Privacy Policy

OttoStruct, Inc. (“OttoStruct,” “we,” “us”) provides AI-native construction management software at ottostruct.com and its subdomains (the “Service”). This policy explains what we do with personal information when you visit our website, create an account, or use the Service.

Our role depends on the data. For your account details, billing records, and how you use the Service, we are the controller and this policy governs. For the project content your organization uploads — drawings, specifications, submittals, RFIs, daily journals, and the names and contact details of project team members and subcontractors inside them — we are a processor acting on your organization’s instructions. That organization is the controller and its own privacy notice governs. If you are a project team member or subcontractor whose details were uploaded by a contractor using OttoStruct, please direct your request to that contractor; we will help them respond.

This policy does not cover third-party sites we link to, or the systems you choose to push data into through an integration. Once data leaves OttoStruct for a connected system, that system’s privacy policy applies.

Account and profile information

When you register we collect your name, email address, and organization. If you sign in with Google, Microsoft, Facebook, or X, we receive your basic profile and email from that provider — never your password. We store authentication records, your role and permissions, and your plan and project allowance.

Project content you upload

The Service exists to process construction documents, so we store the files you upload and the structured data our pipeline extracts from them: drawings, specifications, submittal packages, RFIs, revisions, schedules, closeout documents, and the search indexes built from their text. These files frequently contain personal information about other people, such as the names, job titles, email addresses, and phone numbers of architects, engineers, and subcontractor contacts.

Site and daily journal data

If you use daily journals, we store the site name and address, your notes and logged events, weather and temperature, attachments including site photographs, and the submission record of each filed report. When you enter a site address we send it to Google Geocoding and store the returned coordinates and normalized address. We do not track the live location of your device.

Billing information

Subscription payments are handled by Stripe. Stripe collects and stores your card details directly; we never receive or store full payment card numbers. We retain your subscription status, plan, invoices, and billing contact.

Usage, device, and log data

We automatically collect IP address, browser and device type, pages and features used, timestamps, referring pages, and error and performance diagnostics. Our servers keep application logs for security and troubleshooting.

Contact and support

If you submit our contact form we collect your name, email address, and optional phone number, and we run Google reCAPTCHA to filter spam — which means Google receives device and interaction signals from that page under its privacy policy. Emails you send us and support conversations are retained so we can answer you.

We use information to:

• Provide, operate, and maintain the Service, including processing and indexing the documents you upload.
• Authenticate you, enforce permissions, and keep accounts secure.
• Process payments, manage subscriptions, and send invoices.
• Send transactional messages such as journal submissions, notifications, and service announcements.
• Diagnose problems, monitor reliability, and improve the performance and usability of the Service.
• Respond to your questions and provide support.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms and Conditions.

We may create de-identified and aggregated data — statistics that cannot reasonably be used to identify you, your organization, or any project — and use it to understand usage patterns and improve the product. We maintain de-identified data in that form and will not attempt to re-identify it except to test that the de-identification holds.

We do not sell personal information and we do not use it to build advertising profiles or to target advertising at you as an individual. We may show contextual sponsored content as described in section 7.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:

• Performance of a contract — to give you the Service you or your employer signed up for, including account management and billing.
• Legitimate interests — to secure the Service, prevent abuse, understand how features are used, improve the product, and fund it through contextual sponsorship that involves no profiling, where those interests are not overridden by your rights.
• Consent — for non-essential analytics and session replay where consent is required, and for any marketing email. You may withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests.

OttoStruct uses artificial intelligence to read construction documents and turn them into structured, searchable records. Depending on the task, content is sent to our AI vendors — Google (Vertex AI, Gemini, Document AI), OpenAI, and Anthropic — which process it and return results to us.

We do not use your project content to train AI models, and our AI vendors are contractually prohibited from using it to train theirs. Content is sent under enterprise API terms that exclude training, and is retained by those vendors only as long as needed to return a result and to meet their limited abuse-detection obligations.

We do use de-identified and aggregated data to improve our own features — for example measuring how often an extraction step needs correction, or how long a document takes to process. This data is stripped of identifiers and is not your documents.

AI output can be wrong. The Service produces drafts and extractions for review by qualified people; we do not make automated decisions that produce legal or similarly significant effects about you.

Essential cookies and local storage keep you signed in, remember your preferences, and protect against abuse. The Service will not function without them.

Product analytics and session replay. We use PostHog to understand how the Service is used and to reproduce problems. This includes recordings of interactions with our interface — clicks, navigation, and scrolling. Recordings are configured to mask text entered into form fields, and we do not use them to monitor individual productivity. Where consent is required by law, we collect it before enabling analytics and replay.

You can block or delete cookies in your browser settings, though doing so may break parts of the Service. Because there is no common standard for honoring them, we do not currently respond to browser Do Not Track signals; we do honor recognized opt-out preference signals such as Global Privacy Control where required by law.

