Privacy Policy

1. Who we are

Pipeline is operated by Don Howard Construction. In this policy, “we,” “us,” and “our” mean Don Howard Construction. Questions about privacy can be sent to donhowardpainting@gmail.com.

2. Information we collect

We collect the information needed to run construction sales and operations, including:

• Customer and contact details, such as names, phone numbers, email addresses, and project addresses.
• Project information, such as notes, estimates, contracts, appointments, photos, files, invoices, and job status.
• Communications, such as calls, messages, emails, estimates, follow-ups, and customer replies handled through Pipeline.
• Team account information, such as names, work email addresses, phone numbers, roles, and sign-in activity.
• Payment-related records. Card and bank details are processed by Stripe; we do not store full card or bank numbers in Pipeline.
• Technical information, such as device/browser details, security logs, cookies, and usage records needed to keep the service reliable.
• Google connection information when a team member connects Gmail or Google Calendar, including the connected mailbox address and authorization tokens needed to provide the requested features.

3. How we use information

• Create, send, track, and manage estimates, contracts, invoices, payments, appointments, and jobs.
• Send customer emails, appointment updates, reminders, and other project communications.
• Sync requested appointments with Google Calendar and send requested email through connected Gmail accounts.
• Route calls and messages, maintain communication history, and support field-team coordination.
• Transcribe, translate, summarize, classify customer replies, or draft business content when those features are used.
• Analyze project photos to create searchable captions, tags, issue notes, and safety observations.
• Secure accounts, prevent misuse, troubleshoot problems, maintain records, and meet legal or accounting obligations.

4. Service providers

We use trusted service providers to operate Pipeline. They receive only the information needed for their service:

• Replit: application hosting, database, file storage, and related infrastructure.
• Google: Gmail sending, Google Calendar synchronization, and Google account authorization.
• Twilio: business call and text-message routing.
• Stripe: payment processing and payment-status updates.
• Brevo and Resend: backup transactional-email delivery.
• OpenAI: transcription, translation, summarization, customer-reply classification, writing assistance, and automatic project-photo analysis. Photo analysis sends the uploaded image and limited project context (such as filename, category, phase, and location) to OpenAI and stores the resulting caption, tags, issue notes, and safety observations in Pipeline.

These providers handle information under their own privacy terms and security practices.

5. Google API data and Limited Use

Pipeline requests only the Google access needed for the feature a team member turns on:

• Member Google connections may request access to Google Calendar events, the list of writable calendars, Gmail sending, read-only Gmail access, and basic Google profile/email identity.
• The shared company Gmail connection requests Gmail sending and basic profile/email identity only. Pipeline does not read the shared mailbox or connect it to Google Calendar.
• Calendar use: Pipeline reads the selected calendar’s event details and calendar list, and creates, updates, or deletes Pipeline appointments in Google Calendar when requested. Stored calendar data is limited to the calendar/event identifiers, event details, times, links, and sync status needed to show and maintain the schedule.
• Gmail sending: Pipeline sends only the estimate, contract, invoice, campaign, or follow-up email requested by an authorized team member.
• Read-only Gmail use: for automated estimate follow-up, Pipeline searches the sending team member’s mailbox for messages from the customer after the estimate was sent, checks up to five matching messages, and extracts only the plain-text reply or Gmail snippet. Attachments and unrelated mailbox content are not copied into Pipeline.
• Reply classification: the customer name, estimate number, and up to 4,000 characters of the reply text may be sent to OpenAI to classify the reply as reviewing, declined, accepted, or other. Pipeline stores the Gmail message ID, classification, a short summary, and the reply date—not the full email body.

Pipeline’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Pipeline does not use Google user data for advertising, sale, unrelated profiling, or generalized AI-model training. No human reads Gmail content except when an authorized user views the reply in their own mailbox, when that user affirmatively asks us to support a specific issue involving that data, or when limited access is required for security, abuse prevention, or a legal obligation.

A team member can disconnect Google in Pipeline Settings, and anyone can revoke Pipeline’s access from their Google Account permissions page. Disconnecting stops future Google access and disables the stored connection. CRM project records, calendar event references, and reply classifications created before disconnect may remain as business records. To request deletion of remaining Google-derived data, email donhowardpainting@gmail.com.

6. Cookies and local storage

Pipeline uses required cookies and browser storage for sign-in sessions, security, preferences, offline work, and application caching. We do not use advertising cookies or sell browsing activity.

7. How information is shared

We do not sell personal information. We may share information:

• With the service providers listed above, only as needed to operate Pipeline.
• With customers, team members, subcontractors, or vendors when needed for a project.
• When required by law, court order, safety concern, or to protect rights and prevent fraud.
• As part of a business transfer, merger, or sale, subject to appropriate protections.

8. Data retention and security

We keep information for as long as needed to provide services, maintain business and financial records, resolve disputes, and meet legal obligations. We use access controls, encrypted connections, and provider safeguards, but no internet service can guarantee absolute security.

9. Your choices and rights

You may ask to review, correct, export, or delete personal information by emailing donhowardpainting@gmail.com. We may need to keep certain signed documents, payment records, communications, or other information when the law or a legitimate business need requires it.

10. Children

Pipeline is a business service and is not directed to children under 13. If we learn that we collected information from a child under 13 without a lawful basis, we will take reasonable steps to remove it.

11. Changes to this policy

We may update this Privacy Policy as Pipeline or applicable law changes. The “Last updated” date shows the current version. Material changes will be posted on this page.

12. Governing law and contact

This policy is governed by the laws of the State of Maryland, except where other applicable privacy law provides additional rights. Contact us at donhowardpainting@gmail.com with privacy questions or requests.