Privacy Policy

Slateworks, LLC (“Slateworks,” “we,” “us”) provides a cost-estimating and project-management platform for paving and construction contractors (the “Service”). This policy explains what information we collect, how we use it, and the choices available to you.

This policy covers the Slateworks web application, mobile field app, and related services. It does not cover third-party sites we link to, or the rest of this marketing site beyond this page.

1. Who this applies to

Slateworks is business-to-business software. Our direct customers are contracting firms (“Tenants”) who subscribe to the Service. Individual people who interact with the Service fall into two groups:

• Tenant users — employees of a Tenant (estimators, foremen, office staff, owners) who log in and use the Service.
• Tenant contacts — people a Tenant enters into the Service as part of running their business (clients, property contacts, subcontractors, vendors).

Under the California Consumer Privacy Act (CCPA), these two groups sit in different roles. For Tenant users’ own account data, Slateworks is the “Business” — we decide why that data is collected, because it’s collected to provide the Service to that person directly. For Tenant contacts’ data, the Tenant is the “Business” — they decided to collect that person’s information and entered it into the Service. With respect to that data, Slateworks acts only as the Tenant’s “Service Provider”: we process it solely to provide the Service, under contract, and are prohibited from selling it or using it for any purpose of our own.

If you are a Tenant contact and have a question about how your information is used, contact the Tenant firm that entered it — they are the party responsible for that decision and for responding to your request. Slateworks will assist a Tenant in fulfilling a verified request from their contact, but cannot act on that data independently of the Tenant’s instruction.

2. Information we collect

Account information. Name, email address, and role, collected via Firebase Authentication when a Tenant user is invited or signs up.

Business data you or your firm enter. Everything a Tenant’s users type, upload, or record while using the Service: bids and estimates, cost catalogs and pricing, project and job records, client/contact records, schedules, daily field reports, photos and documents (proposals, contracts, change orders), invoices and payment records, and chat messages sent to Sam, our in-app assistant.

Location data. The mobile field app tags photos taken in daily field reports with GPS coordinates, when location permission is granted. This is the only location use in the Service.

Usage and log data. Standard technical logs (timestamps, IP address, device/browser type, pages and actions taken) for security, debugging, and audit-trail purposes. Every write action in the Service is attributed to the user and timestamped as part of the platform’s audit trail — this is a product feature (accountability for who-changed-what), not third-party tracking. We do not use third-party advertising or analytics trackers.

Payment/financial data you enter. If your firm uses the Service’s invoicing features, records of invoices, payments, and — if you connect a third-party accounting or payment system (see §4) — the fact and status of that connection. We do not ourselves store full payment-card numbers or bank account credentials; those are handled by the third-party processor you choose to connect, per that provider’s own terms.

3. How we use information

• To provide, maintain, and secure the Service.
• To authenticate users and enforce tenant-level access controls (each Tenant’s data is isolated from every other Tenant’s — see §6).
• To power Sam, the in-app assistant, which reads relevant Service data to answer questions and take actions you direct it to (see §4 for how this reaches our AI providers).
• To send transactional email (invitations, notifications, password resets) — never marketing email without separate consent.
• To provide customer support and respond to requests.
• To improve the Service and diagnose problems.
• To comply with legal obligations.

We do not sell personal information, and we do not use Tenant business data to train third-party foundation models beyond what’s described in §4.

4. Who we share information with

We share information with the following categories of service providers, each bound by contract to use it only to provide their service to us:

• Google Firebase / Google Cloud Platform — authentication, application hosting, and database storage. Data is stored in Google Cloud infrastructure in a single region (us-central1, Iowa, USA) — we do not currently operate multi-region and have no near-term plan to.
• Anthropic and/or OpenAI — Sam, the in-app assistant, sends the relevant portion of your request (and the Service data needed to answer it) to one of these providers to generate a response. We use their business/API products, not their consumer chat products — under both providers’ standard API terms, data submitted through the API is not used to train their models, and is retained only briefly for abuse and safety monitoring before deletion.
• Google Maps Platform — place search and geocoding, when you look up or confirm a property address.
• Twilio SendGrid — delivery of transactional email.
• Third-party accounting or payment systems — only if a Tenant administrator explicitly connects one. When connected, relevant invoice and payment data syncs to that system, under its own privacy policy and the permissions the Tenant granted during that connection. We never connect one of these without explicit tenant action, and a Tenant can disconnect it at any time from Settings.
• Legal/safety disclosures — if required by law, subpoena, or to protect the rights, property, or safety of Slateworks, our users, or the public.

We do not share personal information with third parties for their own marketing purposes.

5. Data retention

We retain your Tenant’s business data for as long as the Tenant’s subscription is active, plus 90 days after termination or cancellation — enough time to export your data or reactivate the account before it’s deleted. After that window, data is deleted from active systems, subject to residual copies in backups that age out on their own retention schedule.

Retention here is not a substitute for your own legal recordkeeping obligations. As a contracting business, you may be independently required to retain certain records for periods set by tax law, your state’s contract/construction statute of limitations, mechanic’s lien deadlines, or payroll recordkeeping rules if you use the Service for field timekeeping. Those obligations are yours, not something this policy satisfies — export anything you need to keep before your subscription ends and the 90-day window closes.

You can request deletion of your account’s data at any time by contacting us (§9), subject to the legal/audit exceptions noted above.

6. How we protect your data

• Every Tenant’s data is isolated from every other Tenant’s at the database level (row-level security enforced on every table, fail-closed by design — a bug can hide data, it structurally cannot leak it across tenants).
• Sensitive credentials (e.g., a connected accounting system’s access tokens) are encrypted at rest, not stored in plain text.
• Access to the Service requires authentication; administrative actions are role-gated and logged.
• We use encryption in transit (HTTPS/TLS) for all Service traffic.

No system is perfectly secure, and we can’t guarantee absolute security, but protecting your data is a design requirement of this platform, not an afterthought.

7. Your choices and rights

• Tenant administrators control who on their team has access to the Service and can deactivate a user’s access at any time.
• You may request access to, correction of, or deletion of your personal information by contacting us at admin@slateworks.ai. Some information may be retained where required by law or legitimate business need (e.g., financial audit trails).
• California residents have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to non-discrimination for exercising these rights. We do not sell or “share” (as CCPA defines it) personal information, so there is no opt-out to exercise on that front. To make a request, contact us at admin@slateworks.ai; we will verify your identity before acting on it.
• We do not currently operate in, or knowingly serve customers in, the European Union or United Kingdom, so this policy does not attempt to address GDPR/UK GDPR obligations. If that changes, this policy will be updated before we do.

8. Children’s privacy

The Service is intended for business use by adults working in the construction industry. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.

9. Contact us

Questions about this policy or your data: admin@slateworks.ai

Slateworks, LLC
1003 Whaley St, Oceanside, CA 92054

10. Changes to this policy

We may update this policy as the Service evolves. We’ll post the updated version here with a new “Last updated” date, and for material changes, we’ll make reasonable efforts to notify Tenant administrators directly.