Privacy Policy

1. Introduction

Groundwork ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at groundwork.homes (the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Information You Provide Directly

When you create an account or use the Service, we may collect:

• Name and email address;
• Password (stored as a one-way cryptographic hash — we never store your plaintext password);
• Project and property data you enter (addresses, purchase prices, renovation costs, income, etc.);
• Receipt and expense data, including vendor names, amounts, and uploaded receipt images;
• Invoice and contact information you create within the platform;
• Communications you send to our support team.

Information Collected Automatically

When you use the Service, we automatically collect certain technical information, including:

• IP address and approximate geographic location;
• Browser type and version, operating system;
• Pages visited, features used, and time spent in the application;
• Referring URLs and session identifiers.

Information from Third Parties

If you use email forwarding to submit receipts, we receive and process the content of those emails, including any attachments, solely to extract expense data on your behalf. We do not share forwarded email content with third parties beyond what is necessary to operate the AI parsing feature.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Process transactions and send billing-related communications;
• Send transactional emails (account verification, password resets, invoice notifications);
• Analyze usage patterns to improve features and fix bugs;
• Respond to your support requests and inquiries;
• Detect and prevent fraud, abuse, or security incidents;
• Comply with applicable legal obligations.

We do not sell your personal data to third parties. We do not use your project or financial data for advertising purposes.

4. How We Share Your Information

We may share your information with third-party service providers who assist us in operating the Service, subject to confidentiality agreements. These providers include:

• Mailgun — for sending and receiving transactional emails;
• Stripe — for processing subscription payments;
• Amazon Web Services (S3) — for storing uploaded files and receipt images;
• AI model providers — for parsing receipt content (data is not retained by providers for training).

We may also disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Groundwork, our users, or the public.

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

5. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or accounting purposes.

Uploaded files and receipt images stored in cloud storage may be retained for up to 90 days after account deletion before being permanently purged.

6. Security

We implement industry-standard security measures to protect your information, including encryption of data in transit (TLS/HTTPS), hashed password storage, and access controls limiting who can view your data. However, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect any unauthorized access to your account.

7. Cookies and Tracking

We use session cookies to maintain your login state. These cookies are essential for the Service to function and are deleted when you log out or close your browser. We do not use third-party advertising cookies or cross-site tracking technologies.

We may use privacy-respecting analytics tools to understand aggregate usage patterns. These tools do not identify individual users and do not share data with advertising networks.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you;
• Correction: Request correction of inaccurate or incomplete data;
• Deletion: Request deletion of your account and associated personal data;
• Portability: Request an export of your data in a machine-readable format;
• Opt-out: Unsubscribe from non-essential communications at any time.

To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify you by email or via an in-app notice. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at: