Privacy Policy

This Privacy Policy explains how Opulence Companies ("Opulence," "we," "us") collects, uses, shares and protects information when you use the Blueprint Takeoff software, the Opulence operations platform, and our related websites (the "Service"). It applies to visitors, account holders, and users of the Service, and it is incorporated into our Terms of Service.

Our two roles. For information a business customer puts into the Service about its jobs, customers, workers and projects, we act as a processor on that customer's behalf and handle it under our agreement with them and this Policy. For account, billing and website information you give us directly, and for operating and securing the Service, we act as a controller.

If you are an employee, crew member, customer or subcontractor of a business that uses the Service, that business decides what to put into it. Direct your questions and requests to them first; we will refer such requests to them.

Account information: your name, work email, company, role, phone, and password (stored only as a secure hash), plus your preferences and language.

Billing information: billing email and phone, plan, and subscription and payment history. Card payments are handled by Stripe; we do not see or store full card numbers.

Content you provide ("Customer Data"): blueprints, drawings, documents, photographs and short video, measurements and takeoffs, estimates, bids, jobs, projects, change orders, invoices, payments, contacts and accounts, cost and budget records, crew rosters, time records, and anything else you or your users upload or create.

Workforce information, where you enable those features: time-clock punches, break records, and location readings taken at a punch or while a shift is open with the app in the foreground. We do not collect location in the background or between those moments.

Information about your customers and third parties: the contacts, addresses, and documents you enter about your builders, customers, subcontractors and suppliers, and records of their interaction with links you send them, such as when a bid or change order was viewed and accepted.

Usage and device information: log data, IP address, device and browser information, pages and actions in the Service, error reports, and approximate location derived from IP address, used to operate, secure, support and improve the Service.

Cookies and similar technologies: used to keep you signed in, to remember preferences, and to measure use of our website and the Service. On our public website (the marketing pages and the sign-up pages) we also use advertising technologies, described in Section 6. WE DO NOT SELL PERSONAL INFORMATION, AND WE DO NOT SHARE CUSTOMER DATA OR INFORMATION FROM INSIDE YOUR WORKSPACE FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING. See Section 4 for how we use aggregated and derived information, which is not personal information.

We use information to provide, operate, secure and support the Service; authenticate users; process subscriptions and payments; provide customer support and respond to requests; send transactional, account, billing and service messages; monitor, troubleshoot and improve performance and reliability; develop new features; detect, investigate and prevent fraud, abuse and security incidents; enforce our Terms; and comply with legal obligations.

Account, billing and service messages are part of the Service. Product and marketing emails, where we send them, include an unsubscribe link.

We use information collected on our public website to measure and improve our advertising, as described in Section 6.

We do not use Customer Data for advertising, and we do not permit third-party AI providers to train their general-purpose models on it. We do develop and improve our own products, features and models using Customer Data and information derived from use of the Service, as described in Section 4 and in Section 9 of the Terms.

We tell you this plainly because it matters. Opulence Companies and its affiliates operate and manage sales for specialty-trade contractors selling to general contractors and builders, and run insulation, spray-foam and concrete contracting of their own — principally in Nashville, Tennessee and Naples, Florida today, and we may expand at any time. Those businesses may compete with customers of the Service, and we may hold equity or other economic interests in businesses that do. Section 7 of the Terms of Service sets this out in full.

ANALYTICS AND BENCHMARKS. We generate aggregated and derived information from Customer Data and from use of the Service — averages, ranges, indices, benchmarks, market and geographic analyses, and statistical and machine-learning models. We use, publish and commercialize that information for any lawful purpose, including inside the Service, in published research and marketing, in developing our products, in our own and our affiliates' businesses, and as an asset in a financing or sale. Section 9 of the Terms governs those rights.

