or use your data for their own purposes.

Cloudflare

Purpose: CDN, DDoS protection, SSL termination, DNS

Cloudflare processes HTTP requests to deliver the Service and protect against attacks. Cloudflare may temporarily log IP addresses and request metadata but does not store your estimate data or client information.

OpenAI (GPT-4o)

Purpose: AI processing — photo analysis and estimate generation

When you submit job photos for AI analysis, the images are sent to OpenAI's GPT-4o API. Per OpenAI's API data usage policy: OpenAI does not store your photos or use them for model training. Photos are processed in transit, results are returned, and no persistent storage occurs on OpenAI's side. The AI-generated suggestions are returned to your account and stored with your estimate.

6. Data Retention & Deletion

6.1 Active Accounts

We retain your data for as long as your account is active. This includes all estimates, client information, job photos, and custom pricing.

6.2 Account Termination

Upon account termination, you have 30 days to export all your data
After the 30-day export window, we delete your data from primary systems within 14 days
Backup systems are purged within 90 days
Deletion confirmation is available upon request

6.3 Anonymized Data

We may retain fully anonymized, aggregated usage data (with no connection to you or your account) for service improvement and analytics purposes indefinitely.

7. Your Rights

7.1 Data Export

You may export all your data at any time in CSV or JSON format through your account settings or by contacting support@visionaryconsultant.net.

7.2 GDPR Rights (EU/EEA Users)

Right of Access: Request a copy of all personal data we hold about you
Right to Rectification: Correct inaccurate personal data
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
Right to Restrict Processing: Limit how we process your data
Right to Data Portability: Receive your data in a structured, machine-readable format (CSV/JSON)
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent where processing is based on consent

To exercise any of these rights, contact support@visionaryconsultant.net. We will respond within 30 days.

7.3 CCPA Rights (California Users)

Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, how we use it, and to whom we disclose it
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale: We do not sell your personal information — no action needed
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To submit a verifiable consumer request, contact support@visionaryconsultant.net. We will respond within 45 days.

8. Data We Never Collect or Sell

We never sell your data. Additionally, we do not:

Sell or rent your personal information to third parties
Share your individual estimate data, client lists, or pricing with other users or third parties
Use your data for advertising or marketing of third-party products
Build consumer profiles for credit, insurance, or employment purposes
Allow OpenAI to store or train on your uploaded photos

9. International Data Transfers

Your data is processed and stored primarily in the United States. If you are accessing the Service from the EU/EEA, UK, or other regions with data protection laws, you acknowledge that your data will be transferred to and processed in the United States. We ensure appropriate safeguards including:

Standard Contractual Clauses (SCCs) with our data processors
Supabase's compliance with EU-U.S. Data Privacy Framework
Data Processing Agreements with all third-party processors

10. Data Security

We implement industry-standard security measures:

Encryption in transit (TLS 1.3) and at rest (AES-256)
Row-level security and tenant isolation in the database
Regular security assessments and penetration testing
Access controls and audit logging
Incident response procedures with 72-hour breach notification (GDPR compliant)

11. Children's Privacy

EstimateAI is not intended for use by individuals under 18. We do not knowingly collect personal information from children. If we discover we have collected data from a minor, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days before they take effect via email or in-app notification. We encourage you to review this page periodically.

13. Contact

For privacy questions, data requests, or to exercise your rights:

Email: support@visionaryconsultant.net
Company: Visionary Solution LLC

For EU users, you also have the right to lodge a complaint with your local supervisory authority.