This Privacy Policy explains how [Company Legal Name] (“XactAudit,” “we,” “us”) collects, uses, discloses, and protects information when you use our website and Service. XactAudit is a business-to-business service for roofing contractors, public adjusters, and restoration professionals in the United States. It is not directed to consumers or to anyone under 18.
1. Our Role
For account, billing, and usage information about you and your business, we act as the business (controller) responsible for the information. For the claim documents and related data you upload, which may include personal information about policyholders and property owners, we act as your service provider (processor): we process that data only on your behalf and instructions to deliver the Service. You are responsible for having the authority and any required notices or consents to provide that information to us.
2. Information We Collect
Information you provide
- Account and business information: name, email address, password (stored by our authentication provider in hashed form), company name, address, phone, contractor license number, job title, and company logo.
- Claim and operational data (“Your Content”): uploaded documents such as carrier estimates and aerial measurement reports (PDF); the information inside them, which may include insured and policyholder names, property addresses, claim and policy numbers, dates of loss, adjuster names and emails, line items, measurements, and prices; any other files, photos, or notes you choose to upload; and edits, approvals, and claim status you enter.
- Support communications: messages you send us and their contents.
Information from payment processing
Payments are handled by Stripe. We do not receive or store full payment card numbers. We store a Stripe customer identifier, your plan, subscription status, billing-period information, purchase and credit history, and transaction metadata Stripe provides.
Information collected automatically
- Usage and device data: IP address, browser and device type, pages and features used, timestamps, and error logs, generated by our hosting and application infrastructure.
- Cookies: we use essential cookies to keep you signed in and secure your session. We do not currently use advertising cookies or third-party advertising trackers, and we do not track you across other websites. [Update this section if analytics tools are added.]
3. How We Use Information
- To provide the Service: store your claims, analyze the documents you upload, generate line-item suggestions and supplement PDFs, and display results to you.
- To process payments, manage subscriptions and credits, and prevent fraud and abuse.
- To authenticate users, secure the Service, troubleshoot, and provide support.
- To communicate with you about your account, billing, security, and Service changes.
- To improve and maintain the Service using aggregated or de-identified information that does not identify you, your customers, or any property.
- To comply with law and enforce our Terms of Service.
We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use Your Content to build advertising profiles. We do not knowingly use uploaded claim data to train our own or third-party general-purpose AI models.
4. Automated Analysis (AI Providers)
To analyze your documents, we send them, together with our instructions, to an AI model provider (currently Anthropic) through its commercial API. Those providers process the content only to return results to us. [Verify against the provider’s current commercial terms and update: under Anthropic’s commercial terms, API inputs and outputs are not used to train its models by default.] To determine locally enforced building code requirements, we may also run automated web searches. Those searches contain only jurisdiction information (city, state, ZIP code), not customer names, claim numbers, or documents. Results of these searches may be stored and reused for other users in the same jurisdiction.
5. Who We Share Information With
We share information only with service providers that help us run the Service, under contracts that limit their use of it, and in the situations listed below.
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Database, authentication, and private file storage | Account data, claims, uploaded PDFs, logos |
| Vercel | Application hosting and delivery | Requests, IP addresses, logs; data in transit |
| Anthropic | Automated document analysis and jurisdiction research | Uploaded claim documents (analysis); jurisdiction details only (code research) |
| Stripe | Payment processing and billing portal | Name, email, payment details, subscription and purchase data |
We may also disclose information (a) to comply with law, legal process, or a government request; (b) to protect the rights, property, or safety of XactAudit, our users, or others; (c) in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; and (d) with your direction or consent. When you export a supplement PDF and send it to a carrier or adjuster, that transmission is made by you, not by us.
6. Data Retention
- Claims and uploaded documents: kept until you delete them or close your account. You can delete a claim, which removes its record and its uploaded PDFs, from within the app at any time.
- Account closure: on closure or verified request, we will delete or de-identify your account data and Your Content within [30] days, except where we must retain it by law or for legitimate purposes described here. Copies in routine backups are overwritten within [35] days.
- Billing and tax records: retained for [7] years or as required by law.
- Logs and security records: retained for [90] days unless needed longer to investigate abuse or incidents.
- Jurisdiction research cache: contains no customer data and is refreshed periodically.
7. Security
We use reasonable safeguards designed to protect commercial inspection and claim records, including encryption in transit (HTTPS/TLS); private, access-controlled file storage; per-account database access controls so users can see only their own records; separation of server-side secrets from the browser; and signature verification on payment webhooks. Our infrastructure providers maintain their own security programs and encryption at rest. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you as required by applicable law.
8. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; request deletion of your personal information; correct inaccurate information; opt out of the sale or sharing of personal information (we do not sell or share it); limit the use of sensitive personal information (we do not use it beyond what is necessary to provide the Service); and not be discriminated against for exercising these rights.
Categories in the past 12 months: identifiers (name, email, IP address); customer and commercial information (plan, purchase history); professional information (company, license number); internet or network activity (usage and logs); and, within Your Content, information about policyholders and properties (such as names, addresses, and claim details) that you provide. We collect these directly from you, from your use of the Service, and from our payment processor, for the purposes in Section 3, and disclose them to the service providers in Section 5.
To exercise a right, email [support@your-domain.com]. We will verify your request, and we will respond within 45 days (extendable once by 45 days where permitted). You may use an authorized agent with written permission. If your information is in a claim file uploaded by one of our business customers, we process it on that customer’s behalf, so we may direct your request to that customer. Residents of other states may have similar rights; contact us and we will review your request under the law that applies to you.
9. Your Choices
You can update your company information and delete claims in the app. You can cancel a subscription from the billing portal. You can ask us to close your account and delete your data by emailing us. You may opt out of non-essential emails; we will still send service, security, and billing messages.
10. Children
The Service is not directed to children under 18 and we do not knowingly collect their personal information.
11. Data Location
The Service is operated in the United States and is intended for U.S. users. Information is processed and stored in the United States and any other locations where our providers operate. [Confirm hosting regions.]
12. Changes to This Policy
We may update this Privacy Policy. We will post the new version here with a new effective date and, for material changes, notify you by email or in the Service. Please review it periodically.
13. Contact
[Company Legal Name]
[Mailing Address]
[support@your-domain.com]