Privacy Policy

1. Who We Are

Gradelog (gradelog.com) is a field documentation SaaS platform for precision contractors. We provide grade verification, as-built reporting, calibration tracking, daily logs, and AI-assisted field documentation tools. Gradelog is operated by Gradelog (420 Industrial Blvd, Nash, TX 75569).

For privacy-related questions or requests, contact: privacy@gradelog.com

For general legal matters: legal@gradelog.com

2. Data We Collect

Account Information

• Identity: Full name, job title
• Contact: Email address, phone number
• Organization: Company name, organization account details, team member relationships
• Authentication: Hashed passwords, session tokens, OAuth provider tokens

Subscription & Billing

• Payment information: Billing details processed securely by Stripe (we do not store raw card numbers)
• Subscription history: Plan tier, billing dates, renewal history, invoices

Field Data & Uploads

• Field reports: Grade verification data, as-built documentation, site measurements
• Photos and files: Job site images, PDFs, survey files, and other documents you upload
• Location data: Geographic coordinates, site addresses, and map data associated with your jobs
• Job information: Project names, site locations, equipment information
• Calibration records: Equipment calibration logs and tracking data

AI Conversations

• Chat messages: Your questions and messages to our AI Field Assistant
• AI responses: Content generated in response to your queries
• Context data: Information shared during AI sessions to provide relevant answers

Usage Data

• Analytics: Pages visited, features used, session duration (via Google Analytics 4)
• Device information: IP address, browser type, operating system, device identifiers
• Performance data: Error logs, crash reports, load times

3. Sources of Data

• Directly from you: When you create an account, upload files, fill in forms, or contact support
• Automatically: Server logs, cookies, device sensors (location via your browser or mobile device), and analytics tools as you use the platform
• Third-party integrations: OAuth sign-in providers (Google), payment processors (Stripe), email platforms (Klaviyo)

4. How We Use Your Data & Legal Bases

Where GDPR or UK GDPR applies, the legal basis for each use is noted in brackets.

5. AI & Automated Decision-Making

Your AI & Profiling Rights

• Opt out of profiling/ADMT: You may request to opt out of any automated decision-making or profiling that meaningfully affects you by emailing privacy@gradelog.com.
• Human review: If you believe an AI-influenced outcome affected your account or service, you may request human review by contacting support.
• GDPR Article 22: EU/UK residents have the right not to be subject to solely automated decisions with legal or significant effects, and to request human review.

Your Data & AI Model Training

Your project data, photos, and field documentation are used only to provide the Gradelog service to you. We do not use your proprietary customer data to train AI models for other customers or for general model improvement purposes without your explicit consent. Conversations processed by Anthropic Claude may be subject to Anthropic's Privacy Policy and their API usage terms.

6. Data Sharing & Third Parties

We do not sell your personal information. We share data only with the following service providers:

We may also disclose your information if required by law, court order, or to protect the rights and safety of Gradelog, our customers, or the public.

7. International Data Transfers

Gradelog is operated from the United States. Your data is stored in the US (AWS us-east-2 region). If you are located outside the United States — including the EU, UK, Canada, or Australia — your data will be transferred to and processed in the US.

• EU / UK: Where we transfer personal data from the EU or UK, we rely on Standard Contractual Clauses (SCCs) and/or UK International Data Transfer Agreements (IDTAs) with our service providers as the transfer mechanism.
• Canada (PIPEDA): We take steps to ensure comparable protection applies to data transferred outside Canada, including through contractual commitments with our processors.
• Australia: We take reasonable steps to ensure that overseas recipients handle personal information in accordance with the Australian Privacy Principles.

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Retention criteria include: the nature of the data, legal and regulatory obligations, and whether you have an active account.

9. Your Rights — US State Privacy Laws

Residents of California and 19 other US states (including Virginia, Colorado, Connecticut, Texas, Utah, Montana, Oregon, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Kentucky, Maryland, Nebraska, Minnesota, Rhode Island, and others effective 2025–2026) have privacy rights under their state laws. We honor these rights for all qualifying US residents.

10. Your Rights — GDPR & UK GDPR (EU/EEA & UK Residents)

If you are located in the EU, EEA, or United Kingdom, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data and information about how we use it
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”)
• Right to Restriction (Art. 18): Request that we limit how we process your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is consent-based
• Right Not to be Subject to Automated Decisions (Art. 22): Request human review of any automated decision with significant legal effects

Submit requests to privacy@gradelog.com. We respond within 30 days (extendable by two months for complex requests with prior notice).

You have the right to lodge a complaint with your local supervisory authority. For EU residents, this is your national data protection authority. For UK residents, this is the Information Commissioner's Office (ICO) at ico.org.uk.

11. Canadian Residents — PIPEDA

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws govern our handling of your personal information.

• We collect, use, and disclose your personal information only for the purposes described in this policy, or as you have otherwise consented
• You may withdraw consent to non-essential uses (such as marketing emails) at any time
• You have the right to access your personal information and request correction of inaccuracies
• You have the right to challenge our compliance with PIPEDA
• We retain personal information only as long as necessary for the identified purposes

To exercise your rights or submit a complaint, email privacy@gradelog.com. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

12. Australian Residents — Privacy Act

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) govern our handling of your personal information.

• We collect personal information only by lawful and fair means and only when reasonably necessary for our functions
• You have the right to access and correct your personal information
• Your personal information may be disclosed to overseas recipients (primarily in the US); we take reasonable steps to ensure comparable protection applies
• You may make a complaint about our handling of your personal information

Automated Decision-Making (ADM) Transparency: Our AI Field Assistant generates suggestions based on your messages and context. No personal information is used to make decisions about you solely by automated means. All account, billing, and service decisions are made by human staff.

To access or correct your information, or to make a complaint, email privacy@gradelog.com. You may also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. File Uploads & Field Data

Files and documents you upload to Gradelog — including field reports, job site photos, grade data, and calibration records — are:

• Encrypted at rest and in transit using industry-standard encryption
• Accessible only to your organization — other organizations cannot access your data
• Stored in the United States on AWS infrastructure (us-east-2)
• Backed up regularly to protect against data loss
• Deleted within 30 days of account closure

Gradelog staff may access file content only when necessary for technical support, at your request, or as required by law.

14. Account Deletion & Your Right to Delete

If you cannot access your account, email privacy@gradelog.com to request deletion.

15. Cookies

We use the following types of cookies on gradelog.com:

EU/EEA visitors will be asked for consent for non-essential cookies. You can manage cookie preferences in your browser settings.

16. Children's Privacy

Gradelog is a professional platform for adults and is not directed at anyone under the age of 16. We do not knowingly collect personal information from users under 16. If we become aware that we have collected data from a minor, we will delete it promptly. Contact privacy@gradelog.com if you believe we have inadvertently collected data from a minor.

17. Security

We protect your data using TLS encryption in transit, AES-256 encryption at rest, role-based access controls, and regular security reviews. Supabase Row-Level Security ensures organizational data isolation. While we take reasonable precautions, no system is completely secure. Report suspected security vulnerabilities to legal@gradelog.com.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the date at the top and notify you of material changes via email or in-app notification. Continued use of Gradelog after changes take effect constitutes acceptance of the updated policy.

19. Contact & Complaints

EU/UK residents may also contact their national supervisory authority. Australian residents may contact the OAIC. Canadian residents may contact the Office of the Privacy Commissioner of Canada. We take all complaints seriously and will respond within 30 days.