Privacy policy

Who we are and what this covers

PipeTakeoff.com is operated by TGC Works LLC, a Wyoming limited liability company ("PipeTakeoff," "we"). This policy describes how we handle personal data when you visit our website or use the PipeTakeoff.com service (the "Service").

The Service is business software. For the content your organization uploads, such as drawings, extracted material takeoff (MTO) data, and quotes, your organization controls the data and we process it on the organization's behalf under our Terms of service and, where signed, a data processing agreement. For account, billing, and website data, we determine how processing happens as described here.

What we collect

• Account data, stored first-party in our database (Neon Postgres, US-East): name, email address, sign-in credentials (passwords stored only as salted scrypt hashes), sign-in method, and organization membership.
• Content your organization uploads: PDF drawings stored in Cloudflare R2 (United States); extracted and edited MTO rows, projects, catalogs, and quotes in a Neon Postgres cluster (US-East). Uploaded drawings may incidentally contain personal data, such as names on title blocks; your organization is responsible for having the rights to upload them.
• Audit records: an immutable log of compliance-relevant actions (who committed an MTO, who reviewed a quote, when, and what changed), plus Terms-acceptance records (accepted version, timestamp, IP address, and browser user agent).
• Billing data, via Stripe: subscription state and invoice history. Card numbers never touch our servers.
• Product analytics, via PostHog: pageviews and feature-usage events linked to your account, including your name and email address, and to your organization and its name, so we can see which features people use and help when something goes wrong. Automatic capture of clicks and form interactions is off. In the EEA, UK, and Switzerland, none of this runs until you consent; see "Cookies and analytics choices" below.
• Session replay, via PostHog, for visitors outside the EEA, UK, and Switzerland, on the public website and in the application, whether or not you are signed in: a recording of how pages and screens were used (navigation, clicks, scrolling, timing) that we use to improve the website, debug problems, and answer support requests. Everything you type and all on-screen text, including drawing and takeoff content, prices, and names, is masked with placeholder characters before it leaves your browser, images are not captured, and browser console output is not collected. A replay recorded while you are signed in is linked to your account. Replays are kept for 30 days. Nothing is recorded on the sign-in, sign-up, or legal pages, in the EEA, UK, or Switzerland, or when your browser sends Global Privacy Control.
• Operational logs and security data: request logs (IP address, user agent, path) at our hosting providers, error reports and application logs with personal data scrubbed before sending, and rate-limit counters keyed by organization identifier and IP address.
• Correspondence: emails you send to our support, legal, privacy, or abuse addresses.

We do not collect special categories of personal data and the Service is not directed to children.

How we use it

• To provide the Service: render extractions, surface MTO rows, aggregate projects, run RFQ and quote workflows, and deliver transactional email (invitations, payment notices, extraction results).
• To secure and operate the Service: authentication, tenant isolation, rate limiting, abuse prevention, debugging, and incident response. Internal access to customer content is role-gated and audited.
• To bill you, via Stripe.
• To understand product usage, improve the product, and help individual users when something goes wrong, using the product analytics described above.
• To meet legal obligations and to establish or defend legal claims; the audit log exists in part to evidence that required human review of extractions occurred.

AI processing: pages of uploaded drawings are sent to Anthropic to perform extraction. We do not train AI models on your data, and Anthropic's commercial API terms prohibit training on it; Anthropic retains extraction inputs only for a limited period under those terms.

Aggregated statistics: we compute de-identified, aggregated statistics across customers (for example, material-price benchmarks), only where a minimum number of distinct organizations contribute to each statistic. These never include drawings and never identify you, your vendors, or your projects.

Cookies and analytics choices

Strictly necessary cookies (your sign-in session, the Terms-acceptance record, and the cookie that stores your analytics choice itself) are set on every visit and cannot be turned off, because the Service does not function without them. We set no advertising cookies and no third-party tracking pixels of any kind.

The one non-essential cookie we set is PostHog product analytics, described above (session replay uses the same cookie and the same choice). How it is handled depends on where you are:

• European Economic Area, United Kingdom, and Switzerland: analytics does not run until you accept. We ask once, with a banner offering Accept and Decline as equally prominent choices, and nothing analytics-related is loaded or set before you answer. Declining is remembered and never re-prompts you within the same six-month window. Session replay never runs in these regions, whatever you answered.
• Elsewhere: analytics runs by default as described in this policy, and you can opt out at any time by enabling Global Privacy Control in your browser.
• Global Privacy Control: we honour the GPC signal everywhere, not only in jurisdictions that legally require it. If your browser sends GPC, analytics never initializes and you are never shown the consent banner.

Your choice is stored in a first-party cookie for six months, after which we ask again rather than assume the answer still holds.

Embedded video: the product demo on our homepage is hosted on YouTube, a Google service. Nothing is loaded from YouTube until you press play. When you do, the player loads from YouTube's privacy-enhanced domain (youtube-nocookie.com), and Google receives your IP address and may store data in your browser under Google's own privacy policy. If you never press play, no data about your visit goes to Google.

How we share it

We do not sell personal data and we do not share customer drawings or MTO data with third parties, except:

• Subprocessors that operate the Service on our behalf, listed with purposes and data categories at /legal/subprocessors. Organization administrators receive 30 days' notice before a new subprocessor is added.
• Vendors your organization invites: when your organization sends an RFQ, the vendor sees the RFQ content your organization chose to send.
• Legal reasons: where required by law or legal process, or to protect the rights, safety, or property of PipeTakeoff, our customers, or the public.
• Corporate transactions: in a merger, acquisition, or asset sale, data may transfer to the successor under this policy's protections.

Data retention

We keep account and content data while your organization's account is active. Audit logs are retained for a minimum of seven years, reflecting construction-industry record-retention norms. Vendor-side windows (error reports, application logs, analytics) are enforced by each vendor on the plan we use; session replays are deleted after 30 days. Our published retention schedule, maintained for auditors and privacy reviewers, is the authoritative reference for each data class and its window.

Security

Data is encrypted in transit and at rest. Tenant isolation is enforced at both the application and database layers, access is role-based and audited, and the audit log is insert-only and tamper-evident. Details, including our incident-notification commitment (72 hours after a confirmed breach affecting your data), are published at /security.

Your controls

You can export every committed MTO in xlsx or csv format at any time. You can delete an organization from the settings panel; its database records (projects, extraction data, MTO rows, and audit history) are permanently deleted immediately, and an automated cleanup purges its uploaded files from object storage. Residual copies in backups expire on the schedule published in our retention documentation.

To access, correct, export, or delete personal data we hold about you, email privacy@pipetakeoff.com. If your request concerns content controlled by an organization you belong to (for example, data inside a workspace), we may route the request to that organization's administrators, and we will assist them in responding.

Where data lives

We are a United States company and process data in the United States, using the providers listed at /legal/subprocessors. If you access the Service from outside the United States, you understand your data is processed in the United States.

How we review this policy

We review this policy, and the tracking and data-handling technologies it describes, at least annually and additionally whenever any of the following happens: we add or remove a subprocessor, we change what the Service collects or how long it is kept, we introduce or alter any analytics or tracking technology, or a privacy law that applies to us changes materially.

Each review checks that every technology in use is still accurately described here, still has a lawful basis, and still matches the consent behaviour described under "Cookies and analytics choices." Anything a review finds out of date is corrected here, as described under "Changes to this policy." The owner of this review is the founder until a privacy lead is hired.

Changes to this policy

We will post changes to this page and, for material changes, notify organization administrators by email at least 30 days in advance.

Contact

Privacy questions? Email privacy@pipetakeoff.com.