Privacy Policy
This policy explains what CivilsTools collects, why, who else touches it, and what you can ask us to do with it. It is written to be read, not to be skimmed past.
The short version. We collect the account details you type and the work content you upload. We do not run analytics, advertising or tracking of any kind — there is no Google Analytics, no advertising pixel and no behavioural tracking anywhere in this product. We do not sell or share your personal information. Your documents are indexed and analysed by AI on our own server, not sent to an outside AI company.
On this page
- 1. Who we are
- 2. What we collect
- 3. How we use it
- 4. AI, OCR and voice
- 5. Who we share it with
- 6. We do not sell your information
- 7. Cookies and browser storage
- 8. Do Not Track
- 9. How long we keep it
- 10. Your choices and rights
- 11. Security and breach notification
- 12. Children
- 13. Where we operate
- 14. Changes to this policy
- 15. Contact us
1. Who we are
CivilsTools ("we", "us") is a hosted software service for construction estimating, field documentation and specification search. You can reach us at [email protected].
CivilsTools is a business tool sold to businesses. It is not directed at consumers or children.
2. What we collect
2.1 Information you give us
| Category | Specifically | Why |
|---|---|---|
| Account | Your name, work email address, and a one-way hash of your password (we never store the password itself) | To create and secure your account |
| Company | Company or workspace name | To create your workspace and separate it from every other customer's |
| Agreement record | The date/time you accepted these terms and the version you accepted | To show what you agreed to, and when |
| Billing | Plan, subscription status and a customer reference from our payment processor | To run your subscription |
| Phone number (optional) | A mobile number, only if you choose to add one in Settings | To text you follow-up reminders. Leave it blank and we cannot text you. |
| Email intake (optional) | A private forwarding address we generate for you, plus any of your own additional email addresses you register as trusted senders | So you can forward an email into CivilsTools and have it become a follow-up item |
At signup we ask only for a name, work email, password and company name — no phone number, mailing address, date of birth or government identifier. A phone number is optional and added later, by you, only if you want SMS reminders. We never see or store your card number — payment details go directly to Stripe (see §5).
2.2 Content you put into the tools
This is your material, and it is the bulk of what we hold:
- Documents you upload — specification books, drawings, submittals and other PDFs.
- Reports and records you create — daily reports, field issue reports, RFIs, submittal logs, estimates, tasks and project notes.
- Photos you attach, and any location coordinates you choose to capture with them.
- Contact details you enter about other people — subcontractors, vendors, crew and project contacts, including their names, phone numbers, email addresses and your notes.
- Your company branding — logo, colours and contact details for your exported PDFs.
- Emails you forward in. If you use the email-intake feature, the messages you forward to your private CivilsTools address are received on our behalf by Cloudflare and stored as follow-up items — including the sender and recipient addresses, subject line and message body. That may include information about people who never agreed to be in our system, so forward deliberately.
You are responsible for the contact details and documents you upload. When you enter another person's information, or upload a specification you licensed from a third party, you are the one deciding to put it in our system. See §4 of the Terms of Service.
2.3 Information collected automatically
Very little, and none of it for tracking:
- Server logs — ordinary web-server records of requests, used to keep the service running and to investigate faults and abuse.
- Your IP address — read from the connection (via Cloudflare) and used to count recent login, signup, password-reset and share-link requests so we can block brute-force attempts and abuse. These counters are held in memory, are short-lived, and are not used to build any profile of you. Cloudflare separately logs request IPs as part of running its network.
- Location — only if you use a feature that asks for it (the GPS pin on a field issue report, or weather on a daily report). Your browser asks your permission first, and you can refuse; the rest of the tool still works.
There is no advertising pixel, analytics package, session recorder, heat-map, fingerprinting script or cross-site tracker in this product.
3. How we use it
- To provide the service — store your work, index your documents, run the estimators, and generate your PDFs.
- To authenticate you and keep accounts separated from one another.
- To bill you, if you are on a paid plan.
- To send service messages — password resets, invitations you triggered, and notices about your account or important changes to the service.
- To provide support when you ask for it.
- To keep the service secure, prevent abuse, and comply with the law.
We do not use your uploaded documents or records to train AI models — not ours, and not anyone else's.
4. AI, OCR and voice
Being specific here matters, because "AI features" usually means "we send your data to someone else". Mostly, we don't.
- Document AI runs on our own server. Spec question-answering, Smart Fill, note polishing, text extraction and OCR all execute on hardware we operate, using a language model installed locally. Your documents are not sent to OpenAI, Anthropic, Google or any other AI provider.
- Voice dictation uses your browser. The "talk instead of type" features use your browser's built-in speech recognition. In Google Chrome and Edge, that means the audio you dictate is sent to Google's speech service for transcription — it is a browser feature, outside our control. If you would rather that did not happen, type instead of dictating, or use a browser that transcribes on-device.
- The AI Quote Caller is different — read §5.2. It places real phone calls and does use outside providers.
5. Who we share it with
We share personal information only with the service providers below, only so they can perform their function for us, and never for their own marketing.