WHAT WE DO NOT DO WITH IT. Aggregated and derived information is produced so as not to identify you. When we publish benchmarks or make them available to third parties, we do not attribute an individual price, bid, margin, customer, project or employee to you by name, and we do not publish a figure drawn from so few sources that it identifies one customer. A case study that would identify you is published only with your approval. WE DO NOT SELL PERSONAL INFORMATION, AND WE NEVER SHARE CUSTOMER DATA OR INFORMATION FROM INSIDE YOUR WORKSPACE FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING — that commitment concerns personal information and does not limit our rights in aggregated and derived data.

ACCESS BY OUR PEOPLE. Our personnel access your workspace — including by signing in to it or on behalf of one of your users — to set up, operate, support, secure, test, troubleshoot and bill for the Service, to answer your requests, and to comply with law. You authorize that access in the Terms. WHERE OUR STAFF OPEN YOUR WORKSPACE, THAT ACCESS IS RECORDED IN YOUR OWN ORGANIZATION'S AUDIT LOG, WHICH YOU CAN READ.

When you use AI-assisted intake, extraction or estimating, the documents and inputs you submit for that task are sent to a third-party AI provider to generate the result, which is returned to you and stored in your workspace. We use these features only to perform the task you requested.

Our AI providers are bound not to train their general models on the content submitted through the Service. You are responsible for ensuring you have the right to submit the materials you send, and you should not upload information you are not permitted to disclose to a processor. Where you supply your own provider key, that provider relationship is yours.

Service providers (subprocessors) who help us run the Service, listed below, each bound by contract to protect the information and to use it only for us.

At your direction — for example when you connect an accounting, calendar, messaging or email integration, send a document to your customer, or publish a link that recipients can open.

For legal reasons — to comply with law or valid legal process, to respond to lawful requests from public authorities, to enforce our Terms, to investigate fraud or security incidents, or to protect the rights, property or safety of any person. Where we may lawfully do so, we will notify a business customer before disclosing their Customer Data in response to legal process.

Business transfers — in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy or a successor policy at least as protective, and with notice to you where required.

Analytics and advertising on our public website — our marketing pages and the sign-up pages you use before your company's workspace is set up. We use Google Analytics to measure how our website and the Service are used. On the public website only, we also use the Reddit Pixel and the Reddit Conversions API to measure whether our advertising on Reddit works. These tools may set cookies or read similar identifiers, and they receive the address of the page you are on, the page that sent you there, your IP address, your device and browser information, an advertising click identifier if you arrived from an ad, and a record that you visited a page, submitted a contact form or created an account, with a random event identifier so the same event is not counted twice. When you submit a contact form, our server may send Reddit that same record directly. We do not send Reddit your name, email address, phone number, company or anything you type into a form.

The Reddit Pixel and Conversions API are never used inside your workspace, and never on the links a business sends its own customers and subcontractors, such as a bid, change order, photo gallery, billing portal or invitation. Customer Data is never sent to them. Google and Reddit handle the information they receive under their own privacy policies and may use it to measure and improve the advertising they show. Section 10 explains how to opt out.

WE DO NOT SELL YOUR PERSONAL INFORMATION. Under some U.S. state privacy laws, allowing an advertising partner to collect information on our website for advertising can be considered "sharing" for cross-context behavioral advertising; we honor opt-outs of that sharing as described in Section 10. WE NEVER SHARE CUSTOMER DATA OR INFORMATION FROM INSIDE YOUR WORKSPACE FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING. As described in Section 4, aggregated and derived information that does not identify you is our own data, and we may use, publish, commercialize and transfer it — including within our affiliated businesses.

We use the following providers to deliver the Service:

Supabase — Application database, authentication, and file storage.

Stripe — Subscription billing and payment processing (we never store card numbers).

Cloudflare — Hosting, content delivery, and network security.

Google (Workspace / Apps Script) — Calendar scheduling and outbound email sent from your own mailbox at your direction.

Slack — Team notifications you enable.

Anthropic and other AI providers — AI-assisted document intake, extraction, and estimating you invoke.

Resend — Transactional billing and notification email.

Twilio — Text messages to your crews that you choose to send.

