Privacy Policy

1. Information We Collect

We collect information you provide directly, including:

• Account information: full name, email address, phone number, company name
• Build documentation: photos, videos, plans, notes, customer updates, contracts, selections, change orders, signatures, and payment records
• Payment information: processed by Stripe — we do not store full card numbers
• Communications: messages sent to team members, customers, or support

We also automatically collect certain usage data, including IP addresses, browser type, pages visited, and device information.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the CERTAFI platform
• Manage Builds, customer portals, and permanent Build Records
• Process payments and send billing-related communications
• Respond to support requests and communicate about your account
• Send important service announcements and policy updates
• Detect and prevent fraud and abuse

We do not sell your personal information to third parties. We do not use your build photos or documentation for marketing without your explicit consent.

3. GPS and Location Data

Photos captured or submitted through CERTAFI may contain embedded GPS metadata (EXIF data). We may extract and store this location data as part of the Build Record and to label live captures.

GPS coordinates may be visible to authorized company users and, when the builder chooses to share them, customers. Precise location data is not made public by default.

Manual uploads are allowed and may not include GPS data. A GPS or live-capture label describes available metadata only; it does not certify, inspect, approve, or verify the construction shown.

4. Photo Storage and Retention

Photos and documents submitted to CERTAFI are stored using Supabase Storage. Completed Build Records may be retained to provide the permanent documentation service requested by builders and customers.

If an account is terminated, submitted Build documentation may be retained for record-keeping, contractual, security, and legal purposes, subject to applicable law.

You may request deletion of personal account data by contacting support@getcertafi.com. Some Build Record content may need to be retained where another authorized user owns the record or where retention is legally permitted or required.

5. Third Party Services

CERTAFI uses the following third-party services to operate the platform:

• Supabase — Database, authentication, and file storage (including photos and videos). Data is stored in US data centers. Privacy policy
• Stripe — Payment processing. Card data is handled entirely by Stripe; we do not store full card numbers on CERTAFI servers. Privacy policy
• Resend — Transactional email, including account, Build, customer, and payment-related notifications. Privacy policy
• Anthropic — Powers ANNA (in-app building assistant) and the public website assistant; chat messages are sent to Anthropic's API to generate replies. Privacy policy
• Sentry — Error and performance monitoring; may receive technical diagnostics and limited context when issues occur. Privacy policy

These services have their own privacy policies and data practices. We encourage you to review them. For more on how we use these relationships and our commitment not to sell your data, see Section 7.

6. Data Security

We implement industry-standard security measures to protect your information, including encrypted connections (HTTPS/TLS), secure authentication via Supabase, and role-based access controls that limit data access to authorized users.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you suspect unauthorized access to your account, please change your password immediately and contact us.

7. Your Data Is Not For Sale

CERTAFI does not sell, rent, or trade your personal information to third parties for money or other consideration. Your data is collected and used to operate the build management platform and related services—not for unrelated marketing by us or data brokers.

We do share limited information with trusted service providers ("processors") that help us run CERTAFI. They act on our instructions and are not allowed to use your information for their own marketing. We share only what is reasonably necessary for each service:

• Stripe — Processes payments. When you pay, Stripe may collect and retain information such as name, email, phone, and billing details under their privacy policy. We do not store your full credit card details on our systems. Stripe is PCI-DSS compliant.
• Supabase — Hosts authentication, application data, and file storage (including photos, videos, and Build Records) on our behalf, with access controlled by our product and policies.
• Resend — Delivers transactional emails such as Build updates, customer notifications, payment notices, and account-related messages. Message content may include information needed to identify your account or Build.
• Anthropic — Powers ANNA (signed-in building assistant) and the public website assistant. Text you send in those chats is transmitted to Anthropic's API to produce responses. Do not include passwords, full payment card numbers, or other highly sensitive data in chat messages.
• Sentry — Receives error reports and related technical data (e.g. stack traces, URLs, device or browser metadata) to help us diagnose and fix issues. We configure Sentry to minimize personal data where feasible.

None of these partners may use your personal information for their own advertising or marketing unrelated to providing the service to CERTAFI. If you have questions about how your data is handled, contact us at support@getcertafi.com.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal account data, subject to retention requirements
• Portability — Request your data in a machine-readable format
• Objection — Object to certain processing of your data

To exercise any of these rights, contact us at support@getcertafi.com. We will respond within 30 days.

9. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

support@getcertafi.com