Privacy Policy

SP4N, Inc. ("SP4N", "we", "us", "our") operates a software-as-a-service platform that uses artificial intelligence to analyze construction project schedules, contracts, vendor data, weather exposure, and related operational data on behalf of construction-industry customers (general contractors, subcontractors, developers, owners, consultants, and similar parties).

This Privacy Policy explains what personal information we process, why we process it, who we share it with, how long we keep it, and the rights you have. It applies to:

• Customers - the legal entities that purchase a SP4N subscription.
• Named users - the individual people who log in to a customer workspace.
• Website visitors - anyone browsing our marketing site, including prospective customers and applicants.
• Communication contacts - recipients of our email, sales, and support communications.

Roles under data-protection law. When we process personal data that a customer uploads to or generates within their SP4N workspace, we act as a processor (or "service provider" under the CCPA) on the customer's behalf, governed by our Data Processing Agreement (the "DPA"). When we process personal data of website visitors, applicants, prospective customers, or for our own business operations (billing, security, product analytics), we act as an independent controller (or "business" under the CCPA).

Contact. Privacy questions, rights requests, and data-subject correspondence should be submitted through the contact form.

We collect the following categories of information. Categories marked (processor) are collected on a customer's behalf and are governed primarily by the DPA between SP4N, Inc. and that customer.

Account and identity data.

• Name, work email, phone number, company name, industry, business address.
• Hashed credentials handled by our managed identity layer; we never see your plaintext password.
• Workspace role, seat assignment, invitation tokens.
• If you sign in via a third-party identity provider (e.g. Google), the OAuth identifier and the basic profile fields that provider returns.

Customer content (processor).

• Construction project data you create or upload - schedules (P6 XER/XML, MS Project, Smartsheet exports), drawings, RFIs, submittals, contracts, cost reports, change orders, vendor lists, photographs.
• Project metadata - project name, jobsite latitude/longitude, owner, contractor team, milestones, dollar values.
• Personal data incidentally contained within those files (e.g. names and signatures on RFIs, vendor contacts, named superintendents on schedules).
• Engine outputs we derive on your behalf - schedule analyses, risk scores, vendor-risk briefs, weather windows, contract findings, cost forecasts.

Billing and payment data.

• Subscription tier, billing email, billing address, plan history, invoice records.
• Payment-method details are collected directly by our payment processor on SP4N's behalf. SP4N stores only the processor customer ID, subscription ID, last-four digits of the card, brand, and billing status; we do not store full card numbers or CVCs on our infrastructure.

Integration data (only if you connect an integration).

• Connection credentials, refresh tokens, and minimum-necessary scopes for Procore, Autodesk Construction Cloud, Primavera, and other configured systems you authorize.
• Project data we read from those systems on your documented instruction (e.g. RFI lists from Procore, drawing sets from Autodesk Docs, and schedule records from Primavera).
• We disconnect (revoke) tokens immediately when you remove an integration; the corresponding cached data is deleted within 30 days.

Usage and product-telemetry data.

• Pages visited, features used, session duration, performance metrics, error reports.
• Engine run counts, token consumption, daily-refresh activity, export counts (used for capacity, billing, and abuse-detection purposes).
• Approximate IP-based geolocation and user-agent string, captured automatically by our hosting provider for security and analytics.

Analytics and session-replay data.

• We use consented Google Analytics and PostHog event telemetry on our public site and authenticated app to understand feature usage and where users get stuck.
• Microsoft Clarity session replay is limited to public marketing, sign-in, account-creation, and legal pages. It is never loaded in the authenticated app, admin surfaces, or customer project and document workspaces.
• Form inputs and editable fields are masked before Clarity loads. Google Analytics, PostHog, and Clarity are all excluded on 404 or unknown paths and whenever a public page URL still contains query parameters or a fragment after recognized invitation fields are removed.
• All non-essential analytics are gated behind your cookie-consent choice (see Section 9).

Communications.

• Records of your support requests, demo requests, newsletter sign-ups, contact-form submissions, and email correspondence.
• Transactional email delivery telemetry (whether a billing or verification email was delivered, bounced, or opened) provided by our email vendor.

Third-party public data we ingest on a project's behalf.

• NOAA weather observations and forecasts, joined to a project's lat/long.
• SEC EDGAR filings for vendor / owner due-diligence enrichment.
• OSHA establishment and inspection records for vendor-risk scoring.
• SAM.gov federal-award and exclusion records.

These sources are public records. We retrieve them with publicly available APIs and treat them as factual reference data, not personal data we have collected from you.

We process personal data only for the purposes set out below. For users in the European Economic Area, the United Kingdom, and Switzerland, the corresponding GDPR / UK GDPR legal basis is shown in parentheses.

