Privacy Policy

Privacy at a Glance

This table summarizes key privacy practices. Please read the full policy below for complete details.

Section 1 — Introduction & Scope

1.1 Who We Are

PerchOS, Inc. ("PerchOS," "we," "us," or "our") is a Delaware corporation with its principal place of business in Winter Park, Florida. We operate the PerchOS platform, which provides residential home builders with project management, cost intelligence, buyer experience, subcontractor management, and AI-powered analytics tools.

1.2 Purpose of This Policy

This Privacy Policy describes how PerchOS collects, uses, stores, shares, and protects information when you:

• Access or use the PerchOS web platform, mobile applications, or APIs ("Services");
• Visit our website at perchos.io;
• Interact with our sales, support, or marketing communications;
• Submit data to the Platform as a Builder User, Authorized User, or in any other capacity.

1.3 Who This Policy Covers

This policy applies to:

• Builder Users: Companies and their employees who subscribe to and operate the Platform.
• Authorized Users: Individuals granted access by a Builder User.
• Buyers: End-homebuyers whose information is submitted to the Platform by a Builder User.
• Subcontractors: Trade contractors and vendors whose information is entered into the Platform.
• Website Visitors: Anyone who visits perchos.io.

1.4 What This Policy Does Not Cover

This policy does not cover third-party services, websites, or applications that may be linked from the Platform. Those services are governed by their own privacy policies, and we encourage you to review them.

Section 2 — Information We Collect

2.1 Information You Provide Directly

2.1.1 Account Registration Data

When you create a PerchOS account, we collect:

• Full name, email address, phone number, and job title.
• Company name, business address, and website.
• Contractor license numbers and state of licensure (where provided).
• Billing information (processed via our payment processor — PerchOS does not store full credit card numbers).
• Account credentials (passwords stored in encrypted, hashed form).

2.1.2 Builder Project Data

In the course of using the Platform, you submit construction project data including:

• Project names, addresses, lot numbers, and parcel information.
• Construction budgets, purchase orders, cost codes, and variance data.
• Subcontractor bids, contracts, invoices, and performance records.
• Permit applications, permit numbers, inspection records, and jurisdictional correspondence.
• Project schedules, milestone data, and completion records.
• Internal communications, notes, and decision logs.
• Photographs, documents, drawings, and specifications uploaded to the Platform.

2.1.3 Buyer Selection & Decision Data

When your homebuyers interact with the Buyer-facing modules of the Platform, we may collect:

• Buyer name, email address, and phone number (submitted by you as the Builder).
• Buyer selection choices (finishes, upgrades, options, and design selections).
• Buyer approval and sign-off records.
• Buyer preference signals and interaction timestamps.
• Communications between builder and buyer conducted through the Platform.

2.1.4 Subcontractor Data

Builder Users may enter subcontractor information into the Platform, which may include:

• Company name, contact name, email, phone number, and business address.
• License numbers, insurance certificates, and bonding information.
• Bid history, pricing, and scope of work records.
• Performance ratings, notes, and correspondence.

2.2 Information Collected Automatically

2.2.1 Usage & Log Data

When you use the Platform, our servers automatically collect:

• IP address, device type, operating system, and browser type.
• Pages visited, features accessed, and actions taken within the Platform.
• Session start and end times, click paths, and navigation patterns.
• Error logs, crash reports, and performance metrics.
• API call logs, request timestamps, and response data.

2.2.2 Cookies & Tracking Technologies

We use cookies and similar technologies including web beacons, pixel tags, and local storage. See Section 9 (Cookies) for full details.

2.2.3 AI Interaction Logs

When you use AI-powered features such as the Buyer Intelligence Engine, Predictive Cost Engine, or Subcontractor Intelligence Engine, we may log:

• Queries and prompts submitted to AI models.
• AI-generated outputs returned to you.
• Feedback signals (positive/negative ratings) on AI responses.
• Feature engagement patterns used to improve AI model performance.

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Integration partners (e.g., accounting software, CRM tools) that you connect to your PerchOS account.
• Payment processors, for billing and fraud prevention purposes.
• Identity verification services, where applicable.
• Publicly available business registries, for account verification purposes.

Section 3 — How We Use Your Information

3.1 Delivering and Operating the Services

We use collected information to:

• Authenticate users and maintain account security.
• Provide access to Platform features in accordance with your Subscription tier.
• Process and store builder project, buyer, and subcontractor data as directed by Builder Users.
• Generate reports, dashboards, and analytics within the Platform.
• Facilitate communication between Builder Users and their buyers or subcontractors through Platform tools.
• Process payments and maintain billing records.

