Ignotix Privacy Policy - Final Deployment Draft

Effective date: July 1, 2026

Operator: SPEKTX LLC, a New Jersey limited liability company, doing business as Ignotix ("Ignotix," "we," "us," or "our")

Privacy contact: ignotixcad@outlook.com

Mailing address: [MAILING ADDRESS]

1. Scope

This Privacy Policy explains how Ignotix collects, uses, discloses, retains, and protects personal information when you use the Ignotix websites, accounts, organizations, hosted projects, construction studios, takeoff and estimating tools, file uploads, AI-assisted features, closeout and learning systems, paid-access features, support channels, and related services (the "Service").

This Policy does not apply to information processed solely by a customer under a separate written agreement that identifies the customer as the controller or business and Ignotix as a processor or service provider, except as stated in that agreement.

2. Information we collect

2.1 Account and identity information

We may collect your email address, display name, password-related authentication records, email-verification status, account identifiers, session records, and account-creation date. Passwords are processed through the authentication provider and are not stored by Ignotix in readable form.

2.2 Organization and access information

We may collect organization names, slugs, billing email addresses, membership roles, invitation records, access status, studio entitlements, project-pass records, and administrative actions.

2.3 Project and customer information

You may submit project names and numbers, customer or client information, addresses, building and room information, drawings, drawing pages, measurements, coordinate data, takeoff items, studio inputs, calculation records, estimates, proposals, exports, revision notes, and other project details.

You are responsible for deciding what information to include and for ensuring that you have authority to submit personal or confidential information about customers, employees, subcontractors, suppliers, or other persons.

2.4 Files and evidence

We may process uploaded plans, PDFs, images, CSV files, JSON files, attachments, source hashes, file names, file types, file sizes, security-scan status, download events, and evidence lineage. Hosted files are designed to be stored privately and may be quarantined until cleared by malware scanning.

2.5 Calculation, closeout, and learning information

We may collect calculation inputs and outputs, engine identifiers and versions, assumptions, warnings, limitations, input and result hashes, actual job outcomes, variance information, waste, labor hours, final cost, comparable-condition tags, notes, and consent choices.

Individual-learning profiles are intended to remain private to the user or authorized organization. Consented observations may be reviewed for controlled aggregate analysis. A single observation does not directly rewrite a global formula.

2.6 AI-assisted feature information

If you choose an AI-assisted feature, we may process the selected image or PDF crop, source PDF hash and filename, page number, crop coordinates, rendered dimensions, recognized text, confidence, warnings, provider and model identifiers, prompt version, review events, corrections, and approval status.

The selected content may be transmitted to the configured AI provider. The current source architecture supports Anthropic for blueprint-assist processing. Provider activation and model selection are controlled by the server.

2.7 Billing information

If paid features are activated, we may collect billing contact information, product and plan selections, customer and subscription identifiers, payment status, billing periods, cancellation status, transaction and webhook identifiers, and entitlement records. Payment card details are processed by Stripe and are not intended to be stored by Ignotix.

2.8 Communications and feedback

We may collect support requests, organization invitations, emails, questions, discrepancy reports, feature suggestions, survey responses, and other communications.

2.9 Device, network, security, and usage information

We may collect request timestamps, route and action information, request identifiers, security events, rate-limit records, hashed identifiers derived from email or IP address, browser or client identifiers supplied by the application, error information, and operational logs.

We do not currently use third-party behavioral advertising trackers in the production source package. If that changes, this Policy and consent controls will be updated before activation.

2.10 Information stored locally on your device

Some workspaces may use browser local storage or similar device storage for drafts, price books, product profiles, handoff records, local projects, preferences, or other local-only data. Local data remains on that browser unless you export, synchronize, or submit it. Clearing browser storage may delete it.

3. Sources of information

We collect information directly from you; from other users who invite you or include you in an organization or project; automatically from your browser, device, and use of the Service; from payment, email, hosting, authentication, AI, security-scanning, and other service providers; and from records generated by the Service.

4. How we use information

We use information to:

1. provide, authenticate, secure, and maintain the Service;
2. create and manage accounts, organizations, roles, projects, revisions, and entitlements;
3. perform calculations and preserve calculation provenance;
4. generate estimates, proposals, reports, and exports;
5. process uploads, quarantine files, conduct security scanning, and provide signed downloads;
6. provide AI-assisted transcription when requested;
7. process payments, subscriptions, project passes, refunds, and billing status when paid features are activated;
8. send verification, recovery, invitation, transactional, security, and service communications;
9. provide support and respond to feedback or discrepancies;
10. maintain private individual-learning profiles and, with consent, controlled aggregate learning;
11. prevent fraud, abuse, unauthorized access, malware, and other security threats;
12. test, debug, audit, analyze, and improve the Service;
13. comply with law, legal process, contractual duties, and enforce our Terms; and
14. protect users, Ignotix, and the public.

5. Legal bases for EEA, UK, and similar jurisdictions

Where applicable, we process personal information because it is necessary to perform a contract with you, to take steps at your request before entering a contract, to comply with legal obligations, to pursue legitimate interests such as operating and securing the Service, or based on your consent.

You may withdraw consent at any time for future processing that depends on consent. Withdrawal does not affect processing already lawfully completed.

