Privacy Policy

We collect the following categories of information:

• Account information: your name, work email address, and the organization you belong to, provided when an account is created or you are invited to one.
• Content you provide: facility basemaps, sites, projects, contract items, activities, severity assessments, vendors, costs, attachments, and other records you enter into the Service.
• Usage and device data: log data, browser and device type, approximate location derived from IP address, and product-analytics events describing how the Service is used.
• Cookies and similar technologies: used to keep you signed in, remember preferences, and measure product usage.

• Provide, operate, secure, and maintain the Service.
• Authenticate users and maintain role-based access and audit trails.
• Respond to support requests and communicate about the Service.
• Diagnose problems, monitor performance, and improve features.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our agreements.

Where applicable law requires a legal basis, we rely on the performance of our contract with you or your organization, our legitimate interests in operating and securing the Service, your consent where requested, and compliance with legal obligations.

We do not sell your personal information. We share information only as described here:

• Service providers (subprocessors) who host and operate the Service on our behalf, under contractual confidentiality and security obligations.
• Within your organization, according to the admin, editor, and viewer roles configured by your organization administrator.
• When required by law, legal process, or to protect the rights, property, and safety of our users, the public, or Metric Flow.
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

We use a small set of reputable service providers to deliver the Service, including providers for cloud hosting, database, authentication and file storage, error monitoring, product analytics, and bot protection (for example, Vercel, Supabase, Sentry, PostHog, and Cloudflare). A current list is available on request.

We retain account and content data for as long as your organization maintains an active account, and thereafter as needed to comply with legal obligations, resolve disputes, and enforce our agreements. On verified request, we will delete or return content data, subject to backups that age out on a rolling basis.

We protect data with encryption in transit, access controls, role-based permissions, an immutable audit trail, and optional multi-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected]. If your data is managed by your organization, we may direct your request to the organization administrator.

PaveGrid is operated from the United States, and information we collect is processed and stored in the United States. If you access the Service from another region, you consent to that transfer.

PaveGrid is a business tool not directed to children, and we do not knowingly collect information from anyone under 18.

We may update this Privacy Policy from time to time. Material changes will be reflected by the Last updated date above and, where appropriate, communicated to account administrators.

Questions about this Policy or your data can be sent to [email protected].