Privacy Policy

1. Who we are

SubmittalFlow (“we”, “us”, or “our”) is a software service that helps US construction subcontractors create professional submittal packages from manufacturer specification sheets. We can be reached at support@submittalflow.app.

2. What data we collect

We collect only what is necessary to provide the service:

• Account information: Your email address, collected when you sign in via magic link or Google OAuth.
• Project metadata: Company name, architect name, job number, project location, and project name — entered by you when creating a submittal.
• Uploaded files: Manufacturer specification sheet PDFs you upload. These are stored securely and also sent to our AI provider for data extraction.
• Generated documents: The submittal packages we produce on your behalf, stored so you can download them.
• Usage data: How many submittals you have created, used to enforce the free tier limit and manage your subscription.

3. How we use your data

• To authenticate you and maintain your session.
• To generate submittal packages from the specification sheets you upload.
• To enforce free tier limits and manage paid subscriptions.
• To respond to support requests you send us.

We do not sell your data, use it for advertising, or share it with any third party beyond the service providers listed below.

4. Third-party service providers

We use the following providers to operate the service. Each acts as a data processor on our behalf:

• Supabase — Database, authentication, and file storage. Your account data and uploaded files are stored on Supabase infrastructure hosted in the United States.
• OpenRouter / OpenAI — AI extraction. The text content of your uploaded PDF is sent to AI models for specification extraction. No personal information is included beyond what appears in the document itself.
• Vercel — Website hosting and anonymous analytics. Vercel Analytics collects aggregated, anonymous page-view data (no cookies, no personal identifiers).
• Payment processor — Billing and subscription management. Your payment details are handled entirely by our payment provider and are never stored on our servers.

5. Cookies

We use only essential session cookies placed by Supabase to keep you signed in. These cookies are strictly necessary for the service to function and cannot be opted out of while using the platform. We do not use advertising cookies, tracking pixels, or any third-party cookies for marketing purposes.

Because we use only essential cookies, no cookie consent banner is displayed. Vercel Analytics uses no cookies — it measures page traffic using anonymous, aggregated signals only.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, your profile, projects, submittals, and uploaded files will be permanently deleted within 30 days. You may request deletion at any time by emailing support@submittalflow.app.

7. Your rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.

To exercise any of these rights, email us at support@submittalflow.app. We will respond within 30 days.

8. Security

All data is transmitted over HTTPS. Files are stored in private, access-controlled buckets. Access to your data requires authentication. We do not store payment card information on our servers.

9. Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Email us at support@submittalflow.app.