6. How we disclose information

We may disclose personal information to:

6.1 Service providers

Providers may include:

• Supabase for database, authentication, storage, and Edge Functions;
• Netlify for frontend hosting, deployment, content delivery, domains, and TLS;
• Stripe for payment processing, subscriptions, checkout, customer records, and billing webhooks;
• Anthropic for user-requested AI-assisted image or drawing transcription;
• an approved email provider for verification, recovery, invitations, and transactional emails;
• an approved malware-scanning provider for hosted file security; and
• infrastructure, monitoring, support, backup, and professional-service providers reasonably necessary to operate the Service.

These providers may process information under their own terms and privacy notices and under agreements with Ignotix where required.

6.2 Your organization and authorized users

Information may be visible to organization owners, administrators, editors, viewers, billing users, or other authorized project participants according to their roles.

6.3 Legal, safety, and business purposes

We may disclose information to comply with law or legal process; enforce agreements; investigate fraud, abuse, security incidents, or rights violations; protect safety or property; obtain professional advice; or complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable protections.

6.4 At your direction

We may disclose information when you export, share, transmit, or otherwise direct us to disclose it.

7. Sale, sharing, targeted advertising, and automated decisions

Ignotix does not currently sell personal information for money and does not currently share personal information for cross-context behavioral advertising or use personal information for targeted advertising.

Ignotix does not use solely automated decision-making to make decisions that produce legal or similarly significant effects about users. Calculation outputs and learning recommendations are project references and require human review.

If these practices change, we will update this Policy and provide any required notice and opt-out mechanisms before the change becomes effective.

8. Cookies and similar technologies

The Service may use a secure, HTTP-only refresh cookie to restore an authenticated session. The cookie is intended to use Secure and SameSite protections in hosted production environments.

The Service may also use browser local storage and similar technologies for local projects, settings, product profiles, price books, and workflow state. These technologies are functional rather than advertising-oriented.

You can control cookies and local storage through your browser, but disabling them may prevent account sessions or local features from working.

9. Data retention

We retain information for as long as reasonably necessary to provide the Service, maintain project and revision history, complete transactions, secure the platform, resolve disputes, enforce agreements, comply with legal obligations, and support legitimate business purposes.

General retention principles are:

• account and organization information: while the account or organization is active and for a reasonable period after closure;
• project records, revisions, estimates, proposals, and files: until deleted, account closure is completed, or retention is otherwise required;
• quarantined or infected files: only as long as needed for security investigation, incident handling, deletion, or legal obligations;
• billing and transaction records: as required for accounting, tax, fraud prevention, and legal obligations;
• security and operational logs: for a period appropriate to investigation, audit, abuse prevention, and system integrity;
• support and feedback records: as needed to resolve the matter and improve the Service; and
• de-identified aggregate information: potentially for a longer period where it no longer reasonably identifies an individual or project.

Backups may retain deleted information for a limited period before rotation. We may retain information longer when required by law, litigation hold, contract, security investigation, or protection of legal rights.

Before public production, Ignotix will adopt and operate an internal retention schedule consistent with this Policy.

10. Security

We use administrative, technical, and organizational safeguards designed to protect information. The current architecture includes private storage, row-level database security, role-based access, versioned records, rate limits, input validation, content-security policies, security event records, file quarantine, malware-scan status, short-lived signed downloads, protected server secrets, and separate staging and production environments.

No method of transmission or storage is completely secure. You are responsible for protecting credentials, limiting organization access, maintaining appropriate backups, and avoiding submission of information that is unnecessary for the Service.

11. International transfers

Ignotix and its service providers may process information in the United States and other countries. Where required, we will use appropriate contractual or legal safeguards for international transfers.

12. Your privacy rights

Depending on your location and applicable law, you may have rights to request access, correction, deletion, portability, restriction, objection, or withdrawal of consent; to opt out of certain sales, sharing, targeted advertising, or profiling; and to appeal a denied request.

To make a request, email ignotixcad@outlook.com with the subject "Privacy Request." We may need to verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization.

We will not unlawfully discriminate against you for exercising a privacy right.

Because Ignotix does not currently sell personal information or use it for cross-context behavioral advertising, there is no current sale or targeted-advertising opt-out to exercise. We will provide one before engaging in a practice that requires it.

13. California notice

Where the California Consumer Privacy Act applies, the categories described in Section 2 may include identifiers; customer records; commercial information; internet or electronic-network activity; geolocation only if submitted in project data; professional or employment-related information; and inferences derived from project or learning information.

We collect, use, and disclose those categories for the business and commercial purposes described in Sections 4 and 6. We do not currently sell or share personal information as those terms are used for cross-context behavioral advertising. We do not knowingly sell or share personal information of persons under 16.

14. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has submitted information, contact us so we can investigate and delete it where required.

15. Third-party links and services

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own notices. We are not responsible for third-party practices outside our control.

16. Changes to this Policy

We may update this Policy. The updated version will identify a new effective date. If a change is material, we will provide reasonable notice through the Service, email, or another appropriate method.

17. Contact

Privacy questions and requests may be sent to:

Ignotix

Operated by: SPEKTX LLC, a New Jersey limited liability company

Email: ignotixcad@outlook.com

Mailing address: [MAILING ADDRESS]