Copperleaf Build — Privacy Policy

Last updated: July 15, 2026 Effective date: July 15, 2026

1. Who we are

Copperleaf Build ("Copperleaf Build", "we", "us", or "our") is a construction-management software service operated by Copperleaf Developments Ltd. of British Columbia, Canada. We offer the Service to customers in Canada and the United States. This Privacy Policy explains what personal information we collect, how we use and protect it, and the choices you have.

If you have questions about this policy or your information, contact us at support@copperleafbuild.com.

This policy applies to the Copperleaf Build web application and related services (the "Service"). It does not apply to third-party websites or services we link to.

2. Who this policy covers

• Account owners and administrators — the people who sign up a company and manage it.
• Team members / employees — people added to a company account who log in to track time, file daily logs, and so on.
• Visitors — people who use our website or sign-up pages.

If you are an employee added to a company's account, your employer (the account owner) decides what information to enter about you and is responsible for that data. We process it on their behalf.

3. Information we collect

Information you provide directly:

• Account information — your name, email address, company name, and password (passwords are stored only as a secure one-way hash, never in plain text).
• Company and project data — projects, schedules, tasks, daily logs, estimates, invoices, change orders, expenses, and budgets you enter.
• Team information — employee names, contact details, time entries, and pay-related settings entered by the account administrator.
• Crew tax identification numbers. If an account administrator chooses to record a crew member's government tax identification number (for example, a Social Insurance Number) for payroll and year-end purposes, we handle it as follows: it is encrypted with AES-256-GCM before it is stored, and it is never returned to any browser or device in full — the application decrypts it only on our server to display a masked value showing the last three digits (for example, •••-•••-123). Only an account administrator, or a user your administrator has granted crew-management permission, can see even that masked value; for everyone else the field is removed entirely. It is never included in any export, report, or year-end file. Recording this number is optional and is your administrator's choice.
• Subcontractor and supplier information — business names, contacts, and tax details you choose to record, such as tax registration and business numbers. For subcontractors and suppliers we do not store a personal tax identification number at all — the application records only a yes/no flag noting whether you hold one in your own records, and there is no field in which such a number can be saved.
• Photos and files — jobsite photos and documents you upload.
• Billing information — your plan selection, billing contact email, and the billing address you provide (used to calculate the correct sales tax for your location). Subscription payments are processed by Stripe (see Section 5). We do not collect or store full credit-card or bank-account numbers ourselves — card details are entered directly with Stripe and handled under Stripe's own privacy policy.

Information collected automatically:

• Basic technical data needed to operate and secure the Service, such as log information and session data.

4. How we use your information

We use personal information to:

• Provide, operate, and maintain the Service;
• Authenticate logins and keep accounts secure;
• Create and send subscription invoices and process plan changes, cancellations, and refunds;
• Support payroll and year-end record-keeping for the crew and subcontractors you enter, including any tax identification number your administrator chooses to record;
• Generate features you request, such as AI-assisted daily site reports;
• Send transactional emails (for example, password resets, invitations, and billing notices);
• Provide customer support; and
• Comply with our legal obligations.

We do not sell your personal information, and we do not use your project or company data to advertise to you.

5. Service providers (sub-processors)

We use trusted third parties to run the Service. They may process your information only as needed to provide their service to us:

Provider	Purpose	Data involved
Replit	Application hosting and database	All account and app data
Google Cloud Storage	Storage of uploaded photos and files	Photos, documents
Resend	Sending transactional email	Email addresses, message content
Stripe	Subscription payment processing, invoicing, and sales-tax calculation	Billing contact, billing address, card details (entered directly with Stripe), payment and invoice records
Intuit (QuickBooks Online)	Optional, only if you connect it: pushing your own invoices and estimates from the Service to your QuickBooks account	Only the invoice/estimate and customer records you choose to push
OpenAI	AI-assisted daily report generation	Daily-log content you submit for summarization

We may update this list as our service evolves; we will keep this section current.

6. AI features

When you use AI-assisted features (such as daily site reports), the relevant content you submit is sent to our AI provider to generate the output, which is then returned to you. This content is submitted through the provider's business API, and under that API's terms it is not used to train the provider's AI models. We will update this section if that arrangement changes.

7. How we share information

We share personal information only:

• With the service providers listed above;
• Within your company account, as designed (for example, administrators can see team time entries);
• When required by law, such as a valid legal request; or
• In connection with a business transfer (such as a merger or acquisition), in which case we will notify you.

8. Data location and cross-border transfers

Your information may be stored or processed on servers located outside of Canada, including in the United States, depending on where our service providers operate. Where information is transferred across borders, it may be subject to the laws of those jurisdictions, including lawful access by courts, law enforcement, and government authorities in those countries.

9. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Service. After an account is closed, we retain data for 90 days to allow for reactivation and to meet legal, tax, and accounting obligations, after which we delete or anonymize it. Billing and invoice records may be retained longer where required by tax law.

Crew tax identification numbers. An encrypted crew tax identification number is stored only for as long as that crew member's record exists. When an administrator deletes a crew member, the record and the encrypted number are permanently deleted with it. We do not currently apply a separate automatic expiry to this number while the crew record remains active, so we recommend that administrators remove crew records they no longer need. Administrators can also clear the number at any time by editing the crew member.

10. Security

We protect your information with measures including encrypted connections, hashed passwords, access controls that wall off each company's data from others, and encryption of sensitive integration credentials at rest. Crew tax identification numbers are encrypted at rest using AES-256-GCM, are never transmitted back to a browser in full, and are restricted to administrators and users granted crew-management permission. No system is perfectly secure, but we work to protect your information and to address issues promptly.

Security incident notification. If we become aware of a security incident affecting your personal information, we will investigate promptly and provide any notifications required by applicable law — including, where applicable, notifying affected users and the Office of the Privacy Commissioner of Canada under PIPEDA.

11. Your rights and choices

Depending on your location, you may have the right to access, correct, or delete your personal information, or to withdraw consent. To make a request, contact support@copperleafbuild.com.

If you are an employee on a company account, please direct requests to your employer (the account owner) first, since they control that data. We will assist account owners in fulfilling such requests.

If you are in the United States: depending on your state, you may have rights under state privacy laws (such as the California Consumer Privacy Act/CPRA and similar laws in other states) to know what personal information we collect, to request access to or deletion of it, to correct it, and not to be discriminated against for exercising those rights. As stated above, we do not sell your personal information and we do not share it for cross-context behavioral advertising. To exercise any of these rights, contact support@copperleafbuild.com. We will verify your request before acting on it.

Canadian residents who are not satisfied with our response may contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

12. Children

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children under 18.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice where appropriate.

14. Contact us

Copperleaf Developments Ltd. British Columbia, Canada Email: support@copperleafbuild.com