Intuit (QuickBooks Online) — Accounting synchronization you connect and enable.

We may update this list as our stack changes; the current list is always the one published here.

We retain Customer Data while your account is active and as needed to provide the Service. After termination we delete or de-identify Customer Data within a commercially reasonable period, except where we must keep records to comply with law, resolve disputes or enforce our agreements — for example billing records and append-only logs.

Some records in the Service are append-only by design, including audit logs, legal-acceptance records, and evidence records such as posted costs, submitted bids, signed approvals and time records. They cannot be edited or deleted from within the Service, because their value depends on their not being changeable after the fact.

We use technical and organizational measures designed to protect information, including encryption in transit, encryption at rest for stored files, row-level tenant isolation enforced in the database rather than only in the application, per-organization access controls, least-privilege service credentials, secret management for third-party credentials, private storage with short-lived signed links for sensitive files, and audit logging of sensitive actions including staff access to a customer workspace.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for your own account security, for the roles and permissions you grant, and for who you send links to. If we become aware of a breach of security affecting your personal information, we will notify you as required by law.

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to opt out of sale or sharing (we do not sell personal information; how to opt out of the advertising technologies on our public website is explained below), to limit use of sensitive information, and to appeal a decision. Account holders can update much of their information in the app. To make a request, contact privacy@opulencecompanies.com or legal@opulencecompanies.com; we will verify your request and respond within the time the law allows, and we will not discriminate against you for exercising a right.

Opting out of website advertising. Our website honors the Global Privacy Control (GPC) signal as a request to opt out of sharing: when your browser sends it, the Reddit Pixel does not load and our server sends Reddit no record for you. You can also block or delete cookies in your browser, change your ad preferences in your Reddit account settings, and install Google's Analytics opt-out browser add-on. Questions about these technologies can be sent to privacy@opulencecompanies.com.

If your information was submitted to the Service by a business — for example your employer or a contractor you hired — that business controls it, and we will refer your request to them and assist them in responding.

California, Colorado, Connecticut, Texas, Virginia and similar state privacy laws: the categories we collect, the purposes, and the categories of recipients are described in Sections 2, 3 and 6. We do not sell personal information. The advertising technologies on our public website described in Section 6 may be considered sharing for cross-context behavioral advertising; we honor the Global Privacy Control signal as an opt-out of that sharing, and we never share Customer Data or information from inside your workspace for that purpose. We do not knowingly process the personal information of anyone under 16. EEA/UK: where we act as a controller our legal bases are contract performance, our legitimate interests in operating and securing the Service, consent where required, and legal obligation; you may lodge a complaint with your supervisory authority.

Where an employer enables the workforce features, the Service records time punches, breaks and location readings taken at a punch or while a shift is open with the app in the foreground. It does not collect location in the background, between punches, or when the app is closed, and it does not collect biometric identifiers.

The employer decides whether to enable these features and is responsible for giving workers any notice and obtaining any consent the law requires. Workers are shown a disclosure in the app before location checks begin, and a worker may decline; a refusal is recorded once and then respected. Location and time records are evidence of what a device reported, not proof of where a person was.

Requests about workforce records should go to the employer, who controls them. We will assist the employer in responding.

We and our subprocessors process information in the United States and may process it in other countries. Where required for transfers from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with supplementary measures. A copy of the relevant safeguards is available from privacy@opulencecompanies.com.

Business customers who require a data processing addendum, standard contractual clauses, a subprocessor notification commitment, or a security questionnaire response may request them at legal@opulencecompanies.com. An executed data processing addendum supplements and, where it conflicts on the processing of personal data, controls over this Policy.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact privacy@opulencecompanies.com and we will delete it.

We may update this Policy. If we make material changes we will provide notice and update the version and effective date shown on this page, and where required we will ask you to accept the change. Your organization's acceptance of each version is recorded.

Questions about privacy, a data request, or a data processing addendum: privacy@opulencecompanies.com or legal@opulencecompanies.com, Opulence Companies.