Draft — pending legal review. This document is a starting template based on StructSure's current data practices. Have it reviewed by qualified counsel before you rely on it or launch. Fill the [bracketed] items and remove this banner when finalized.

Privacy Policy

Last updated: [DATE] · StructSure, LLC

StructSure, LLC ("StructSure," "we," "us") builds software for construction companies, including the SiteMap staffing‑intelligence application and the StructSure account platform (together, the "Services"). This policy explains what we collect, why, and the choices you have.

1. Who this policy is for — and the controller / processor split

The Services are used by construction companies (our "Customers") and the people they authorize (admins, members, and invited recruiters — "Users").

Data about our Customers and Users (account and billing information) — StructSure is the controller, and this policy governs it.
Workforce data a Customer enters about its own employees and candidates (names, job titles, assigned job sites, and — for authorized administrators — pay and employment‑status fields) — the Customer is the controller and StructSure acts as a processor on the Customer's behalf, handling that data under our agreement with the Customer (see our Terms and, where applicable, a Data Processing Addendum). If you are an employee or candidate of one of our Customers, please direct requests about your data to that company; we will support them.

2. Information we collect

Category	Examples	Source
Account	Name, work email, password (hashed), company, role	You, at sign‑up
Company / workforce content	Job sites, project stages, employees and candidates, job titles, site assignments, comments and messages; pay and employment‑status fields (admin‑only)	Entered by the Customer's admins and members
Location	Approximate coordinates derived from addresses you enter (for the map)	Geocoded from addresses you provide
Billing	Subscription, seat counts, plan status; payment card details are handled by Stripe and are not stored by StructSure	You / Stripe
Usage & security	Sign‑in events, activity/audit log, and standard server logs	Automatically

We do not intentionally collect Social Security numbers, financial account numbers, or special categories of data. Please do not enter them into free‑text fields.

3. How we use information

Provide, operate, secure, and support the Services.
Authenticate users and enforce company‑ and role‑based access (row‑level security).
Process subscriptions and seats (billing).
Maintain an activity/audit log for security and accountability.
Communicate with you about your account and service changes.

We do not sell personal information, and we do not use your company's workforce data to train general‑purpose AI models.

4. How information is shared

Within your company — per the roles your admins assign (viewer / contributor / admin). Sensitive fields (pay, precise locations, resignation status) are restricted to administrators.
With recruiters your company invites — an invited recruiter sees only a read‑only hiring projection for the companies that invited them; never the map, pay, or other company data.
Service providers (subprocessors) — see §5.
Legal — where required by law, or to protect rights and safety.
Business transfer — in a merger, acquisition, or asset sale, subject to this policy.

5. Subprocessors

We rely on a small set of vendors to run the Services:

Provider	Purpose
Supabase	Database, authentication, and hosting of application data
Netlify	Website and application hosting / delivery
Stripe	Subscription billing and payment processing
Resend	Transactional email (confirmations, password resets)
Map / geocoding (OpenStreetMap‑based: Photon/komoot, Nominatim)	Converting addresses to map locations and rendering the map
Content delivery networks (jsDelivr, unpkg, Cloudflare cdnjs)	Serving open‑source libraries

[Confirm this list and each provider's data location before finalizing.]

6. Data retention

We keep company and workforce content for as long as the Customer's account is active, plus version‑history snapshots that support undo/restore. When an account is closed, we delete or de‑identify the associated data within [e.g., 30–90] days, except where we must retain limited records to meet legal, tax, or security obligations. Backups are cycled on a rolling basis.

7. Security

We use encryption in transit (HTTPS/TLS) and at rest, row‑level access controls that scope data to each company, role‑based permissions, an activity/audit log, and Subresource Integrity on third‑party scripts. No system is perfectly secure, but we work to protect your data and to respond promptly to issues.

8. Your rights & choices

Depending on where you live (including under the California Consumer Privacy Act, as amended), you may have the right to access, correct, delete, or export your personal information, and to appeal a decision. To exercise these rights, email support@structsureapps.com. Account admins can also request deletion or export of a company's data. If your data was entered by a company that uses StructSure, contact that company (we will assist them). We will not discriminate against you for exercising these rights.

9. Cookies & local storage

The Services use your browser's local storage and essential cookies to keep you signed in and remember preferences. We do not use third‑party advertising trackers. [If you add analytics, disclose it here.]

10. Children

The Services are for business use and are not directed to children under 16. We do not knowingly collect their data.

11. International

StructSure operates in the United States, and data is processed there. [If you serve users outside the U.S., add the appropriate transfer disclosures.]

12. Changes

We may update this policy; we'll revise the "Last updated" date and, for material changes, provide notice.

13. Contact

StructSure, LLC · Roseville, CA · support@structsureapps.com