Privacy policy

BuiltSum collects the minimum needed to run an estimating and billing account: an email address to sign you in, and the project, estimate, billing and time data you choose to enter. There is no advertising, no sale of data, and no third-party analytics or tracking script on the site.

What the free tools store

The free calculators and document generators run in your browser. What you type into them is saved in your browser’s local storage on your device, not on our servers, unless you sign in and choose to file a document under a project. Clearing your browser data removes it. Embedded calculators on other websites behave the same way.

What an account stores

• Sign-in: your email address. Sign-in is passwordless; we email you a link and a one-time code and keep a hashed copy of the token until it is used or expires. We never hold a password.
• Profile and company: your name and company name if you enter them, and the team members an account owner adds by email address.
• Work data: projects, estimates, schedules of values, pay applications, change orders, retainage releases, invoices and payments recorded against them, job costs, purchase orders, RFIs, submittals, schedule tasks, daily logs and crew time entries. Client and general-contractor names and addresses appear in this data when you enter them.
• Share links: proposals, pay applications, invoices and project status pages you share are reachable by anyone who has the link’s unguessable token. They are excluded from search engines. You can stop sharing by issuing a new link.
• Cookies: two strictly necessary cookies, one holding your session and one indicating that you are signed in. Neither is used for tracking or advertising.

Payments

Card payments are processed by our payment provider, Lunastric, on Stripe’s infrastructure. Your card number never reaches BuiltSum. We receive and store the payment reference, amount, plan and date so your subscription can be activated and your receipts shown. Refunds and disputes are recorded against the same reference.

QuickBooks Online

If an account owner connects QuickBooks Online, we store the OAuth tokens Intuit issues for that company and use them only to create the invoices and customers you ask us to post, and to read back their identifiers so a period is never billed twice. Disconnecting removes the tokens. Intuit’s handling of your QuickBooks data is governed by Intuit’s own policies.

Who processes data on our behalf

• Vercel: hosting and request logs for the website and application.
• Supabase: the Postgres database that stores account and work data.
• Resend: transactional email (sign-in links, invitations, acceptance and certification notices).
• Lunastric with Stripe: card payments, as described above.
• Intuit: QuickBooks Online, only if you connect it.

Each processes data only to provide its service to us. We do not sell personal data and do not share it with advertisers or data brokers.

Email we send

All email is transactional: sign-in links and codes, team invitations, and notices when a client accepts a proposal or a pay application is certified. There is no marketing list.

Retention and deletion

Work data is kept while the account exists so billing history can be reconstructed. A paid plan that lapses drops to the free tier; nothing is deleted. To delete an account and all of its data, email hello@builtsum.com from the account’s address; deletion is completed within 30 days, except payment records we must retain for tax and accounting purposes. Sign-in tokens expire within minutes of issue and are removed when used.

Your rights

You can ask for a copy of your data, a correction, or deletion at any time at the address above. Estimates and pay applications can also be exported from the application as PDF, Excel or CSV without asking us. If you are in a jurisdiction that grants additional rights, we honour them on request.

Security

Data is encrypted in transit. Sign-in tokens are stored hashed. Access to the database is restricted to the application. Free-tool data never leaves your browser unless you choose to save it to an account. No system is perfectly secure; if you believe you have found a vulnerability, email us and we will respond.

Children

BuiltSum is a business tool and is not directed to anyone under 16.

Changes

When this policy changes, the effective date above changes with it. Material changes to how account data is used are announced by email to account owners before they take effect. Questions go to the contact page.