Privacy Policy

Bildgaard, Inc. ("Bildgaard," "we," "our," or "us") provides a suite of AI-powered construction software products — Bid Radar, Timesheets, Estimator, Daily Report, Takeoff, and the Bildgaard Dashboard (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our Services and our website at getbildgaard.com (the "Site").

By accessing the Site or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use.

Enterprise customers who require a Data Processing Addendum (DPA) for GDPR or other regulatory compliance may request one by contacting legal@getbildgaard.com.

This Privacy Policy covers two distinct categories of information, and Bildgaard's role differs for each:

2.1 Customer Data

"Customer Data" is any content, files, documents, or data that you or your users submit to the Services — including bid documents, RFPs, timesheet entries, payroll records, field reports, site photos, takeoff plans, and any other project information. When processing Customer Data, Bildgaard acts as a data processor on your behalf. You (the customer) remain the data controller and are responsible for how Customer Data is collected and used. Bildgaard processes Customer Data only as necessary to provide the Services and as directed by you, in accordance with our Terms of Use and any applicable DPA.

AI Processing of Customer Data: When you use AI-powered features (such as bid summaries, proposal generation, report drafting, or cost estimation), your Customer Data — including construction documents and project information — is transmitted to third-party AI subprocessors to generate outputs. See Section 6.2 for the list of AI subprocessors.

2.2 Bildgaard Data

"Bildgaard Data" is information we collect independently about how you interact with the Services and the Site — such as account information, usage logs, device data, and payment records. For Bildgaard Data, Bildgaard acts as the data controller and this Privacy Policy governs its use.

3.1 Information You Provide

You can sign in with Google (OAuth 2.0) or with an email address and password. When you sign in with Google, we receive your name, email address, and profile picture; we never receive your Google password. If you create a password with us, we store only a one-way bcrypt hash of it, never the password itself. You may also provide your company name, job title, and other account details during onboarding.

3.2 Customer Data You Submit to the Services

As described in Section 2.1, the following types of Customer Data may be submitted to the Services and, where applicable, transmitted to AI subprocessors to generate outputs:

• Bid Radar: bid solicitation documents, RFPs, project specifications, and competitor intelligence data
• Timesheets: employee names, crew lists, cost codes, hours worked, GPS clock-in/out locations, and payroll data
• Estimator: RFP documents uploaded for AI proposal generation, scope-of-work drafts, and pricing data
• Daily Report: field reports, GPS-tagged site photos, voice-to-text notes, subcontractor logs, and incident records
• Takeoff: construction plan files, drawings, and cost estimate data
• Dashboard: aggregated project and financial data drawn from all connected products

3.3 Information Collected Automatically

We automatically collect certain technical and usage data when you interact with the Services or the Site, including:

• Log data: IP address, browser type, operating system, referring URLs, pages visited
• Device identifiers and session identifiers
• Feature usage patterns, click events, and session duration
• Error reports and performance diagnostics

3.4 Location Data

Timesheets and Daily Report may collect precise GPS coordinates at clock-in, clock-out, and when photos are captured, to verify crew presence at job sites and geotag field documentation. Location collection is disclosed to users at the time of collection. You may disable location access in your device settings, though certain features will be unavailable without it.

3.5 Payment Information

Subscription payments are processed by Stripe, Inc. Bildgaard does not store full card numbers, CVV codes, or bank account details on our systems. Stripe's privacy policy applies to payment data. We retain billing records (plan, amount, date) for accounting and tax purposes.

3.6 Information from Third Parties

We may receive limited information from Google (authentication), Stripe (subscription status), and NOAA's National Weather Service (weather conditions for Daily Report — no personal data is transmitted to NOAA).

We use Bildgaard Data for the following purposes:

• Providing the Services: authenticating users, managing accounts and subscriptions, and enabling product functionality
• AI-Powered Features: transmitting Customer Data to AI subprocessors to generate bid summaries, proposals, cost estimates, field report narratives, and other AI outputs at your direction
• Communications: sending transactional emails (subscription confirmations, invoices, usage alerts, security notices) and, with your consent, product updates and marketing communications
• Safety and Security: detecting and preventing fraud, abuse, unauthorized access, and other harmful activity
• Analytics and Improvement: generating aggregate, de-identified usage analytics to understand feature adoption and improve the Services; we do not build individual user profiles for advertising
• Legal Compliance: fulfilling our obligations under applicable law, responding to lawful requests, and enforcing our agreements

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases:

Where we rely on legitimate interests, you have the right to object. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We do not sell your personal information. We share information only as described below:

6.1 Service Providers

We engage trusted third-party service providers who process data on our behalf under written data processing agreements:

• Google Cloud Platform — cloud infrastructure, Firestore database, and Cloud Storage (United States)
• Stripe, Inc. — payment processing and subscription billing (United States)
• Twilio SendGrid — transactional email delivery (United States)

6.2 AI Subprocessors

When you use AI-powered features, Customer Data (including uploaded documents and project information) is transmitted to the following AI subprocessors solely to generate the requested output:

• Anthropic, PBC (Claude API) — our primary AI provider for document analysis, summarization, drafting, and report generation (United States)
• OpenAI, LLC — fallback provider for the same features when the Claude API is unavailable (United States)
• Google LLC (Google Cloud Vertex AI) — transcribes the audio recordings of meetings you upload for AI meeting minutes. Google reads the recording where it is stored in our Google Cloud project; we delete the recording once it has been transcribed (Google Cloud's global infrastructure)

A current, complete list of subprocessors is available upon request at privacy@getbildgaard.com. We may add, remove, or change subprocessors at any time.

