Privacy Policy

SpecSwift is a service that helps construction estimators and bidding teams analyze project specification documents. The Service lets you upload specification PDFs, select your trade divisions, and receive organized, flagged summaries of requirements, conditions, and risks relevant to your bid.

The entity responsible for your personal data (the "controller" or "business" under applicable laws) is H. Mollenry and Co., located at P.O. Box 3605, Dublin, Ohio 43016. You can reach our privacy team at Privacy@SpecSwift.com.

We collect the following categories of personal and business data, depending on how you use the Service:

• Account & identity data. When you create an account, our authentication provider (Clerk) collects and processes your name, email address, and authentication credentials, and may collect a profile image or details from a third-party sign-in provider you choose to use. We use this to identify you and secure your account.
• Uploaded specification documents and extracted text. When you scan a project, we store the specification PDF you upload and the text extracted from it. These documents may contain business information about projects, owners, contractors, and contract terms.
• Generated summaries, notes, and selections. We store the summaries, flagged requirements, and other outputs the Service generates from your documents, along with your selected CSI trade divisions and any custom checklist items you add.
• Usage data. Information about how you interact with the Service, such as scans run, features used, and actions taken, which we use to operate and improve the Service.
• Device & log data. Technical information automatically collected when you use the Service, such as IP address, browser type, device identifiers, approximate location derived from IP, access times, and error logs.

We do not intentionally seek to collect sensitive personal data (such as government identifiers, health, or financial account information) through the Service. Please do not upload documents containing such information unless it is necessary for your bid.

We use personal data to:

• Provide the core scanning service — storing your documents, extracting text, and generating organized summaries.
• Send your document content to an AI/LLM provider so that it can be analyzed and summarized (see Section 4).
• Create and manage your account, authenticate you, and provide customer support.
• Maintain the security and integrity of the Service, detect and prevent fraud or abuse, and enforce our terms.
• Understand usage and improve, troubleshoot, and develop new features.
• Comply with legal obligations and respond to lawful requests.

We do not use your data to build advertising profiles, and we do not engage in targeted advertising based on your activity.

We share personal data with a limited set of service providers who process it on our behalf and under contract, only as needed to operate the Service:

• Authentication provider (Clerk). Manages account sign-up, sign-in, and identity. It processes your name, email, and authentication data.
• Object storage provider. Securely stores the specification PDFs you upload and related files.
• AI / LLM provider. Processes the content of your uploaded documents and extracted text to generate the summaries and flagged items that power the Service. Document content is sent to this provider solely to produce your results.
• Infrastructure & hosting providers. Provide the servers, databases, and platform on which the Service runs.

We may also disclose personal data when required by law, to respond to legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will provide notice as required by law).

We do not sell your personal data, and we do not share it for cross-context behavioral advertising (also called "targeted advertising") as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and other U.S. state privacy laws.

We also do not use or disclose sensitive personal data for purposes other than providing the Service and the operational purposes described in this policy.

We keep personal data only for as long as it is needed for the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Scans and documents. Your uploaded specification documents, extracted text, and generated summaries are retained for as long as the associated job exists in your account.
• Deleting a job. When you delete a job, we permanently remove both the scan results (the extracted text and generated summaries) and the original uploaded specification document from storage. This action cannot be undone.
• Account data. Account and identity data is retained while your account is active. If you close your account or request deletion, we delete or de-identify your personal data, except where we must retain certain records to comply with law, resolve disputes, or enforce our agreements.
• Logs and backups. Device and log data is retained for a limited period for security and operational purposes. Residual copies may persist in routine backups for a short time before being overwritten.

