Privacy Policy

Spec Sheet Builder is a tool for trade professionals (builders, general contractors, remodelers, and related trades) to create finish schedules and spec sheets and share them with clients. This policy covers:

• Account information about you, the account holder; and
• Project content you create in the Service, which may include information about your own clients and projects.

You are responsible for the information you enter about your clients. See Section 11.

Information you provide when you create and use an account

• Your email address and password, used to authenticate you. Passwords are handled by our authentication provider and are stored only in hashed form; we never see or store your plaintext password.
• Profile and branding details you choose to add, such as your company name and uploaded company logo.
• Your in-app preferences, including AI feature settings.

Content you create in the Service

• Projects, sections, line items, finish selections, manufacturers, models/SKUs, quantities, units, allowances, prices, statuses, dimensions, notes, and any images you upload to line items.
• Client and project details you choose to enter, such as a client's name, email address, and project address.
• Client and trade activity submitted through shared links, including comments, reactions, approvals, change-order signatures, trade acknowledgements, and delivery check-in notes and photos.
• Some approval, signature, acknowledgement, and check-in records also include the submitter's name, consent, submission time, IP address, and user-agent information so the Service can maintain a security and activity record.

If you use the Chrome extension, see Section 16.

Payment information

When you subscribe to a paid plan, payment is processed by Stripe. We do not collect or store your full card number or card security details. We store a Stripe customer identifier and subscription status so we can manage your plan and entitlements.

Information collected automatically

Standard technical data generated when you use a web application, such as IP address, user-agent, browser and device information, request logs, and security or rate-limit events processed by us and our infrastructure providers for security, reliability, and abuse prevention. We do not use advertising trackers. Page-view analytics are described in Section 5 (Vercel) and Section 6.

We use information to:

• Provide, operate, and maintain the Service and your account;
• Generate, store, and display your spec sheets and related documents;
• Power optional AI features you choose to use (see Section 4);
• Process subscriptions, billing, and plan entitlements through Stripe;
• Send transactional emails you would expect, such as sign-in codes, password resets, and documents you send to your clients;
• Secure the Service, prevent abuse, and troubleshoot problems; and
• Comply with our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

Optional AI features use Google's Gemini models and Z.ai. Depending on the feature you start, Gemini may process:

• Text you enter for AI chat, quick templates, product imports, search, or care-note drafting;
• Limited snapshots of relevant project content, such as section titles, item names, product details, or recent conversation context;
• Images you submit for product photo capture;
• Documents or quote images you upload for quote reading;
• Product-page text and metadata extracted from a URL you ask us to import; and
• Printed plan-note text from uploaded construction drawings, sent as embedding input for takeoff search.

Takeoff features send page images and text of uploaded construction drawings to Z.ai. An advisory plan check may also send section titles and line names from the spec sheet, not prices, quantities, or allowances.

We send only the categories needed for the feature you requested. We do not send your account password or your stored payment information to Gemini or to Z.ai.

AI providers process this data to return a result to you. We rely on these providers' commitments that data submitted through their business APIs is not used to train their models; their handling is governed by their own terms, and we encourage you to review them. AI output is generated automatically and may be inaccurate or incomplete. See our Terms of Service for the important disclaimer about relying on it.

We share information only with service providers ("subprocessors") that help us run the Service, and only as needed for them to perform their function:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery, and page-view analytics. Analytics records page URL and path, referrer, filtered query string, country/region/city, device type, operating system, browser version, and a timestamp.
• Stripe — payment processing and subscription management.
• Resend — sending transactional email.
• Sentry — error reports, which can include a stack trace, the request URL, and browser or server context. An opaque account identifier may be included. Email addresses, IP addresses, and request bodies are stripped before events are sent.
• Cloudflare (R2) — stores the nightly backup of the database dump and uploaded files, encrypted with age before upload. A small heartbeat record (outcome, hashes, and aggregate counts) is also stored. Residual copies remain for a limited period before they are overwritten.
• GitHub (Actions) — runs the nightly backup job. During the job, the database dump and uploaded-file bytes exist on the runner. The workflow does not upload those files as GitHub Actions artifacts. Encrypted archives go to Cloudflare R2.
• Google (Gemini) — AI features you initiate, including chat, the quick-template builder, product normalization and semantic matching, photo capture, quote reading, and care-note drafting. When you use takeoff plan notes, printed plan-note text may also be sent as embedding input.
• Z.ai (JINGSHENG HENGXING TECHNOLOGY PTE.LTD) — plan and drawing analysis for takeoff, including reading pages, proposing rooms, finding symbols, drafting from plans, extracting notes from scanned sheets, and an advisory plan check. Sends page images and text of uploaded construction drawings. The advisory check also sends section titles and line names from the spec sheet (not prices, quantities, or allowances). Processing is generally in Singapore. Their API DPA states that API input and output content is processed in real time and is not saved on their servers, and that they will not use API end-user content to develop or improve their services unless we explicitly agree.
• Bright Data — retrieving a product page you asked us to import when the ordinary server fetch cannot access it.

