Privacy Policy

Guthrie AI ("Guthrie AI," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have.

This Policy applies to our website (www.guthrieai.com), the Guthrie AI platform and applications, and any related services (collectively, the "Service"). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, company name, role, phone number, and password
• Billing information: company billing address and payment method details (processed by our payment processors; we do not store full credit card numbers)
• Customer Content: project documents, drawings, drawings, specifications, RFPs, pricing data, and other materials you upload to the Service
• Communications: messages you send us via email, support tickets, forms, or chat
• Survey responses and feedback you voluntarily provide

1.2 Information Collected Automatically

• Usage data: pages visited, features used, time spent, clicks, and navigation patterns
• Device data: IP address, browser type and version, operating system, device type, and screen resolution
• Log data: access times, referring URLs, error logs, and diagnostic events
• Cookies and similar technologies: as described in our Cookie Policy

1.3 Information From Third Parties

• Business contact details from public sources, professional networks, or partners
• Authentication data if you sign in through a third-party provider
• Integration data from tools you connect to the Service (e.g., Building Connected, Bluebeam, SharePoint)

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service
• Create and manage your account and authenticate you
• Process payments and manage subscriptions
• Deliver the core features of the Service (document organization, takeoffs, RFIs, proposals)
• Communicate with you about your account, updates, and support requests
• Send marketing communications (with your consent where required by law)
• Detect, prevent, and address fraud, abuse, or security issues
• Comply with legal obligations and enforce our Terms of Service
• Train and improve our AI models using aggregated, de-identified data (never sharing your confidential project data between customers)

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contractual necessity: to perform our agreement with you and provide the Service
• Legitimate interests: to improve the Service, prevent fraud, and manage our business
• Consent: where you have given us permission (e.g., marketing emails, non-essential cookies)
• Legal obligation: to comply with applicable laws

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers: trusted vendors who process data on our behalf (hosting, payment processing, analytics, email delivery, support tools), bound by confidentiality and data protection obligations
• Within your organization: team members and administrators you authorize to access your workspace
• Third-party integrations you enable: for example, when you connect Building Connected or email tools
• Legal requirements: when required by law, subpoena, court order, or to protect our rights, property, or the safety of our users
• Business transfers: in connection with a merger, acquisition, or sale of assets, in which case the acquirer will be bound by this Policy

Customer Confidentiality: we enforce strict non-disclosure obligations and technical separation. Your Customer Content is never shared with other customers or used to serve competitors.

5. International Data Transfers

Guthrie AI is based in the United States. If you access the Service from outside the US, your information may be transferred to, stored, and processed in the US and other countries where our service providers operate. When we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. Data Retention

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you terminate your account, we will delete or de-identify your data in accordance with our retention schedule, generally within 90 days, except where retention is required by law.

7. Data Security

We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption in transit (TLS) and, where applicable, at rest
• Role-based access controls and authentication
• Regular security reviews and monitoring
• Vendor due diligence and contractual safeguards

No system is completely secure. If we become aware of a breach affecting your personal information, we will notify you and relevant authorities as required by law.

8. Your Rights and Choices

Depending on your location, you may have some or all of the following rights:

• Access a copy of your personal information
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention requirements)
• Object to or restrict processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent where processing is based on consent
• Opt out of marketing communications at any time via the unsubscribe link or your account settings
• Non-discrimination for exercising your privacy rights

California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion, request correction, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA. You may also designate an authorized agent to make requests on your behalf.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, analyze usage, and improve your experience. For details, including how to manage preferences, please review our Cookie Policy.

10. Children's Privacy

The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@guthrieai.com so we can delete it.

11. Third-Party Websites

The Service may contain links to third-party websites or services. We are not responsible for their content or privacy practices. We encourage you to review their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via a prominent notice on the Service at least 30 days before they take effect. The "Last updated" date at the top indicates the most recent revision.