6.3 Legal Requirements

We may disclose information if required by law, court order, or government authority, or when reasonably necessary to protect the rights, property, or safety of Bildgaard, our users, or the public. Where permitted, we will notify you before complying.

6.4 Business Transfers

If Bildgaard undergoes a merger, acquisition, financing, or sale of assets, your information may be transferred to the acquiring entity.

Bildgaard is based in the United States. If you access the Services from the EEA, the United Kingdom, Switzerland, or other regions with data transfer restrictions, your information — including Customer Data processed by AI subprocessors — may be transferred to and processed in the United States or other countries that may not provide the same level of data protection as your home country.

For transfers from the EEA, UK, or Switzerland, Bildgaard relies on the European Commission's Standard Contractual Clauses (SCCs) as the legal transfer mechanism. Copies of applicable SCCs or our Data Processing Addendum are available upon request at legal@getbildgaard.com.

We retain Bildgaard Data for as long as your account is active or as otherwise needed to provide the Services, resolve disputes, and comply with legal obligations. Specific retention periods:

• Account data and Customer Data: retained while your account exists, including after a subscription or trial ends, when your account becomes read-only and your data stays available to view and export. We delete it within 30 days of a verified deletion request.
• Billing records: retained for 7 years as required by applicable tax and accounting law
• Security logs: retained for up to 12 months

Point-in-time recovery copies of our databases may persist for up to 7 days after data is deleted. To request deletion of your account and all associated data, contact privacy@getbildgaard.com.

9.1 All Users

Regardless of your location, you may:

• Access and download a copy of your account data by contacting us
• Correct inaccurate account information via your account settings or by contacting us
• Opt out of marketing emails at any time via the unsubscribe link in any email
• Request deletion of your account and associated data (subject to legal retention requirements)

9.2 California Residents (CCPA / CPRA)

California residents have the right to: (1) know what personal information we collect, use, disclose, and sell; (2) request deletion of personal information; (3) correct inaccurate personal information; (4) opt out of the sale or sharing of personal information; and (5) non-discrimination for exercising these rights.

Do Not Sell or Share My Personal Information: Bildgaard does not sell your personal information for money. We do not share personal information for cross-context behavioral advertising. You may nonetheless submit an opt-out request at any time by emailing privacy@getbildgaard.com with the subject line "CCPA Opt-Out."

To submit a verifiable consumer request, contact us at privacy@getbildgaard.com. We will respond within 45 days. You may designate an authorized agent to make a request on your behalf.

9.3 EEA, UK, and Swiss Residents (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, you have the right to:

• Access — obtain a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request deletion of your personal data
• Restriction — restrict our processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — where processing is consent-based, withdraw at any time without penalty

To exercise any GDPR rights, contact us at privacy@getbildgaard.com. We will respond within 30 days (extendable by 60 days for complex requests with notice). You also have the right to lodge a complaint with your local supervisory authority.

Note regarding Customer Data: Because Bildgaard acts as a data processor for Customer Data, requests relating to personal data contained within Customer Data should be directed to the customer organization (the data controller) that submitted the data to the Services.

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: HttpOnly, Secure session cookies used to maintain authenticated sessions. These cannot be disabled without preventing login.
• Analytics: Server-side access logs used to understand aggregate usage patterns. We do not use third-party JavaScript analytics trackers (such as Google Analytics) in the core Services.

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral targeting. You may configure your browser to refuse cookies, though this will prevent you from logging in to the Services.

We implement industry-standard technical and organizational safeguards to protect your information, including TLS encryption in transit, AES-256 encryption at rest for stored data, and role-based access controls. Sessions use HttpOnly cookies, and passwords are stored only as one-way bcrypt hashes, never in plain text. Despite these measures, no system is completely secure. Please notify us immediately at privacy@getbildgaard.com if you suspect unauthorized access to your account or any security incident.

The Services are designed for business and professional use and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us at privacy@getbildgaard.com and we will promptly delete it.

The Services may contain links to third-party websites or integrate with third-party tools (such as Google Drive or government bid portals). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or alongside the Services.

We may update this Privacy Policy at any time, and we reserve the right to change our systems, technology, and service providers at any time. The "Effective Date" at the top of this page will always reflect the current version. Your continued use of the Services after the effective date of any update constitutes your acceptance of the revised policy.

For privacy-related questions, requests to exercise your rights, or to request our Data Processing Addendum, please contact us: