Privacy Policy

Version 1.2 — Effective August 23, 2026

This policy explains what LumberJack AI collects when you use our takeoff and estimating service, what we do with it, who else touches it, and how long we keep it. It covers the LumberJack AI web application and the lumberjack-ai.com website.

1. What We Collect

Account information. When you register we collect your email address, and — where you choose to provide them — your name, company, and phone number. Your password is never stored; we store only a salted PBKDF2-HMAC-SHA256 hash of it (260,000 iterations).

Campaign attribution. When you arrive through a campaign link, we may collect the first-party utm_source, utm_medium, utm_campaign, utm_content, and utm_term URL parameters. We keep those values in browser session storage while you navigate the marketing site and associate them with a contact-form submission or registration in our sales CRM. This lets us understand which campaign produced an inquiry or account; arbitrary URL parameters are not retained for this purpose.

Uploaded construction plans and project files. When you upload construction drawings, quotes, layouts, schedules or specifications we store the file you uploaded and the data our engine extracts from it.

Project metadata. Project name and address, plan number, sheet index, page counts, upload and analysis timestamps, package versions, and the activity date that drives the retention clock described below.

User-entered project information. Every value you type, select, confirm or correct — wall lengths, heights, wall types, openings, buck types, waste factors, product selections, and your saved preferences and favourites.

Usage and activity logs. Operational records needed to run, meter, secure, and debug the service: request logs, error reports, feature and endpoint usage, plan-upload and takeoff counts, billing-period allowance and add-on consumption, job and event identifiers, sign-in activity, and — if you use the "Report an issue" form — whatever you write plus the last API error your session saw.

Technical and device information. IP address, browser user-agent string, request timestamps, and security signals derived from them, such as approximate login region or concurrent-session indicators, collected for server logging, rate limiting, named-user and usage-limit enforcement, abuse prevention, and the legal acceptance records described in section 3.

Payment information. We do not receive or store your card number. Payments are handled by Stripe; we hold only the customer and subscription identifiers Stripe gives us, your plan status, and the billing contact details you choose to enter for invoicing.

Communications and support information. Messages you send us, support issues you file, and our replies.

2. How We Use It

• To produce your takeoffs and run the features you ask for.
• To operate, secure, debug and improve the service.
• To measure included usage and add-ons, enforce named-user and plan limits, prevent credential sharing or automated abuse, and route organizations to an appropriate Business program.
• To bill you, and to contact you about your account — including the notice that a plan file is about to be removed (see section 5).
• To respond when you contact support.
• To keep the acceptance and acknowledgement records described in section 3.

3. Legal Acceptance and Acknowledgement Records

When you accept the Terms of Service or Privacy Policy, or acknowledge the output disclaimer before generating or exporting a document, we record that you did so. Each record stores the document type, the version and effective date you accepted, the time, where in the product the acceptance was captured, and — where reasonably and lawfully available — the IP address and browser user-agent of the request.

These records are kept as evidence of agreement and are not overwritten when a later version is accepted; the history is retained. Access to them is restricted to administrators.

4. Artificial Intelligence and Automated Processing

Reading a drawing is done by an AI model. Pages of your uploaded plans, including any text on them, are sent to Anthropic's API for analysis and are processed under Anthropic's API terms. If your drawings contain information you do not want processed this way, do not upload them.

Automated processing also drives extraction, classification, and the quantity rules that produce a takeoff. Those outputs are estimates and decision-support information; they are not automated decisions with legal or similarly significant effects about you.

5. Service Providers and Infrastructure

We use the following third parties to run the service. Each receives only what it needs for its function. We do not sell personal information, but running the service does mean these vendors process data on our behalf.

6. Plan Files and Data Retention

How the 90 days is counted. The clock runs from your last activity on a project, not from when you created it. Opening a project, running an analysis on it, or exporting a report from it all reset the clock to a full 90 days. A project you keep using is never removed, however old it is.