We may display sponsored or promotional content in the Service — for example, material from a product manufacturer, supplier, or trade partner.

Any such advertising is contextual, not targeted at you. Sponsored content is selected from the subject matter at hand — the trade, specification division, or document type in view — in the same way an advertisement in a trade magazine is matched to the article beside it. It is not selected using your identity, your profile, your role, your employer, your inferred interests, or your behavior across other websites and apps.

• We do not build advertising or marketing profiles about you.
• We do not allow advertisers or ad networks to place cookies, pixels, or other tracking technologies that follow you across other sites and apps.
• Advertisers receive aggregate reporting such as total impressions and clicks. They do not receive your personal information, your identity, or your project content.
• Selection uses only coarse category signals about what is on screen, such as trade or specification division. We do not mine the substance of your documents or daily journals for advertising, and sponsors never learn which organization or project an impression came from.

Because this advertising is not based on personal information and is not cross-context behavioral advertising, it is not a “sale” or a “share” under US state privacy laws, and it does not involve profiling under the GDPR. If we ever intend to advertise in a way that is based on personal information, we will update this policy and obtain your consent or offer you an opt-out before we begin.

We share personal information only as described here. We do not sell it, and we do not share it for cross-context behavioral advertising.

• Within your organization. Project data is visible to other members of your organization according to the permissions your administrators set.
• Service providers (sub-processors). The vendors listed below process data on our behalf under contracts that limit them to our instructions.
• Connected systems you choose. If you enable an integration and push records to another platform, we send the data you selected to it at your direction. These pushes are one-way and cannot be undone from OttoStruct.
• Advertisers and sponsors. Where we show the contextual sponsored content described in section 7, sponsors receive aggregate performance reporting only — never your personal information or project content.
• Legal and safety. We may disclose information when required by law, or to protect the rights, property, or safety of OttoStruct, our customers, or the public.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may transfer with the business. We will notify you before your information becomes subject to a materially different policy.

Our sub-processors

A small number of vendors process data on our behalf so we can run the Service. They fall into these categories: cloud hosting, storage, and authentication; AI document understanding and extraction; address geocoding; spam and abuse prevention; payment processing; transactional email; and product analytics. Each is bound by a contract that limits it to our instructions, and all of them currently process data in the United States.

OttoStruct is operated from the United States and our infrastructure and sub-processors are located there. If you use the Service from the EEA, the United Kingdom, or elsewhere outside the United States, your information will be transferred to and processed in the United States, which may not offer the same level of data protection as your home country.

Where required, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with technical and organizational safeguards, as the legal mechanism for these transfers. You may request a copy of the relevant clauses using the contact details below.

EEA and UK representatives under Article 27 GDPR: [EU representative name and address], [UK representative name and address].

We keep information for as long as your account is active and as long as needed for the purposes described in this policy.

• Project content is kept until you or your organization deletes it, or until 90 days after your subscription ends, after which it is deleted from our active systems.
• Account records are kept for the life of the account and for a short period afterward so the account can be restored.
• Billing and tax records are kept for as long as financial law requires, typically seven years.
• Logs, analytics, and session recordings are kept for up to 12 months.

Backups are deleted on a rolling schedule, so deleted data may persist in encrypted backups for a limited period after removal from our active systems.

We encrypt data in transit with TLS and at rest in Google Cloud. Access to production data is restricted to personnel who need it, authentication is handled by Firebase Authentication, and every API request is checked against your organization and role permissions before data is returned.

No system is perfectly secure. You are responsible for keeping your credentials confidential and for telling us promptly at support@ottostruct.com if you suspect unauthorized access. Where the law requires it, we will notify you and the relevant regulator of a personal data breach.

Everyone

You can access and update much of your information directly in the Service. For anything else, contact us and we will respond within the time the law allows.

EEA and UK

You have the right to access your personal data; to correct it; to erase it; to restrict or object to its processing; to data portability; and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner’s Office.

California and other US states

If you are a resident of California, Colorado, Connecticut, Virginia, or another state with a comprehensive privacy law, you have the right to know what personal information we collect and how we use and disclose it; to request a copy; to request correction or deletion; to opt out of sale, sharing for cross-context behavioral advertising, and profiling with legal effects; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months. The contextual sponsored content described in section 7 is neither a sale nor a share, because it is not selected using personal information and is not cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.

You may use an authorized agent to submit a request. We will verify your identity before acting, usually by confirming control of the email address on the account. If we deny a request you may appeal by replying to our response; we will explain the outcome in writing.

OttoStruct is business software intended for use by people aged 18 and over. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy as the Service and the law change. The date at the top of this page shows when it was last revised. If a change materially affects how we handle your personal information, we will give notice in the Service or by email before it takes effect. Your continued use after a change takes effect means you accept the updated policy.

For privacy questions, or to exercise any of the rights above, contact us. Please tell us which right you are exercising and the email address on your account.

See also our Terms and Conditions.