Depending on where you live, you may have some or all of the following rights regarding your personal data. We honor these rights for residents of states with comprehensive privacy laws, and we extend the core rights to all users where practicable:

• Right to access / know. Request confirmation of whether we process your personal data and obtain a copy of the data we hold about you, including the categories collected, the purposes, and the categories of recipients.
• Right to correct. Request that we correct inaccurate personal data.
• Right to delete. Request that we delete personal data we have collected from you, subject to legal exceptions.
• Right to data portability. Obtain a copy of your personal data in a portable, machine-readable format.
• Right to opt out of sale, sharing, and targeted advertising. We do not sell or share your data for these purposes, so there is nothing to opt out of — but you retain this right.
• Right to limit use of sensitive personal data. We do not use sensitive personal data beyond providing the Service.
• Right to non-discrimination. We will not discriminate or retaliate against you for exercising any of your privacy rights.

You may use an authorized agent to submit requests on your behalf where the law permits; we may ask for proof of authorization and to verify your identity.

To exercise any of these rights, contact us at Privacy@SpecSwift.com. You can also delete your scanned jobs (and their underlying documents) directly within the app at any time.

To protect your data, we will take reasonable steps to verify your identity before fulfilling a request — typically by confirming control of the email address associated with your account. We will not fulfill a request if we cannot reasonably verify it.

We will respond to verifiable requests within the timeframe required by applicable law — generally within 45 days. If we need more time, we will let you know and may extend the period by an additional 45 days (or as otherwise permitted by law). There is generally no charge to exercise your rights, though we may charge a reasonable fee or decline requests that are excessive, repetitive, or manifestly unfounded.

If we decline to take action on your request, you may appeal that decision by contacting us at Privacy@SpecSwift.com with the subject line "Privacy Appeal." We will respond to your appeal within the timeframe required by your state's law (generally within 45–60 days) and will explain the reasons for our decision.

If your appeal is denied, you may have the right to contact your state attorney general to submit a complaint. Contact details are available on your state attorney general's website.

The following disclosures apply to residents of U.S. states with comprehensive privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), and other states with similar laws.

California (CCPA / CPRA)

In the preceding 12 months, we have collected the following categories of personal information (as defined by the CCPA): identifiers (e.g., name, email, IP address); internet or other electronic network activity (usage and log data); and the contents of documents you upload and the outputs we generate. We collect this information for the business purposes described in Section 3.

We do not sell or share (for cross-context behavioral advertising) the personal information of any consumer, including minors. California residents have the rights to know, delete, correct, and opt out described above, and the right not to be discriminated against for exercising them.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana & other states

Residents of these states have the rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data, targeted advertising, and certain profiling. As noted, we do not sell personal data, engage in targeted advertising, or conduct profiling that produces legal or similarly significant effects. Where required, we also provide an appeals process (see Section 9).

"Do Not Sell or Share My Personal Information": because we do not sell or share personal data, no opt-out mechanism is necessary. If this changes, we will update this policy and provide the required controls.

The Service is intended for business use by construction and estimating professionals and is not directed to children. We do not knowingly collect personal data from children under 13 (or the minimum age required in your jurisdiction). If we learn that we have collected personal data from a child without appropriate consent, we will delete it. If you believe a child has provided us personal data, contact us at Privacy@SpecSwift.com.

We use reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit, access controls, authentication safeguards, and isolating each account's data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

The Service is operated in the United States, and personal data is processed and stored in the United States and by our service providers. If you access the Service from outside the United States, you understand that your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

We and our service providers use cookies and similar technologies (such as browser local storage) to operate the Service and, with your consent, to understand and improve how it is used.

• Strictly necessary. These are required for the Service to function — for example, the session cookie set by our authentication provider that keeps you signed in, and local storage we use to associate work you started before signing up with your new account. Because they are essential, they are always active and do not require consent.
• Analytics. With your consent, we may use cookies to measure how the Service is used so we can improve it.
• Marketing. With your consent, we may use cookies to measure and improve our outreach.

When you first visit, we ask for your choice through a cookie banner, and analytics and marketing cookies stay off unless you opt in. You can change your choice at any time using the Manage cookie preferences control, or through your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If we make material changes, we will provide additional notice as required by law, such as by email or an in-app notice. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or how we handle your personal data, or to exercise your rights, contact us at: