Privacy Policy

Account information: When you sign up, we collect your email address, name, and password. If you subscribe to a paid plan, Stripe (our payment processor) collects your payment information directly — we do not store your credit card number.

Project data: PDF drawings, takeoff results, estimates, project details, client information, and other content you upload or create within SteelFlo.

Usage data: We automatically collect information about how you use the Service, including pages visited, features used, browser type, operating system, IP address, and referring URLs.

Cookies and analytics: We use cookies and similar technologies for authentication, preferences, and analytics. See Section 7 for details.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your uploaded PDFs through our AI detection pipeline
• Measure and improve the accuracy of the Service, including limited human review of uploaded drawings (see Section 3)
• Process payments and manage your subscription
• Send transactional emails (account verification, password reset, billing receipts)
• Respond to support requests
• Monitor for abuse, fraud, and security threats
• Analyze usage patterns to improve the product (in aggregate, not individually)

We do not use your project data or uploaded drawings to train AI models.

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Service providers: We use third-party services to operate SteelFlo, including:
  • Supabase — database and authentication (your data is stored in Supabase's cloud infrastructure)
  • Stripe — payment processing (handles your billing information directly)
  • Google (Gemini AI) — processes PDF pages for steel member detection (drawings are sent for analysis and not retained by Google beyond processing)
  • Vercel — application hosting
  • Google Analytics — anonymous usage analytics
  • Crisp — customer support chat
  • Sentry — error monitoring (captures technical errors, not personal data)
• Legal requirements: We may disclose information if required by law, court order, or government request
• Business transfers: If SteelFlo is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Team members: If you use the Business plan, your team owner and teammates with appropriate permissions can access shared project data
• Independent estimators (quality review): Uploaded drawings may be reviewed by independent professional estimators engaged by SteelFlo, as described below

Human review of uploaded drawings

To measure and improve the accuracy of the Service, SteelFlo may ask independent professional estimators to review drawings you upload and prepare their own takeoffs for comparison with our results. These estimators are contractors engaged by SteelFlo and are bound by written confidentiality obligations.

• What they see: Drawing content only. Drawings are shown with a neutral reference number. Estimators do not receive your name, email address, company account details, or billing information. The drawings themselves may still show project, client, or company names, for example in title blocks.
• How they may use it: Solely to perform reviews for SteelFlo. They may not use your drawings for any other purpose, including bidding or competitive work, and may not share them with anyone.
• Deletion: Estimators must delete any copies of your drawings and their notes when their review is complete, when their access ends, or when we ask.
• Opting out: You can exclude your drawings from human review at any time by emailing support@steelfloai.com. We will honor your request within 30 days, and your drawings will not be offered for future review.
• Account deletion: Deleting your account also removes your drawings from the review program.

Your data is stored in Supabase's cloud infrastructure with the following protections:

• All data is encrypted in transit (TLS/HTTPS) and at rest
• Row-Level Security (RLS) policies ensure users can only access their own data
• Authentication tokens are managed via secure HTTP-only cookies
• Uploaded files are stored in isolated, access-controlled storage buckets
• API routes validate authentication on every request
• Webhook signatures are verified to prevent spoofing

While we implement industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

Active accounts: We retain your data for as long as your account is active.

Deleted accounts: When you request account deletion, we will delete your personal data and project content within 30 days. Some data may be retained longer where required by law (e.g., billing records for tax compliance, typically 7 years).

Canceled subscriptions: Your account and data remain accessible on the free tier after cancellation. You can continue to access past estimates and project data.

You have the right to:

• Access your personal data — view it in your account settings or request a copy
• Correct inaccurate data — update your profile information at any time
• Delete your data — request account deletion by contacting support@steelfloai.com
• Export your data — download your estimates and takeoff results as CSV files
• Opt out of analytics — use the cookie consent banner to decline non-essential cookies
• Opt out of human review — email support@steelfloai.com to exclude your drawings from review by independent estimators (see Section 3)

To exercise any of these rights, contact us at support@steelfloai.com. We will respond within 30 days.

We use the following cookies and tracking technologies:

• Essential cookies: Required for authentication and session management. Cannot be disabled.
• Analytics cookies (Google Analytics): Help us understand how users interact with SteelFlo. You can opt out via the cookie consent banner or by using browser extensions like Google Analytics Opt-out.
• Support cookies (Crisp): Enable the live chat support widget. Can be disabled via the cookie consent banner.

We do not use advertising cookies or sell data to advertisers.

SteelFlo is a business tool not intended for use by individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

SteelFlo is operated from the United States. If you access the Service from outside the U.S., your data may be transferred to and processed in the United States. By using SteelFlo, you consent to this transfer.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how we use it
• Right to request deletion of your personal information
• Right to opt out of the sale of personal information — we do not sell your personal information
• Right to non-discrimination for exercising your privacy rights

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. The "Effective date" at the top of this page indicates when it was last revised. Your continued use of SteelFlo after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

SteelFlo AI
Email: support@steelfloai.com