Privacy Policy

1. Overview and who we are

This Privacy Policy explains how Felag ("Felag," "we," "us," or "our") collects, uses, and protects personal information in connection with our construction software products at felag.io, including BidBuddy, PQPal, FieldFriend, PMBuddy, and TallyTom.

For account, billing, and website information, Felag acts as the controller of that information. For the project documents, photos, emails, and other content that customers upload or route into their workspace, Felag acts as a processor that handles the content on the customer's behalf and at the customer's direction. If you use a Felag workspace operated by your employer or another organization, that organization controls the workspace, and you should direct questions about its data practices to that organization.

2. Information we collect

Account and organization information: when you register, we collect information such as name, work email address, organization name, user role, and authentication credentials, which are stored in hashed form.

Billing information: to process subscriptions, we collect billing contact details and payment information. Payment card details are handled by our payment processor, Stripe, and we do not store full card numbers.

Customer Content: customers upload or route project documents, photos, records, and emails into their workspace, including through per-tenant inbound email addresses that let a customer forward messages into their account. This content may contain personal information about the customer's own personnel, subcontractors, and contacts.

Usage and log data: we automatically collect technical information such as log records, device and browser details, IP address, and actions taken in the products, which we use to operate and secure the service.

3. How we use information

We use personal information to provide, maintain, and improve the service; to authenticate users and administer the shared Felag login; to process payments and manage subscriptions; to provide support and respond to requests; to secure the service and prevent abuse; and to comply with legal obligations.

We use AI features to extract, structure, summarize, and analyze the customer's own Customer Content at the customer's direction, so that customers can work with their documents more efficiently. We do not use Customer Content to serve third-party advertising, and we do not sell personal information.

4. AI processing

When a customer uses an AI feature, the relevant Customer Content may be sent to AI model providers accessed through OpenRouter, acting as our subprocessor, to generate the requested output. The output is returned to and stored within the customer's own workspace.

Felag does not use Customer Content to train third-party foundation models. AI outputs are working drafts that stay in the customer's workspace and are available only to that customer's authorized users. Customers are responsible for reviewing AI outputs before relying on them.

5. Subprocessors

We share personal information with a limited set of service providers who process it on our behalf under appropriate obligations. They currently include: Stripe, for payment processing; OpenRouter, for AI model inference; Zoho ZeptoMail, for transactional email such as notifications and account messages; and S3-compatible object storage operated by Felag, for storing uploaded files.

We may also disclose information if required by law or legal process, to protect the rights and safety of Felag, our customers, or the public, or in connection with a merger, acquisition, or sale of assets, subject to appropriate protections. We do not sell personal information.

6. Data retention and deletion

We retain account information and Customer Content for as long as the subscription is active and as needed to provide the service. Customers can export their Customer Content while the subscription is active using in-product tools or by contacting support.

After a subscription ends, or following a verified deletion request, we will delete or de-identify the associated Customer Content from active systems within 90 days, except where we are required to retain certain information to comply with legal, tax, or accounting obligations, or to resolve disputes. Backup copies are removed on our regular backup cycle.

7. Security

We use technical and organizational measures designed to protect personal information. These include encryption of data in transit, isolation of each organization's data by tenant, role-based access controls that limit who can see what within a workspace, and storage of authentication credentials in hashed form.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We ask that you use strong, unique credentials, protect your login, and notify us at support@felag.io if you suspect any unauthorized access.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export the personal information we hold about you, and to object to or restrict certain processing. Because much of the personal information in the service is Customer Content controlled by a customer organization, we will often direct these requests to the relevant customer or act on that customer's instructions.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights to notice about the information we collect, to request access to and deletion of your personal information, and to non-discrimination for exercising your rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising. To exercise a right, contact us at support@felag.io, and we will respond as required by law after verifying your request.

9. Cookies and sessions

The products use cookies that are necessary to sign you in and keep your session secure. We use these essential cookies to operate the service and to remember your authentication state. We do not use third-party advertising cookies or cross-site ad tracking in the products.

10. Children

The products are business tools intended for use by organizations and their personnel. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, contact us at support@felag.io and we will take appropriate steps to delete it.

11. Changes and contact

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the service or by email before they take effect, and we will update the date shown on this page.

If you have questions about this policy or about how we handle personal information, contact us at support@felag.io.