Privacy Policy

What we collect

Account data. Your email address (used for magic-link sign-in), your name if you provide it, and the workspace and role you belong to. We also record sign-in timestamps, IP address, and browser user-agent as a security trail.

Project data. Whatever your workspace puts into the service: projects, units, schedules, budgets, payments, draws, punch items, daily logs, photos, and documents. This can include personal information about the owners, subcontractors, and team members your workspace invites or references. Your workspace controls that content.

Billing data. Subscription plan, status, and invoices are handled by Stripe. Your card number goes directly to Stripe and never touches our servers; we store only Stripe’s customer and subscription identifiers.

Website visits. When you browse our public website (www.epextechnology.com), Google Analytics and the Meta Pixel record the pages you view, how you arrived (for example, the ad or link you clicked), your browser and device type, and your IP address. Before anything is sent, we remove personal details such as an email address from the page address; only campaign tags (utm_*, gclid, fbclid) are kept.

Booking requests. When you book a call, the name, email, phone number and notes you enter go to our booking and CRM provider, LeadConnector (HighLevel), so we can confirm the call and send reminders.

How we use it

To run the product: authenticate you, scope what you can see to your role and workspace, bill subscriptions, send the emails you trigger (sign-in links, team invites, e-signature requests), and keep the service secure.

On the public website, we use visit data to understand which pages and campaigns bring people to us, and to measure and improve our advertising on Google, Facebook and Instagram. We do not sell your data, and we never use your workspace’s project data for advertising.

Who can see what

Access is scoped in the database itself with row-level security: workspace members see their workspace’s projects, an owner sees only their own unit’s rows, and invited subcontractors see schedule and field data but not project financials. Our staff access customer data only to operate and support the service.

Service providers

We rely on a small set of processors to run the service: Supabase (database, authentication, and file storage), Vercel (application hosting), Stripe (payments), and an e-signature provider (SignWell) when you send documents for signature. Each receives only what it needs to perform its function.

On the public website, Google (Analytics) and Meta (the Meta Pixel) receive visit data, and LeadConnector (HighLevel) receives booking details. Google and Meta process visit data under their own privacy policies and may use it to measure and deliver ads.

Retention & deletion

Your project data is kept for as long as your workspace exists, including through a lapsed subscription, so nothing is lost if a card fails. You can export your data at any time, and you can request deletion of your account or your entire workspace by emailing us; we delete it within 30 days, except records we must keep for legal or accounting reasons.

Security

All traffic is encrypted in transit (TLS) and data is encrypted at rest by our hosting providers. Sign-in is passwordless (magic links), so there is no password database to breach. Authorization is enforced by database row-level security, not just in the interface. If we ever discover a breach affecting your data, we will notify your workspace administrator without undue delay.

Cookies

Essential cookies. The signed-in EPEX Build app uses only the cookies needed to keep you signed in. It does not load analytics or advertising tags.

Analytics and advertising cookies. Our public website pages set cookies from Google Analytics (such as _ga) and the Meta Pixel (such as _fbp). They let us count visits, see which campaigns work, and measure our ads on Google, Facebook and Instagram. The booking calendar is embedded from LeadConnector, which may set its own cookies to run the booking form.

Your choices. You can block or delete these cookies in your browser settings, install Google’s Analytics opt-out add-on, and control how Meta uses this data in your Facebook or Instagram ad settings. Blocking them does not affect the app.

Your rights & contact

You can ask us to access, correct, export, or delete your personal information at epextechnology@gmail.com. If your workspace entered your information (for example, you are an owner on a builder’s project), we may route the request through that workspace’s administrator, who controls that content. See also our Terms of Service.