• Provide the Service - authenticating users, hosting workspaces, running schedule and risk analyses, generating outputs, processing payments, sending transactional email (performance of a contract).
• Operate, secure, and improve the Service - diagnostics, debugging, performance monitoring, abuse and fraud detection, security incident response, capacity planning (legitimate interests in operating a secure, reliable product).
• Billing and tax - invoicing, dunning, chargeback handling, revenue recognition, statutory bookkeeping (performance of a contract and legal obligation).
• Customer support - responding to your tickets, troubleshooting, walking through outputs, restoring data (performance of a contract).
• Product analytics - understanding feature usage to prioritize the roadmap, identifying drop-off and error patterns (legitimate interests; for non-essential cookies, also consent).
• Marketing and sales - sending product updates and offers to customers and prospects who have opted in, attributing inbound demand (consent for marketing email; legitimate interests for B2B sales prospecting in jurisdictions that permit it).
• Legal and compliance - responding to lawful requests, enforcing our Terms, defending claims, complying with anti-money-laundering, sanctions, and export rules (legal obligation and legitimate interests).

We do not engage in solely-automated decision-making that produces legal or similarly significant effects on you. Engine outputs are advisory only; a human user always reviews and decides whether to act on them.

SP4N's engine is powered by large language models (LLMs) and supporting machine-learning infrastructure. Because this is the most sensitive area of our data practices, we are explicit about what we do and do not do.

What we do:

• We send relevant portions of your project data to our LLM inference provider so that the engine can reason about your schedule, contracts, vendor risk, weather exposure, cost data, and similar inputs.
• We use prompt caching to reduce cost and latency. Cached prompts contain your project data; cached entries are scoped to SP4N's provider account and time out under the provider's cache policy.
• We may use de-identified, aggregated operational telemetry - such as finding acceptance rates, parser success rates, latency, error categories, and feature usage - to improve product heuristics, extraction logic, scoring systems, and model-evaluation workflows.
• Customer documents, schedules, contracts, drawings, and workspace-specific engine outputs are not shared across workspaces or used to train foundation models.
• We log engine invocations (project ID, token counts, timestamps, model version, success/failure) for billing, capacity, and quality reasons.
• We store the engine's outputs (the analysis, summary, recommendation, risk score, etc.) in your workspace so that you can view, compare, and export them.

What we do not do:

• We do not use personal information to train or otherwise improve AI models. Account and identity data, billing data, contact details, support communications, authentication data, analytics/session data, and other personal information unrelated to construction intelligence are excluded from model-improvement datasets.
• We have configured our LLM provider account so that customer content sent for inference is not used by that provider to train or otherwise improve any model. This is a commitment to SP4N's configuration, not just to the provider's default policy; if provider defaults change, our configuration remains the binding constraint.
• We do not sell or "share" customer content for advertising or cross-context behavioral advertising.
• We do not blend one customer's content with another customer's content. Workspaces are isolated at the database row and security-rule level; engine prompts and caches are scoped per project.
• We do not allow our personnel to read your project content except (a) when you ask us to (e.g. you open a support ticket and authorize us to look), (b) to investigate a security incident, or (c) to respond to a legally compelled request.

Output reliability disclosure. LLMs can be miscalibrated and can produce incorrect or misleading output. We design the engine to surface confidence indicators and to require human review before any output is acted on (see our Terms of Service, "AI Advisory Disclosure"). You are responsible for validating outputs before relying on them.

We share personal data only in the following categories of circumstance. We do not sell personal data, and we do not "share" personal data for cross-context behavioral advertising as those terms are defined under the CPRA.

• Sub-processors and infrastructure providers. Our hosting, AI, payment, email, and analytics providers process data on our behalf under written contracts. The current vendor list is available through legal/procurement review under NDA rather than published on the public website.
• Integrations you initiate. When you connect Procore, Autodesk, Primavera, or another configured system, we read from and (where applicable) write to those systems on your instruction. Those vendors are independent controllers for the data they hold; their privacy policies govern that data.
• Your own workspace members. Project content uploaded by one user inside a workspace is visible to other authorized users in that workspace consistent with the role configuration the customer administrator has set.
• Compelled disclosure. We disclose personal data when required by valid legal process (e.g. a subpoena, court order, or law-enforcement request that is legally enforceable against us). We push back on overbroad requests, and where we are not legally prohibited from doing so we will notify the affected customer before disclosing.
• Corporate transactions. If SP4N is involved in a merger, acquisition, financing, reorganization, or sale of substantially all of its assets, personal data may be transferred to the surviving entity or acquirer, subject to this Privacy Policy or a successor policy that is at least as protective.
• With your consent or at your direction. Any other disclosure occurs only when you specifically tell us to (e.g. you ask us to forward a contract to a named reviewer).