When you paste a product link to import details, our servers first try to fetch it directly. If the page blocks that request, we may send the URL to Bright Data to retrieve the page. We extract product metadata (such as name, brand, model, price, images, and relevant page text) to pre-fill a line item, and may send the extracted material to Gemini for normalization.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your information consistent with this policy.

We use only the cookies and storage necessary to operate the Service:

• Authentication cookies that keep you signed in.
• Offline storage on your device (a service worker cache and a local database) so the app can work when your connection drops and sync your changes when you reconnect.

We do not use advertising cookies or cross-site tracking. Page-view analytics are described in Section 5 (Vercel).

We keep your information for as long as your account is active or as needed to provide the Service. You can delete your account at any time. Deleting your account permanently removes your account and your associated data, including your projects, spec items, AI conversations, the files you uploaded (such as logos and item images), and generated PDF documents.

Client and trade submissions, including comments, reactions, approvals, signatures, acknowledgements, check-in notes and photos, and associated IP address and user-agent information, are retained with the related project until the project or account is deleted. An acknowledgement or check-in may remain after its individual trade package or item is removed so the project activity record stays intact, but it is removed when the related project or account is deleted.

Residual copies may remain in our encrypted backups for a limited period before they are overwritten. Service providers may retain data under their own policies and legal obligations. We may retain limited records where required for legal, tax, accounting, or fraud-prevention purposes.

We use industry-standard safeguards, including encryption in transit and at rest provided by our infrastructure providers, row-level database security that isolates each account's data, and hashing of sensitive tokens such as client share links. No system is perfectly secure, but we work to protect your information and to limit access to it.

• Access and update the account and profile information available in the app at any time, and contact us using Section 14 to make a privacy request.
• Edit project content while your current plan entitlement permits it. After paid access ends, project content becomes read-only, but you can still view and export it.
• Export your project data in CSV or JSON format.
• Delete your account and content as described in Section 7.
• Manage email: transactional emails are part of the Service; we do not send marketing email by default.

Depending on where you live, you may have additional rights described below.

If you are a California resident, you have the right to know what personal information we collect and how we use and share it (described in this policy), to request access to or deletion of your personal information, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or "share" personal information for cross-context behavioral advertising. To make a request, contact us using Section 14.

When you enter information about your own clients (such as their name, email, or project address) or share a spec sheet with them, you are responsible for that information: for having the right to provide it, for the accuracy of it, and for using the Service in a way that respects your clients' privacy. With respect to that client information, you act as the controller and we act as a processor handling it on your behalf to provide the Service.

Spec sheets you choose to share are made available through a read-only link secured by a unique token. You control whether to create or revoke a share link.

The Service is operated from the United States, and your information is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

The Service is intended for business use by individuals who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

Questions about this policy or your information? Contact us at:

Grup Holdings LLC, Spec Sheet Builder
info@specsheetbuilder.com

We reply within 2 business days.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.

Spec Sheet Builder offers a Chrome extension that saves a product page into your product library.

The extension has no standing access to any website and requests no host permissions. Chrome grants it access to the current tab only when you use it.

When you click its toolbar icon, it reads the full HTML of the page in that tab (the document markup your browser has already rendered) and sends that HTML, together with the page URL, to Spec Sheet Builder. If the HTML is longer than two million characters, it is truncated before it is sent. Spec Sheet Builder extracts product details from that HTML, including the product name, manufacturer, model, finish, size, unit, and price. When AI features are available, a trimmed copy of the page HTML is sent to Google Gemini for that extraction (see Section 4).

The product we save is the extracted details, the page URL, and any images you choose to save.

While the clip panel is open on that same page, choosing an image reads that image's address from the page. If you use Capture, the extension screenshots the visible tab, crops the area you select, and uploads that image file to your Spec Sheet Builder account at that moment.

If you save the product, the extension sends the page URL, the details you confirmed, and the image addresses you selected. Our servers download those images and store copies in your account. They are not kept only as links to the source page. If a copy cannot be made, the product is still saved without that image.

If you create a folder from the panel, the folder name is saved to your account.

If the posted page does not include a usable product image, we may fetch the page again using the page URL. That fetch may use Bright Data, as described in Section 5.

Testing the connection from the extension's Options page sends your clipper token and no page content.

The extension stores a clipper token and the Spec Sheet Builder app address in your browser's local storage. It does not store your last used folder. While a clip is in progress, it keeps the current tab identifier in session storage.

The extension authenticates to Spec Sheet Builder with the clipper token, not your password. It does not send your password. It does not attach the site's cookies to the request. The HTML it sends is the page as your browser rendered it, which may include content that is only visible because you are signed in on that site.

It does not read your browsing history or your other tabs.

We do not sell this data. We share it only as described in Section 5.

You can remove the extension at any time from your browser's extensions page. Removing it does not delete products already saved to your library.