3.2 Improving and Developing the Services

We use collected information to:

• Analyze usage patterns to identify features that are working well or poorly.
• Diagnose technical issues and resolve bugs.
• Develop new features, modules, and product improvements.
• Conduct internal research and development on AI/ML model performance.

3.3 AI Model Training & Improvement

PerchOS's AI capabilities — including the Buyer Intelligence Engine, Predictive Cost Engine, and Subcontractor Intelligence Engine — are trained and improved using data from across our user base. Specifically:

• We use anonymized and de-identified Builder Data to train, validate, and refine AI and machine learning models.
• We do not use raw, identifiable buyer personal information (names, email addresses, phone numbers) to train AI models without your express consent.
• We may use de-identified buyer preference and selection patterns as training signals for recommendation systems.
• We may use de-identified cost, schedule, and performance data to improve predictive accuracy.

3.4 Network Intelligence & Benchmarking

A core component of the PerchOS value proposition is the ability to provide builders with benchmarks, market insights, and industry comparisons drawn from the collective data of all Platform users. To deliver this:

• We aggregate and anonymize Builder Data from across our user network to generate Network Intelligence Data.
• Network Intelligence Data does not identify individual builders, projects, buyers, or subcontractors.
• We may commercialize Network Intelligence Data — for example, by providing market benchmarking reports — as a feature of the Platform or as a standalone product.
• Our right to retain and use Network Intelligence Data survives the termination of any individual subscription.

3.5 Communications

We use your contact information to:

• Send transactional communications (account confirmations, password resets, billing receipts, service notifications).
• Provide customer support and respond to inquiries.
• Send product updates, feature announcements, and educational content (you may opt out of marketing emails).
• Notify you of changes to these Terms, this Policy, or the Services.

3.6 Legal & Compliance Purposes

We may process information to:

• Comply with applicable laws, regulations, and legal process.
• Enforce our Terms of Service and other agreements.
• Detect, investigate, and prevent fraud, security breaches, and abuse.
• Respond to lawful requests from government authorities.
• Establish, exercise, or defend legal claims.

3.7 Legal Bases for Processing (GDPR)

For users whose data is subject to the GDPR, our legal bases for processing include:

• Contract Performance: Processing necessary to deliver the Services you have subscribed to.
• Legitimate Interests: Platform improvement, AI training on anonymized data, fraud prevention, and network intelligence, where our interests do not override your rights.
• Legal Obligation: Processing required by applicable law.
• Consent: Where we specifically request consent (e.g., marketing emails, certain AI training activities).

Section 4 — How We Share Your Information

4.1 We Do Not Sell Personal Data

PerchOS does not sell personally identifiable Builder Data, buyer personal information, or subcontractor personal information to third parties for their independent commercial use. This applies regardless of the definition of "sale" under applicable state privacy laws, including the California Consumer Privacy Act (CCPA) and Florida's Digital Bill of Rights.

4.2 Service Providers

We share information with trusted third-party service providers who assist us in operating the Platform, subject to contractual obligations to protect your data. These providers include:

4.3 Sharing Within Your Organization

Builder Data is shared among Authorized Users within your Builder User account in accordance with the role-based access controls you configure. PerchOS does not share your Builder Data with other Builder User organizations.

4.4 Integration Partners

If you connect your PerchOS account to a third-party integration (e.g., QuickBooks, Procore, or a CRM tool), data may be shared with that third party in accordance with the integration's scope and your configuration settings. PerchOS is not responsible for how integration partners handle data they receive.

4.5 Legal Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request.
• Protect the rights, property, or safety of PerchOS, our users, or the public.
• Detect, prevent, or address fraud, security breaches, or technical issues.
• Enforce our Terms of Service or other agreements.

Where permitted by law, we will notify you of such requests.

4.6 Business Transfers

If PerchOS is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred to a successor entity. We will provide notice prior to any such transfer and the successor entity will be bound to honor this Privacy Policy or provide materially equivalent protections.

4.7 Aggregated & De-Identified Data

We may share aggregated, anonymized, or de-identified data — including Network Intelligence Data — with partners, investors, or the public for market research, benchmarking, or business development purposes. This data cannot reasonably be used to identify you or your projects.