Every sub-processor is bound by a written data-processing agreement that imposes obligations no less protective than those we owe our customers, including confidentiality, security, breach notification, and an obligation to process only on documented instructions.

SP4N, Inc. operates from the United States. Personal data we collect is processed and stored in the United States on managed cloud infrastructure. Several of our sub-processors operate in multiple regions including the United States and the European Economic Area.

When personal data of an EEA, UK, or Swiss data subject is transferred to the United States or another country that has not been designated as providing an adequate level of protection, we rely on appropriate safeguards, principally:

• The EU Standard Contractual Clauses (Module 2 or Module 3 as applicable) and the UK International Data Transfer Addendum, incorporated by reference into our DPA and into the contracts we hold with our sub-processors.
• Where available, the EU-U.S. Data Privacy Framework and the UK Extension thereto with sub-processors that participate in it.
• Encryption in transit and at rest, and access controls that minimise the personal data exposed.

You can request a copy of the relevant transfer-safeguard documentation through the contact form.

We retain personal data only as long as we need it for the purposes set out in this policy or for as long as we are legally required to. Specific retention periods:

• Customer content (in-workspace data, projects, files, engine outputs) - retained for the term of the customer's subscription. After termination, customer content is available for export for 30 days, then irreversibly deleted from production systems within 60 days, and purged from encrypted backups within an additional 90 days.
• Account and identity records - retained for the life of the account plus 24 months after closure, then deleted (or anonymised) subject to any legal hold.
• Billing and tax records - retained for 7 years to comply with US tax and accounting recordkeeping requirements.
• Security and audit logs - retained for 13 months.
• Email marketing data - retained until you unsubscribe; suppression record kept indefinitely so we honor your opt-out.
• Cookie / analytics data - retained per the vendor's default, generally 14 to 26 months; aggregate, deidentified reports may be retained longer.
• Demo, contact-form, and early-access submissions - retained for up to 36 months unless you ask us to delete sooner.

A customer may instruct us to delete specific records earlier. We will comply unless we are legally required to keep them (e.g. tax records, fraud-prevention records, records subject to an active legal hold).

We implement administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and loss. Our current measures include:

• TLS 1.3 in transit; AES-256 at rest on managed cloud infrastructure.
• Workspace-level data isolation enforced through database and object-storage access controls; every authenticated read and write is matched against the requesting user's UID and workspace membership.
• Identity managed through a managed authentication layer; password-strength enforcement; rate-limiting on signup and signup-adjacent endpoints to mitigate credential-stuffing and enumeration; optional SSO and SCIM on higher tiers.
• Application secrets stored in managed secret storage; rotated when personnel change.
• Least-privilege engineering access; production access is auditable and limited to the personnel who require it for their role.
• Vulnerability monitoring on dependencies; security patches applied on a documented cadence.
• Independent code review and pre-deploy audits, with a documented incident-response process for security events.

SOC 2 status. SP4N is preparing for an independent SOC 2 Type II examination. Until the report is issued, we provide current security architecture documentation, sub-processor details, and applicable third-party assurance reports under NDA on request.

Breach notification. If we determine that a security event has resulted in unauthorized access to or disclosure of personal data, we will notify the affected customer without undue delay, and in any event within 72 hours of becoming aware of the event where required by applicable law, with the information needed to comply with the customer's own notification obligations.

We use cookies, localStorage, and similar technologies in four categories:

• Strictly necessary - authentication, session integrity, security, CSRF protection, load balancing, your saved cookie-consent choice. These cannot be turned off in our product.
• Functional - remembering your dashboard preferences, last-viewed project, and similar usability state.
• Analytics - analytics and usability tooling used to understand usage patterns and improve the product.
• Marketing - limited attribution cookies on the marketing site to measure inbound campaigns. SP4N does not run cross-context behavioral advertising.

On your first visit you will see a consent banner. Non-essential cookies (Analytics and Marketing) are loaded only after you accept them. Strictly-necessary cookies are loaded regardless because the product cannot function without them. You can change or withdraw your choice at any time by clicking "Cookie preferences" in the footer.

Most browsers honor Global Privacy Control (GPC). We treat a GPC signal as a "do not sell or share" opt-out under the CCPA / CPRA and, in our case, as a request not to load non-essential analytics.

