Lumanvio Privacy Policy

Version 1.0 · Effective [EFFECTIVE DATE]

🌐 Available in Español, Português and Kreyòl Ayisyen for convenience. The English version controls.

This policy explains how Urban Builders Consulting Inc ("Lumanvio", "we") collects, uses and shares personal information when you use our websites, web app and mobile app (the "Service").

Who this covers. Three groups of people interact with the Service:

1. Customers and their team — contractors who create accounts and the seats they invite.
2. Recipients — people a Customer interacts with through the Service: their clients, subcontractors, suppliers and design professionals who receive estimates, invoices, pay applications, work orders or submittals, sign documents, pay invoices, or submit a lead form.
3. Visitors — people browsing our public websites.

Our role for Recipient data. For most Recipient data (client names, contacts, project details a Customer stores), the Customer decides what to collect and why — we process it on the Customer's behalf as a service provider/processor under our Data Processing Addendum. If you are a Recipient and want your data corrected or deleted, the fastest path is contacting the contractor you worked with; you can also contact us at support@lumanvio.com and we will assist or forward the request.

1. Information We Collect

Account information — name, email, password (hashed), phone, company name, role, language, profile photo, and if you sign in with Google, your Google account email and name.

Business content you store — clients and their contact details, leads (name, email, phone, job address), estimates, invoices, projects, schedules, purchase orders, supplier records — including supplier tax IDs you enter for 1099 reporting — catalog items, notes, and team data.

Files and media — construction plans and drawings, project photos and daily-log media, receipt and bill images, 3D models, brand assets, and documents you upload.

Voice recordings — if you use voice dictation (for example daily reports), we transcribe the audio and store the recording with the daily log it belongs to, so you and your team can replay it. It is kept until you delete the log, the project or your account. The transcription provider receives the audio through a time-limited link and automatically deletes its copy of the input and output within about one hour (see Section 3).

Signature data — when someone signs a document through the Service we capture the signature image, signer name, and an audit trail: date/time, IP address, device/browser, and a cryptographic hash of the signed document. This is retained as evidence of the signature for as long as the signed document is retained.

Payment information — payments are processed by Stripe. We do not receive or store full card or bank numbers; we receive limited information such as payment status, last four digits and payout status. Your billing relationship with us is also managed through Stripe.

Usage and device data — log data, IP address, device and browser type, pages and features used, and diagnostic events, used for security and to operate and improve the Service.

Cookies — we use essential cookies for sign-in and session security, and limited functional cookies (for example language preference). We do not use third-party analytics or advertising cookies, and we do not track you across other sites. Because of this, our sites do not respond differently to "Do Not Track" signals — there is no tracking to turn off.

Location (future feature — not yet active). A planned Lumanvio Pro feature allows crew location tracking during work hours. If activated, it will be opt-in with a dedicated consent screen, limited to working hours, retained for 30 days, and described here before launch. It is not part of the Service today.

2. How We Use Information

• Provide, operate and secure the Service (including authentication, backups and fraud prevention).
• Process documents and workflows you initiate: sending estimates and invoices, capturing signatures with audit trails, processing payments through Stripe, generating PDFs and reports.
• Provide AI features (Section 3).
• Communicate with you: transactional email (confirmations, trial reminders, receipts), support, and product updates you can opt out of.
• Comply with law, enforce our Terms, and establish or defend legal claims.
• Improve the Service using aggregated, de-identified data.

We do not sell personal information, and we do not use your content or your Recipients' data to train AI models.

3. AI Features

Some features send your content to AI providers to produce a result for you:

These providers process the data solely to return a result to us and do not use your content to train their models. Anthropic's commercial API terms exclude customer content from model training. Replicate automatically deletes API inputs and outputs within about one hour of processing. AI output may be inaccurate — review it before relying on it.

4. How We Share Information

We share personal information only with:

• Subprocessors that run the Service — hosting, database, payments, email, AI. The current list, with purposes and locations, is at /subprocessors.
• Recipients you choose — when you send an estimate, invoice or other document, its contents (including your business details) go to the person you send it to.
• Stripe — to process subscription billing and, if you enable client payments, to operate your connected account.
• Law and safety — when required by law, subpoena or legal process, or to protect rights, safety and the integrity of the Service.
• Business transfers — in a merger, acquisition or asset sale, with notice to you.

We do not share personal information with data brokers or advertisers.

5. Retention

• Account and business content: for the life of your account.
• Signed documents and their audit trails: as long as the underlying document exists in your account (they are legal evidence — deleting them prematurely could hurt you and your Recipient).
• After account deletion: we delete Customer Content after a 30-day grace period, except records we must keep for tax, legal or dispute purposes (for example invoices and payment records), which we keep only as long as required.
• Backups roll off on a fixed schedule after deletion.

6. Security

We use industry-standard measures: encryption in transit (TLS) and at rest, row-level access controls that isolate each customer's data on every table and storage path, private storage buckets served through time-limited signed links, least-privilege internal access, and secure infrastructure providers (see Subprocessors). Supplier tax IDs are masked in the interface and visible only to account owners and admins. Signed documents are stored with a cryptographic fingerprint so tampering is detectable. No system is 100% secure; notify us at support@lumanvio.com of any suspected breach of your account.

7. Your Rights and Choices

• Access / export — export your data in Settings → Account.
• Correction — edit most data directly in the app.
• Deletion — delete your account in Settings → Account (30-day grace period, then permanent deletion subject to Section 5).
• Marketing opt-out — unsubscribe link in any non-transactional email.
• State privacy rights — residents of California and other states with privacy laws may have rights to access, delete, correct, and obtain a copy of personal information, and to not be discriminated against for exercising them. We honor these requests at support@lumanvio.com, and we do not sell or "share" (for cross-context advertising) personal information as defined by those laws.
• Recipients — contact the contractor who holds your data, or write to us and we will assist.

We will verify requests and respond within the time required by applicable law.

8. Children

The Service is for business use by adults. We do not knowingly collect information from children under 13 (or under 18 as account holders). If you believe a child provided us data, contact support@lumanvio.com.

9. Where Data Is Processed

We are based in the United States and the Service is offered to US businesses. Data is stored and processed in the United States [CONFIRM Supabase/Vercel regions].

10. Changes to This Policy

We will post updates here and, for material changes, notify you by email or in-app before they take effect. The "Effective" date above always shows the current version.

11. Contact

Urban Builders Consulting Inc · 941 Crystal Lake Dr, Apt 111, Pompano Beach, FL 33064 · support@lumanvio.com