Privacy Policy — CTC Takeoffs

Last updated: October 26, 2026

This Privacy Policy explains what personal data CTC Takeoffs ("we," "us") collects, why, and your choices. It applies to app.ctctakeoffs.com, ctctakeoffs.com, and support.ctctakeoffs.com.

Data controller: CTC Takeoffs, 931 Washington Blvd #106, Roseville, CA 95678, USA. Contact: [email protected].

Beta note: the Service is in beta; data practices described here are the practices in effect during beta and may be refined before general release, with notice of material changes.

1. What we collect

Account data. Name, email address, organization name, role, and account settings for you and your organization's members.

Your project data. Plan files you upload, projects, measurements, item libraries, prices, company branding (including logo), and customer details you choose to add to a project. This content may contain personal data only if you put it there.

Billing data. Subscription plan, seat count, invoices, and payment status. Payments are processed by Stripe — we do not receive or store your full card number.

Support data. Messages you send through the support contact form or support tickets (name, email, organization, topic, message, and any attachment you include), and support-access records (who requested access, the reason, decisions, and session times — see Terms of Service, Section 7).

Feedback. Feedback you submit in the app (type, message, optional attachment). Feedback is stored with your account and organization so we can triage it.

Technical data. Log and device data needed to run and secure the Service (e.g., IP address, browser type, timestamps, error logs). We use browser local storage for preferences (e.g., units, display settings) and for the website's owner-unlock gate.

2. Why we use it (purposes and legal bases)

• Provide the Service — account operation, project storage, measurement, billing, and exports. Legal basis: performance of our contract with you.
• Support and safety — answering support requests, consent-based support access, preventing abuse, securing the Service. Legal basis: contract; legitimate interests.
• Service email — confirmations, billing and lifecycle notices (trial reminders, plan changes, deletion warnings), and support replies. Legal basis: contract; legitimate interests.
• Improvement — triaging feedback and fixing defects. Legal basis: legitimate interests.

We do not sell personal data, share it for advertising, or use your project data to train models.

3. Who processes data for us (subprocessors)

We use a small set of processors:

• Supabase — application hosting, database, authentication, and file storage (United States, us-west region).
• Stripe — payment processing, tax calculation, invoices.
• Resend — transactional email delivery.
• Cloudflare — website and application hosting/delivery and DNS.

Each processor handles data only to provide its service to us. A current list is available on request and is included in the Data Processing Addendum for business customers.

4. International transfers

Our infrastructure is in the United States. If you are in the EU, UK, or Switzerland, your data is transferred to the US. Where required, transfers rely on the European Commission's Standard Contractual Clauses (and the UK/Swiss equivalents), incorporated in our Data Processing Addendum.

5. Retention

• Account and project data: kept while your account is active.
• If your subscription lapses and the account is inactive for 6 months, data is permanently deleted after emailed warnings (approximately 30 days, 7 days, and 24 hours before) and an offer to download your data (see Terms of Service, Section 6).
• If you request deletion, it is scheduled 7 days out and can be cancelled in that window.
• Support tickets and feedback: kept for as long as needed to provide support and improve the Service, and reviewed periodically.
• Backups: overwritten in the normal backup cycle after deletion.

6. Your rights

Depending on where you live (including under the GDPR/UK GDPR, Swiss FADP, and California and other state laws), you may have the right to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent where processing is based on consent.

• In the app: download your data and delete your account from Settings at any time.
• By email: contact [email protected]. We respond within the time required by applicable law (generally 30 days).
• You may complain to your local data protection authority; we would appreciate the chance to resolve the issue first.

Organization admins control member accounts within their organization; members should contact their super admin for organization-level requests.

7. Security

Access to project data is restricted by organization using row-level security and authenticated accounts; plan files are stored in private storage. Support access to a customer's projects requires the super admin's express approval, is time-limited, and is logged (Terms of Service, Section 7). No system is perfectly secure; we will notify affected customers of a personal-data breach where the law requires.

8. Cookies and local storage

We use only the storage needed to run the Service: sign-in sessions, preferences, and the landing site's owner-unlock gate. We do not use advertising or cross-site tracking cookies.

9. Children

The Service is a business tool and is not directed to children under 16. We do not knowingly collect their data.

10. Changes

We will email organization super admins and/or announce material changes in the app at least 14 days before they take effect.

11. Contact

CTC Takeoffs, 931 Washington Blvd #106, Roseville, CA 95678, USA — [email protected].