Section 5 — Data Security

5.1 Security Measures

PerchOS implements commercially reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, loss, or destruction. Our security program includes:

• Encryption in Transit: All data transmitted between your browser/application and PerchOS servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Builder Data stored on our servers is encrypted using AES-256 encryption.
• Access Controls: Role-based access controls (RBAC) restrict access to Builder Data to authorized personnel only. PerchOS employee access to production data requires multi-factor authentication and is subject to least-privilege principles.
• Vulnerability Management: We conduct regular security assessments, penetration testing, and code reviews.
• Incident Response: We maintain a documented incident response plan and conduct regular drills.
• SOC 2 Compliance: PerchOS is pursuing SOC 2 Type II certification. Current compliance status is available upon request.

5.2 Your Role in Security

You are responsible for maintaining the security of your account credentials and for ensuring that Authorized Users follow appropriate security practices. You should:

• Use strong, unique passwords for your PerchOS account.
• Enable multi-factor authentication (MFA) where available.
• Promptly revoke access for departing employees or contractors.
• Notify us immediately at security@perchos.io if you suspect unauthorized access to your account.

5.3 Limitations

No security system is impenetrable. Despite our best efforts, we cannot guarantee that unauthorized third parties will never defeat our security measures. You provide information to PerchOS at your own risk.

5.4 Data Breach Notification

In the event of a confirmed data breach affecting your Builder Data or buyer personal information, PerchOS will:

• Notify you without undue delay following discovery and confirmation of the breach.
• Provide notification in compliance with applicable law (including GDPR Article 33/34, the Delaware Computer Security Breach Notification Act (6 Del. C. § 12B-101 et seq.), applicable state breach notification laws where affected users reside, and other applicable federal requirements).
• Include in our notification: the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed.
• Cooperate with your own investigation and notification obligations.

Section 6 — Data Retention & Deletion

6.1 Retention During Active Subscription

We retain Builder Data, including all project, buyer, and subcontractor information, throughout the duration of your active Subscription. This allows you to access historical project data, run reports, and use AI features that depend on longitudinal data.

6.2 Post-Termination Retention

Following the termination or expiration of your Subscription:

• We retain your Builder Data for a period of ninety (90) days, during which you may request a data export.
• After 90 days, we will delete or anonymize your identifiable Builder Data from production systems.
• Backups and disaster recovery archives may retain data for up to an additional 30 days before purging.
• De-identified and aggregated Network Intelligence Data derived from your Builder Data is retained indefinitely for benchmarking and AI purposes.

6.3 Legal Hold

We may retain data beyond standard retention periods if retention is required to comply with a legal obligation, resolve a dispute, enforce an agreement, or respond to a government investigation.

6.4 Account-Level Deletion Requests

Builder Users may request deletion of their account and associated identifiable data by contacting privacy@perchos.io. We will process deletion requests within thirty (30) days, subject to legal hold requirements. We will confirm completion of deletion in writing.

6.5 Buyer Data Deletion

Builder Users may request deletion of specific buyer personal information records from the Platform. PerchOS will process such requests within thirty (30) days. Buyers seeking deletion of their information should direct their request to the Builder who collected their information.

Section 7 — Your Privacy Rights

7.1 Universal Rights

Regardless of your location, PerchOS provides the following rights to all users:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention obligations.
• Data Portability: Request your Builder Data in a structured, machine-readable format (CSV, JSON, or PDF).
• AI Training Opt-Out: Opt out of your data being used to train PerchOS AI models.
• Marketing Opt-Out: Unsubscribe from marketing communications at any time via the unsubscribe link in any marketing email or by contacting privacy@perchos.io.

7.2 California Privacy Rights (CCPA/CPRA)

California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected, the business purposes for collection, and the categories of third parties with whom we share information.
• Right to Delete: Request deletion of personal information we have collected from you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: PerchOS does not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: Where applicable, request that we limit our use of sensitive personal information.
• Non-Discrimination: You will not receive discriminatory treatment for exercising your CCPA rights.

7.3 GDPR Rights (EEA & UK Residents)

Where the GDPR or UK GDPR applies, you have the following rights:

• Right of Access (Article 15): Obtain a copy of your personal data.
• Right to Rectification (Article 16): Correct inaccurate data.
• Right to Erasure (Article 17): Request deletion ("right to be forgotten"), subject to legitimate retention grounds.
• Right to Restriction (Article 18): Request restriction of processing in certain circumstances.
• Right to Data Portability (Article 20): Receive your data in a portable format.
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making (Article 22): Request human review of decisions made solely by automated means that significantly affect you.
• Right to Lodge a Complaint: Lodge a complaint with your local data protection authority.

