01Who this covers
This policy explains how BulletDraw handles personal information when you visit this website and when you use the BulletDraw platform and apps (the “Service”) — as a builder, a member of a builder's team, a lender, a subcontractor, a supplier, an inspector or a client invited to view work.
Most information in the Service is put there by a builder's organisation about its own projects. For that information the organisation decides what is collected and why, and BulletDraw processes it on the organisation's behalf. If you are a subcontractor or supplier and have a question about data a builder holds about you, you can ask the builder or ask us.
02Information we collect
Account information. Name, email address, phone number, company, role, and sign-in details.
Project and financial records. Budgets, schedules, draws, invoices, change orders, payment records and the documents attached to them — including lien waivers, certificates of insurance, W-9s, licences, photos and drawings.
Payment details. Bank account details needed to send or receive payments are collected and held by our regulated payment partners; we keep the payment records and status, not full account credentials.
Communications. Messages you send us, requests answered through a link, and the email notifications the Service sends.
Usage and device information. Log data such as IP address, browser, pages and actions, used to run, secure and support the Service.
03How we use it
We use personal information to:
- provide the Service — build draw packages, request and verify documents, run payments and send notifications;
- read documents with AI so you do not have to re-key them, with every result confirmed by a person;
- keep accounts secure, prevent fraud, and enforce our Terms & Conditions;
- provide support, and improve the Service;
- meet legal, accounting and audit obligations.
We do not sell personal information, and we do not use Customer Data to advertise to you or to train general-purpose AI models.
05How long we keep it
We keep information for as long as the account is active. Records of funded draws and payments are kept for seven years for audit and legal purposes. When an organisation deletes its account, its data is purged within thirty days, except records we must keep longer by law.
06How we protect it
The Service is hosted on AWS. Documents are stored encrypted and served through time-limited links. Every request is scoped to your organisation, with row-level security enforced in the database, and sign-in is through Firebase Authentication with email verification. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires. See our Security page for more.
07Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. Organisations can export their data at any time from the Service.
To make a request, email contact@bulletdraw.com. We will verify the request and respond within the time the law allows. If your information was provided by a builder's organisation, we may refer the request to them. We will not discriminate against you for exercising these rights.
09Where it is processed
BulletDraw is operated in the United States and your information is processed there. If you use the Service from another country, you understand that your information will be transferred to and processed in the United States.
10Children
The Service is for businesses and is not directed at children. We do not knowingly collect information from anyone under 16.
11Changes to this policy
We may update this policy as the Service changes. We will post the new version here with a new date and, if the changes are material, notify account holders before they take effect.
Contact us
Questions about this document go to contact@bulletdraw.com. See also our Terms & Conditions and Security.