Depending on where you live, you may have some or all of the following rights with respect to personal data we hold about you as a controller:

• Access - a copy of the personal data we hold about you.
• Rectification - to correct inaccurate or incomplete data.
• Erasure - to ask us to delete data we no longer need to retain.
• Restriction and objection - to limit, or object to, certain processing including direct marketing.
• Portability - to receive your data in a structured, commonly used machine-readable format.
• Withdraw consent - where we rely on consent, you can withdraw it at any time without affecting prior lawful processing.
• Lodge a complaint - with your supervisory authority (in the EEA / UK) or attorney general (in many US states).

CCPA / CPRA specific rights (California residents). You also have the right to know the categories and specific pieces of personal information collected, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" (we do not sell or share, as defined), the right to limit use of "sensitive personal information" (we do not collect or use sensitive personal information for the purpose of inferring characteristics), and the right not to be retaliated against for exercising these rights. We honor verifiable consumer rights requests regardless of whether we qualify as a covered "business" under the statute.

Notice at Collection - CCPA / CPRA categories. In the prior twelve months, we have collected the following statutory categories of personal information, from the sources, for the business purposes, and disclosed to the categories of third parties listed in this Policy (we have not sold or shared any of these for cross-context behavioral advertising, and we have not used "sensitive personal information" to infer characteristics):

• Identifiers (§ 1798.140(v)(1)(A)) - name, email, phone, business address, IP, account ID, payment processor customer ID, OAuth IDs.
• Customer records (§ 1798.140(v)(1)(B)) - billing details, company affiliation, role.
• Commercial information (§ 1798.140(v)(1)(D)) - subscription plan, billing history, support-ticket history.
• Internet or other electronic network activity (§ 1798.140(v)(1)(F)) - pages visited, features used, click events, session timing, performance telemetry, session replay (where you've accepted analytics cookies).
• Geolocation data (§ 1798.140(v)(1)(G)) - approximate IP-based location of website visitors and the jobsite lat/long of projects you create. We do not collect device-precise location of named individuals.
• Professional or employment-related information (§ 1798.140(v)(1)(I)) - your job title, company, and project role.
• Inferences (§ 1798.140(v)(1)(K)) - engine outputs we generate from your project data (risk scores, delay forecasts, vendor briefs) sit in your workspace and are not used to build a consumer profile.

We do not knowingly collect categories § 1798.140(v)(1)(C) (characteristics of protected classifications), (E) (biometric), (H) (audio/visual/sensory beyond drawings you upload), (J) (education records), or "Sensitive Personal Information" as defined in § 1798.140(ae), for any purpose other than to perform the Service or as expressly permitted by the consumer.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will verify the agent's authority before acting.

How to exercise a right. Submit a request through the contact form from the address on file (or include sufficient information for us to verify your identity to a reasonable degree of certainty). We respond within 30 days; we may extend that period by a further 60 days for complex requests and will tell you if we do.

If you are a named user of a customer workspace, the customer is the controller of your workspace data. Send rights requests for that data to the customer; we will support the customer in responding to you.

SP4N is a business-to-business platform intended for use by construction-industry professionals. We do not knowingly collect personal data from individuals under 16. If you believe a child has provided us personal data, please submit a request through the contact form and we will delete it.

SP4N's engine produces recommendations, classifications, and risk scores using AI reasoning. These outputs are advisory only - they are presented to a human user who decides whether to act on them. SP4N does not use these outputs to make decisions that produce legal or similarly significant effects on a data subject without human involvement.

If, in the future, SP4N introduces a feature that does engage in solely-automated decision-making with legal or similarly significant effects, we will obtain the necessary legal basis, explain the logic involved and the significance and envisaged consequences, and provide a meaningful right to obtain human intervention, before activating that feature for any data subject covered by the GDPR or analogous laws.

We may update this Privacy Policy from time to time. The "Version" stamp at the top of this page identifies the current version. When we make material changes, we will (a) update the version stamp and effective date, (b) notify customers by in-product banner and / or email to the administrator on file at least 30 days before the change takes effect for them, and (c) update any references in our DPA accordingly. The 30-day notice does not apply to the initial publication of this Policy (version 2026-05-12), which is effective on the date posted.

Continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree to an update, you may terminate your subscription per the Terms of Service.

Privacy questions, rights requests, or DPA execution:

Submit through the contact form

SP4N, Inc. — B2B SaaS for construction project intelligence.
Operated in the United States.

Our core market is US construction-industry businesses. We do not specifically target individuals in the European Economic Area or the United Kingdom, and we do not consider ourselves to be "offering goods or services" to EEA / UK data subjects within the meaning of Article 3(2) GDPR. If an EEA-based or UK-based contracting entity becomes a customer and the application of Article 27 (or its UK equivalent) is contested or clarified, we will designate a representative for that customer's relationship at no additional charge - contact us at the email above to coordinate.