7.4 Florida Digital Bill of Rights

Florida residents may have additional privacy rights under the Florida Digital Bill of Rights (FDBR), effective July 1, 2024. These include rights to access, correction, deletion, portability, and opt-out of the sale of personal data and targeted advertising. PerchOS does not engage in targeted advertising or sell personal data, and we honor applicable FDBR rights.

7.5 How to Exercise Your Rights

To exercise any of the above rights, please contact us at:

We will respond within thirty (30) days (or as required by applicable law). We may require identity verification before processing your request. We will not charge a fee for reasonable requests but may charge a reasonable fee or decline to act on manifestly unfounded or excessive requests.

Section 8 — International Data Transfers

8.1 Data Location

PerchOS stores and processes data primarily within the United States. Our cloud infrastructure is hosted within U.S.-based data centers operated by major cloud providers.

8.2 Cross-Border Transfers

If you access the Services from outside the United States, your data may be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. By using the Services, you acknowledge and consent to such transfer.

8.3 GDPR Transfer Mechanisms

For transfers of personal data from the European Economic Area (EEA) or United Kingdom to the United States, PerchOS relies on:

• Standard Contractual Clauses (SCCs): Approved by the European Commission for transfers to third countries.
• UK International Data Transfer Agreements (IDTAs): For transfers from the United Kingdom.

Copies of applicable transfer mechanisms are available upon request by contacting legal@perchos.io.

8.4 Data Localization Requests

If your regulatory environment requires data to be stored within a specific jurisdiction, please contact us prior to onboarding to assess feasibility. We cannot guarantee data localization capabilities for all jurisdictions at this time.

Section 9 — Cookies & Tracking Technologies

9.1 What We Use

PerchOS uses cookies and similar technologies including local storage, session storage, and web beacons on our website and Platform. We categorize these as follows:

9.2 Managing Cookies

You can manage cookie preferences through:

• Our Cookie Settings tool, accessible via the cookie consent banner on perchos.io.
• Your browser settings, which allow you to block or delete cookies. Note that blocking essential cookies may impair Platform functionality.
• Opt-out tools provided by analytics vendors (e.g., Google Analytics Opt-Out Browser Add-on).

9.3 Do Not Track

Our Platform currently does not respond to "Do Not Track" signals from web browsers, as there is no uniform standard for such signals. We honor Global Privacy Control (GPC) signals where applicable under state privacy laws.

Section 10 — Children's Privacy

The PerchOS Platform is not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected personal information from a minor, please contact us immediately at privacy@perchos.io and we will take prompt steps to delete such information.

Section 11 — Third-Party Services & Links

The Platform may contain links to third-party websites, integrations, or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with PerchOS. We are not responsible for the privacy practices of third parties.

Section 12 — Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Policy at perchos.io/privacy with a new "Last Updated" date.
• Provide in-platform notification or email notice to active Builder Users at least thirty (30) days before material changes take effect.

Your continued use of the Services after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you should discontinue use and contact us to delete your account.

Section 13 — Contact & Data Protection Officer

13.1 General Privacy Inquiries

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

13.2 Data Protection Officer

PerchOS will designate a Data Protection Officer (DPO) prior to processing personal data subject to GDPR. Once designated, DPO contact information will be listed here and at perchos.io/privacy. In the interim, all data protection inquiries should be directed to privacy@perchos.io.

13.3 EU/UK Representative

If PerchOS is subject to GDPR or UK GDPR obligations, we will designate an EU or UK representative as required. Representative contact information will be published at perchos.io/privacy upon designation.

13.4 Supervisory Authority Complaints

If you are located in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority. In the United States, you may contact the Federal Trade Commission (FTC) at www.ftc.gov.

Appendix A — Definitions

Terms used in this Privacy Policy have the following meanings:

"Builder Data"

All data submitted to PerchOS by Builder Users, including project data, buyer data, subcontractor data, and related documents.

"Network Intelligence Data"

Anonymized, aggregated, de-identified data derived from Builder Data across the PerchOS user base used for benchmarking, AI training, and market insights.

"Buyer PII"

Personally identifiable information about homebuyers submitted to the Platform by Builder Users.

"CCPA"

California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA).

"GDPR"

General Data Protection Regulation (EU) 2016/679.

"FDBR"

Florida Digital Bill of Rights, Chapter 2023-6, Laws of Florida.

"Processing"

Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

"Controller"

An entity that determines the purposes and means of processing personal data.

"Processor"

An entity that processes personal data on behalf of a Controller.