5.1 Always in play
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare | Content delivery, DNS and web application firewall in front of our site | Your IP address and request metadata for every page you load |
| Stripe | Subscription payments | Your name, email, and payment details you enter on Stripe's own checkout page. We never receive your card number. |
| Our email relay | Sends password resets, invitations and service notices | Recipient address and message content |
5.2 Only if you use the specific feature
| Provider | Triggered by | What it receives |
|---|---|---|
| Google Maps Static API | Maps printed into a field issue report or RFI | The map coordinates being rendered |
| Esri / ArcGIS World Imagery | Satellite imagery on site maps | The map area being requested |
| Open-Meteo | Automatic weather and place lookup on a daily report | The coordinates or place name being looked up |
| OpenStreetMap / Nominatim | Turning a typed address into coordinates when georeferencing a site plan | The address you typed |
| BigDataCloud | Turning GPS coordinates into a readable place name | The coordinates captured |
| Google Fonts | Loading a custom font you selected for your company branding | Your IP address, when that font loads |
| Telnyx | AI Quote Caller only — carries the phone call | The number dialled and the call audio |
| Groq | AI Quote Caller only — real-time speech-to-text and the conversational model | The call audio as it is spoken, and the conversation text |
About the AI Quote Caller. This optional feature places a real outbound telephone call to a vendor you nominate, using an automated voice that identifies itself as such at the start of the call. We do not keep an audio recording of the call. The audio is streamed to our speech provider to be turned into text in real time, and it is that transcript — not a recording — that is stored on your project. Telnyx carries the call and Groq performs the transcription and powers the conversation, as shown in the table above. You are the caller of record — you choose who is dialled, and you are responsible for having a lawful basis to call that person. See §7 of the Terms of Service.
5.3 Other disclosures
- People you share with. When you share a report, log or estimate by email or link, the person you send it to can see it. That is you disclosing it, not us.
- Legal. We may disclose information where we are legally required to, or to protect our rights, safety, or the security of the service.
- Business transfer. If the business is sold or merged, customer data may transfer with it. We will say so before that happens.
6. We do not sell your information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so. There is no advertising in this product and no data broker relationship of any kind.
7. Cookies and browser storage
CivilsTools sets no cookies of its own. We keep you signed in using your browser's local storage instead. Cloudflare may set a security cookie to distinguish humans from bots. Full detail, including exactly what is stored and how to clear it, is in our Cookie Policy.
8. Do Not Track
Some browsers send a "Do Not Track" signal. There is still no common industry standard for responding to it. We do not need to respond to it, because we do not track you across websites or over time in the first place — there is no tracking infrastructure in this product to switch off. We also do not permit third parties to collect personally identifiable information about your online activities across different websites when you use CivilsTools.
9. How long we keep it
- Your content — for as long as your account is open. You can delete individual records, documents and photos at any time from within the app.
- Your account — until you ask us to close it.
- After closure — we delete or anonymise your content within 60 days, except where we must keep something to meet a legal or tax obligation.
- Backups — copies may persist in encrypted backups for a short period after deletion, and are overwritten on the normal backup rotation.
- Billing records — retained as long as tax and accounting law requires.
- Call transcripts (AI Quote Caller) — no audio recording is kept. The transcript is stored on your project until you delete that record.
- Forwarded emails — kept as the follow-up item they created, and deleted when you delete that item.
- Abuse counters — the in-memory rate-limit counters described in §2.3 expire within minutes and are never written to disk.
10. Your choices and rights
Whatever your location, you may ask us to:
- Access a copy of the personal information we hold about you.
- Export your data. Most tools export to PDF or CSV from inside the app; ask us if you need a fuller export.
- Correct anything inaccurate — most of it you can edit yourself in Settings.
- Delete your account and its content.
- Object or complain about how we have handled your information.
Email [email protected]. We will verify who you are before acting, and respond within 45 days. Exercising any of these rights costs you nothing and we will not treat you differently for asking.
Under California Civil Code § 1798.83, California residents may request details of any personal information we disclosed to third parties for their own direct-marketing purposes. We disclose none, but you are welcome to ask and receive that answer in writing.
If you are an employee or contact of a CivilsTools customer and your details were entered by them — for example in their vendor directory — that customer controls those records. Contact them first; we will help you reach them, and we will assist that customer in responding.
11. Security and breach notification
Passwords are stored as one-way hashes. Traffic is encrypted in transit with HTTPS. Every request is scoped to your account and company, so one customer cannot read another's files. Uploaded documents are served only through an authenticated, owner-checked endpoint — never from a public folder.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will notify you and the authorities as required, including under California Civil Code § 1798.82.
12. Children
CivilsTools is for business use by adults. It is not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
13. Where we operate
CivilsTools is operated from the United States and our servers are located in the United States. We offer the service to businesses in the United States. We do not target the service at the European Economic Area or the United Kingdom, and this policy is not written as a GDPR compliance statement. If you access CivilsTools from outside the United States, your information will be processed in the United States.
14. Changes to this policy
If we change this policy we will update the version and effective date at the top of this page. For material changes we will also notify account holders by email or by an in-app notice before the change takes effect. The date at the top tells you when this version began; continuing to use CivilsTools after that date means you accept the current version.
15. Contact us
Questions, requests or complaints about privacy:
- Email: [email protected]