Staged rollout. When automatic deletion is active, the controls and notices below apply. Before activation, the displayed retention date may be informational and LJAI may retain the file longer than the standard target. You may still delete the project or contact us to request deletion.

What you see before it happens:

• Every project shows its retention date in your project list.
• Ten days before a plan file is due to be removed, the project is flagged in the application and we email the account owner.
• You can press Keep on any project to reset its clock immediately, as many times as you like.
• Downloading your own copy of the plan also resets the clock.

What is removed, precisely:

• Removed: the plan PDF you uploaded, cached page images of it, and the raw extraction output produced from it.
• Kept: your project, its takeoff packages, its material lines and quantities, your saved takeoff inputs, and your account.

Once a plan file is removed it cannot be recovered, and the project cannot be re-analysed without uploading the drawing again. The project continues to show the date its plan file was removed.

Other retention:

• Account data is kept while your account is open.
• Deleting a project yourself removes its files and its takeoff data immediately, and is not subject to the 90 days.
• Records we must keep — for example billing records and the legal acceptance records in section 3 — are retained as long as the law requires or as long as they may be needed to establish or defend a claim, and may outlive your account.
• Backups and logs may retain copies for a limited period after deletion before ageing out on their own schedule.

This retention period applies equally to free and paid accounts.

7. Security

• Traffic between your browser and our servers is encrypted in transit (TLS).
• We use technical and organisational safeguards designed for the nature of the information and the active deployment configuration.
• Passwords are stored only as salted PBKDF2-HMAC-SHA256 hashes.
• Project data is scoped to your organisation — other customers cannot read it.
• Administrative access to customer records is restricted to named accounts.

No service can promise perfect security, and we do not. We maintain incident-response procedures and will provide notices of a qualifying security breach as required by applicable law.

8. Your Choices, Access and Deletion

• Export your data at any time — every takeoff can be downloaded as XLSX, PDF or CSV.
• Delete a project — this initiates removal of its files and takeoff data from active systems; limited backup or log copies may remain temporarily as described above.
• Access, correct, obtain a copy of, or delete your account data — contact us using the link in section 11. We will respond as required by applicable law. We may need to verify your identity and may retain records where permitted or required, including the records described under "Other retention" above.
• Appeal a privacy-request decision — reply to our decision or submit a new request marked "Privacy Appeal." We will review the appeal and explain our response as required by applicable law.
• Opt out of marketing email — every marketing message carries an unsubscribe link. Transactional and account messages, such as the plan-expiry notice, are not marketing and continue.

Company accounts. If an organisation provides or administers your account, its authorised administrators may access account identity, projects, files, outputs, usage, seat, and billing information associated with that organisation. The organisation is responsible for authorising its users and for its own use of information it receives.

9. Cookies and Analytics

The application stores your sign-in token in your browser's local storage so you stay signed in. That is a functional necessity, not tracking, and clearing it signs you out.

The marketing site stores the campaign-attribution values described in section 1 in browser session storage. This is first-party attribution for the current browser session, not cross-site tracking.

We may advertise on third-party services, but we do not place third-party ads on our site or use cross-site tracking cookies. If we add product analytics or advertising measurement technology, we will describe it here and update the version and effective date at the top of this policy before it takes effect.

10. Legal Compliance and Disclosure

We may disclose information where we reasonably believe it is required to comply with applicable law, a lawful request from public authorities, or valid legal process; to enforce our Terms; to investigate suspected fraud, abuse or security incidents; or to establish, exercise or defend legal claims.

If our business is involved in a merger, acquisition or sale of assets, customer data may transfer as part of that transaction; this policy, or one at least as protective, would continue to apply.

This is a professional construction tool. It is not directed at children and we do not knowingly collect data from anyone under 18.

11. Changes to This Policy

If we change this policy we will update the version and effective date at the top. If a change materially affects how long we keep your data or who we share it with, we will notify account holders and may require you to accept the updated policy before continuing to use the service.

12. Contact

Questions about this policy, or about your data: contact us here.

Read the Terms of Service →