Privacy Policy

1. Introduction

Assemble Limited ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our construction takeoff and estimating software ("Service").

We are a company registered in Ireland and comply with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws worldwide.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when you:

• Create an account: Name, email address, password, company name
• Use the Service: Project documents (PDF floor plans), measurements, estimates, notes, and other content you upload
• Make payments: Billing information (processed securely by Stripe - we do not store full payment card details)
• Contact us: Support requests, feedback, and correspondence
• Manage your workspace: Team member information, organization settings

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Usage data: Features used, actions performed, time spent, pages viewed
• Device information: Browser type and version, operating system, device type
• Log data: IP address, access times, error logs, crash reports
• Cookies and tracking: Session cookies, authentication tokens, preferences (see Section 8)

2.3 Information from Third Parties

We may receive information from:

• Payment processors: Stripe provides transaction confirmations and billing status
• Analytics services: Aggregated usage patterns and performance metrics

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Provision

• Create and manage your account
• Provide access to the Service features and functionality
• Store and process your project documents and measurements
• Enable collaboration within your workspace
• Provide customer support and respond to inquiries

3.2 Billing and Payments

• Process subscription payments and manage billing
• Send invoices and payment confirmations
• Prevent fraud and unauthorized transactions

3.3 Service Improvement

• Analyze usage patterns to improve features and performance
• Identify and fix bugs and technical issues
• Develop new features based on user needs
• Monitor and ensure Service security and stability

3.4 Communication

• Send important Service updates and notifications
• Notify you of changes to Terms or Privacy Policy
• Send marketing communications (with your consent, where required)
• Respond to your requests and inquiries

3.5 Legal Compliance

• Comply with legal obligations and regulations
• Enforce our Terms of Service
• Protect our rights and prevent misuse
• Respond to legal requests from authorities

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on:

• Contract performance: Processing necessary to provide the Service you signed up for
• Legitimate interests: Improving our Service, security, fraud prevention, and analytics
• Consent: Marketing communications and optional features (you can withdraw consent anytime)
• Legal obligation: Compliance with applicable laws and regulations

5. How We Share Your Information

We do not sell your personal data. We share your information only in these limited circumstances:

5.1 Service Providers

We share data with trusted third-party providers who help us operate the Service:

• MongoDB Atlas: Cloud database hosting for storing your data
• Amazon Web Services (AWS S3): Cloud storage for PDF documents
• Stripe: Payment processing and subscription management
• Infrastructure providers: Hosting and content delivery services

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

5.2 Workspace Members

When you create or join a workspace, certain information (name, email, projects, measurements) is shared with other members of that workspace to enable collaboration.

5.3 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations, court orders, or subpoenas
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Enforce our Terms of Service

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and other regions where our service providers operate.

When we transfer data from the EEA/UK to other countries, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally approved transfer mechanisms

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service while your account is active
• Comply with legal, tax, and accounting obligations (typically 7 years)
• Resolve disputes and enforce our agreements

Active accounts: We retain your data while your account is active and for a reasonable period after account deletion to allow for reactivation and data recovery.

Deleted accounts: After you delete your account, we will permanently delete your personal data within 90 days, except where we must retain it for legal compliance.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential cookies: Authentication, security, session management (required for Service operation)
• Performance cookies: Analyze usage, identify errors, improve performance
• Functional cookies: Remember your preferences and settings

Your choices: You can control cookies through your browser settings. However, disabling essential cookies may prevent you from using certain features of the Service.

Do Not Track: We currently do not respond to Do Not Track signals, as there is no industry standard for compliance.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS) and at rest
• Secure authentication with password hashing
• Regular security audits and vulnerability assessments
• Access controls and data segregation
• Monitoring and logging of security events
• Secure cloud infrastructure with reputable providers

While we take reasonable precautions, no system is completely secure. You are responsible for maintaining the security of your account credentials and should notify us immediately of any suspected unauthorized access.

10. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

10.1 Access and Portability

Request a copy of your personal data in a structured, machine-readable format.

10.2 Correction

Update or correct inaccurate or incomplete personal data through your account settings.

10.3 Deletion

Request deletion of your personal data, subject to legal retention requirements.

10.4 Restriction

Request restriction of processing in certain circumstances (e.g., while we verify accuracy).

10.5 Objection

Object to processing based on legitimate interests or direct marketing.

10.6 Withdraw Consent

Withdraw consent for processing at any time (does not affect prior processing).

10.7 Lodge a Complaint

File a complaint with your local data protection authority if you believe we have violated your rights.

How to exercise your rights: Contact us at privacy@assemblepro.com or through your account settings. We will respond to requests within 30 days (or as required by applicable law).

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (subject to exceptions)
• Right to opt-out of sale of personal information (we do not sell personal data)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at privacy@assemblepro.com.

12. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

13. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending an email notification for significant changes

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EEA/UK users: If we cannot resolve your privacy concern, you have the right to lodge a complaint with your local supervisory authority.