Privacy Policy | HeavyCivilHelper

1. Introduction

HeavyCivilHelper ("we," "us," or "our") operates the HeavyCivilHelper platform accessible at heavycivilhelper.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service. By creating an account or using the platform, you agree to the practices described here.

2. Information We Collect

We collect the following categories of information:

Account Information: Username, email address, organization name, plan entitlement, lifetime usage information, and hashed password provided at registration.
Project Data: All content you create within the platform — project names, locations, records (RFIs, submittals, directives, change orders), map pins, zones, segments, attachments, and uploaded documents (PDFs, images).
Payment Information: Billing is handled entirely by Stripe, Inc. for paid subscriptions. We do not store your credit card number, expiration date, or CVV. Free signup does not create a Stripe customer or payment record.
Usage Data: Login timestamps, feature interactions, and error logs used to maintain and improve the service.
Communications: Messages you send to our support team at [email protected].
Mobile App Data: When you use the HeavyCivilHelper mobile app, the same account and project data practices apply as on the web platform. The mobile app may additionally request access to your device camera (for capturing and uploading site photos) and device location (for map-based field coordination features). These permissions are optional and may be granted or revoked at any time through your device settings. HCH Lens is local-first: camera images, optional location, optional plan/blueprint images, and JPG/PNG overlays are processed on-device to create the final stamped image. We do not collect device location data in the background or when the app is not in active use. If you connect Lens with an activated Free or qualifying paid HeavyCivilHelper plan and push a photo, the finished image and selected project context become an HCH project attachment.

3. How We Use Your Information

To provide, operate, and maintain the HeavyCivilHelper platform.
To process paid subscription payments through Stripe after explicit checkout authorization.
To send account-related communications (billing receipts, password resets).
To respond to support requests and inquiries.
To detect, investigate, and prevent fraudulent or unauthorized activity.
To improve our product through aggregated, anonymized usage analysis.
To connect HCH Lens users with their authorized HeavyCivilHelper projects under their plan's attachment allowance and project permissions.

We do not use your project data to train AI models or for any purpose beyond delivering the service features you've subscribed to.

4. Data Storage and Infrastructure

Your data is stored on cloud infrastructure backed by a PostgreSQL relational database. Uploaded files (PDFs, images, attachments) are stored in cloud object storage with access controlled per-project. All data transmission between your browser and our servers is encrypted using TLS (HTTPS). We may change infrastructure providers or storage systems over time while maintaining reasonable security standards. While we implement reasonable safeguards to protect your information, no method of electronic storage or data transmission is completely secure, and we cannot guarantee absolute security.

All traffic to HeavyCivilHelper is routed through Cloudflare, Inc., which provides content delivery, DDoS protection, and web application firewall services. As part of this process, Cloudflare may process your IP address and request metadata to detect and block malicious traffic. Cloudflare's handling of this data is governed by the Cloudflare Privacy Policy.

5. Data Sharing

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

Stripe, Inc.: Processes paid subscription payments. We do not disclose Free signup data to Stripe, and Free signup does not create a Stripe customer, checkout session, subscription, invoice, payment method, or charge. We disclose your verified account name and email to Stripe only when you initiate paid upgrade checkout, to create or reuse a customer and prefill the checkout. Stripe's use of your payment information is governed by its Privacy Policy.
OpenAI: AI-powered features (RFI extraction, risk reports, the Heavy chatbot) may send relevant project text, uploaded documents, and user-provided content to OpenAI's API for processing. Passwords and payment information are not intentionally transmitted to AI providers. No additional personally identifying account information is included in these requests beyond what is necessary for the feature to function.
Google reCAPTCHA: We use Google reCAPTCHA v3 and v2 on our registration page to detect and prevent automated abuse. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. This information is used by Google to determine whether the interaction is likely from a human or a bot. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
Cloudflare, Inc.: All web traffic passes through Cloudflare's network for DDoS protection, bot filtering, and firewall services. Cloudflare may process your IP address and request headers as part of this security layer. Cloudflare does not receive your account data or project content. Their data practices are governed by the Cloudflare Privacy Policy.
Legal requirements: We may disclose information if required by law or valid legal process.
Project collaborators: When you invite team members to a project, they can view and interact with that project's data per the access level you grant.

6. Data Retention

We retain your account and project data for as long as your account is active, including an account using the Free plan. If you cancel a paid subscription, your data remains accessible under the applicable account entitlement until you request deletion. Upon a verified deletion request, we will remove your account and project data within 30 days, except where retention is required by law.

HeavyCivilHelper reserves the right to archive or permanently delete inactive trial or unpaid accounts and their associated project data after an extended period of inactivity, in order to manage infrastructure and storage resources. Where practical, reasonable efforts may be made to provide notice before permanent deletion occurs.

7. Your Rights

You have the right to:

Access and review the personal information we hold about you.
Correct inaccurate account information at any time through Settings.
Request deletion of your account and associated data.
Export your project data (available via the Export feature within the platform).

To exercise any of these rights, contact us at [email protected].

8. Cookies and Browser Storage

HeavyCivilHelper uses functional browser storage to securely maintain your authenticated session, remember display preferences (theme, map settings), and support core platform functionality. We currently do not use third-party advertising cookies. We also use limited website analytics and signup attribution to understand how visitors discover and begin using the service.

Before signup, a temporary, bounded journey may be kept in session storage for up to 24 hours within the same browser tab. It contains selected public-page visits, referral domains, recognized campaign information, signup-link locations, demo choices, and video playback milestones—not form contents, passwords, authentication codes, or session recordings. If you register, this journey is associated with your account and available only to authorized administrators, alongside limited activation and upload milestones. Google or Microsoft sign-in is recorded separately from your original referral source. Missing attribution is not reconstructed or inferred. Browser Do Not Track and Global Privacy Control signals disable this optional pre-signup recorder.

Google reCAPTCHA, used on our registration page, may set cookies and use local browser storage as part of its bot-detection analysis. These are governed by Google's Privacy Policy, not ours.

Cloudflare may set a cookie (typically __cf_buid) to identify trusted browsers and prevent malicious bot traffic. This cookie does not track you across unrelated websites and is governed by the Cloudflare Privacy Policy.

9. Children's Privacy

HeavyCivilHelper is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will remove it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, for material changes, notify active subscribers by email. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

Questions about this Privacy Policy? Contact us at: [email protected]