Privacy Policy

• What we collect: Identifiers and contact details; account and profile data; project and home information (including address, photos, floor plans, measurements, designs, budgets, and product choices); documents and signatures; communications; commercial and billing information; device and usage data; approximate location; inferences about design preferences. Full list in §3.
• Why: To provide the Services, AI features, portals, documents, and e-signatures; to connect homeowners with professionals; to communicate with you; for security and fraud prevention; to improve the Services; for marketing; to create de-identified and aggregated insights; and to comply with law. See §5.
• Do we sell or share it? Yes, in limited cases. If you are a Homeowner User, we may sell limited lead information to professionals serving your area if and when we launch a homeowner leads program: only your name, project details, city and ZIP code, and chosen contact method (never your street address). We do not currently use affiliate or attribution tracking and do not currently share device or usage data for cross-context advertising; if we add advertising technologies later, we will update this Policy first. We do not sell or share information that a construction company, salesperson, or designer enters about its own clients. You can opt out at any time using the "Do Not Sell or Share My Personal Information" link in the site footer, or by turning on a Global Privacy Control signal.
• Sensitive information: We collect account log-in credentials, and our payment processor collects payment card data. We use them only to provide the Services and for security. We do not use sensitive personal information to infer characteristics about you.
• How long we keep it: As long as your account is active and as described in §11 (generally 3 years after your last activity for project data, longer where required by law).
• Full policy: Below, and at modulatech.io/privacy.

1.1 This Privacy Policy explains how ModulaTech, Inc., a Delaware corporation ("ModulaTech," "we," "us") collects, uses, discloses, sells, shares, and protects personal information through modulatech.io, the ModulaTech web application, client and contractor portals, the professional directory, our emails and text messages, and related services (the "Services"). Capitalized terms not defined here have the meaning in our Terms of Service (modulatech.io/terms).

1.2 "Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include de-identified or aggregated information (see §9) or publicly available information as defined by law.

1.3 Two roles. ModulaTech plays two different roles:

• As a "business." For information about our own account holders (Homeowner Users, Professionals and their team members, and visitors) and information we collect for our own purposes, ModulaTech decides how it is used, and this Policy governs.

• As a "service provider" to Professionals. When a construction company, office, salesperson, designer, or showroom (an "Organization" or "Professional") uses the Services to manage its own clients, leads, and contractors — for example, by entering a client's name, phone, and address, inviting a client to the client portal, or inviting a contractor — ModulaTech processes that information on the Professional's behalf as its service provider. In that case the Professional's own privacy policy governs, and requests should be directed to the Professional. We will assist the Professional. ModulaTech does not sell or share information it processes as a service provider, and does not use it to send leads to other professionals.

1.4 This Policy does not cover third-party websites, including Supplier stores you visit through product links, or professionals' own practices once they receive your information. Product links are ordinary links to the Supplier's website: ModulaTech does not add affiliate tracking to them and receives no compensation from Suppliers for listings or clicks. If this changes, we will update this Policy and disclose it.

• Homeowner Users — individuals planning their own renovation ("Renovating my own home").
• Professionals — construction companies and their Owners, Office staff, and Salespersons; independent salespersons and interior designers; showrooms.
• Clients — individuals invited to a project by a Professional (client portal).
• Contractors — contractors and tradespeople invited by a Professional (contractor portal).
• Visitors — anyone browsing our public website, marketplace, or directory, or submitting a content report.

The list below sets out the categories of personal information we have collected in the past 12 months, using the categories in the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code §1798.140(v). For each category it shows examples, sources, the business purposes for collection and use (see §5), to whom it is disclosed for a business purpose, whether it is sold, and whether it is shared for cross-context behavioral advertising.

• A. Identifiers. Examples: name, email, phone number, postal/project address, account ID, IP address, device and cookie IDs. Sources: you; Professionals who invite you; your device; sign-in providers (Google, and Apple where offered). Purposes: provide Services; accounts; communications; security; support; analytics; marketing; leads (homeowners). Disclosed for a business purpose to: service providers; Professionals you choose; other project participants; legal recipients. Sold to: Homeowner Users only: name and the contact method you chose (email or phone), to Professionals serving your area (leads), only if we launch a leads program — not your street address. Shared: none currently (see §7).
• B. Customer records (Cal. Civ. Code §1798.80(e)). Examples: name, signature, address, phone, billing information, insurance or license info of Professionals. Sources: you; Professionals; payment processor. Purposes: provide Services; documents and e-signatures; billing; verification. Disclosed for a business purpose to: service providers; project participants; payment processor. Sold to: homeowner name and chosen contact method (as in A) — not street address. Shared: no.
• C. Protected classification characteristics. Generally not collected. Images of a home may incidentally reveal information; we do not seek it. Sold: no. Shared: no.
• D. Commercial information. Examples: plans purchased, subscription history; products viewed, saved, or selected; budgets; estimates; project type, scope, timeline, and budget range. Sources: you; Professionals; your use of the Services. Purposes: provide Services; billing; product improvement; analytics; leads (homeowners); de-identified insights. Disclosed for a business purpose to: service providers; Professionals you choose. Sold to: Homeowner Users only: project type, scope, budget range, timeline (leads). Shared: no.
• E. Biometric information. Not collected. We do not use face or voice recognition. Sold: no. Shared: no.
• F. Internet or other electronic network activity. Examples: pages and features used, clicks, searches, referring URLs, session data, crash logs. Sources: your device; cookies and similar technologies; analytics providers. Purposes: security; analytics; improve Services; attribution; marketing. Disclosed for a business purpose to: service providers (analytics, hosting, support chat). Sold: no. Shared: none currently (see §7).
• G. Geolocation data. Examples: approximate location from IP address; the property address you enter. We do not collect precise device geolocation. Sources: your device; you. Purposes: localize content (e.g., pros near you, regional prices); fraud prevention. Disclosed for a business purpose to: service providers; Professionals you choose (city/ZIP only, unless you share your address). Sold to: homeowner project city/ZIP only — never the street address (leads). Shared: no.
• H. Sensory data. Examples: photos and videos of rooms and homes, scans, voice notes or recordings if you upload them, call recordings, if any. Sources: you; Professionals; Contractors (site updates). Purposes: provide Services (floor plans, renders, site updates); AI processing; support. Disclosed for a business purpose to: service providers (including AI providers); project participants. Sold: no. Shared: no.
• I. Professional or employment-related information. Examples: for Professionals, company, role, license number, service area, portfolio, reviews. Sources: you; your Organization; public sources (e.g., CSLB license lookup). Purposes: directory; verification; organization management. Disclosed for a business purpose to: the public (directory profiles you publish); service providers. Sold: no. Shared: no.
• J. Education information. Not collected. Sold: no. Shared: no.
• K. Inferences. Examples: design style preferences, likely budget tier, product interests, project stage. Sources: derived from your use of the Services. Purposes: personalize Services; recommendations; leads (homeowners). Disclosed for a business purpose to: service providers. Sold to: homeowner style/budget tier (leads). Shared: no.
• L. Sensitive personal information. Examples: account log-in and password; payment card number with security code (collected by our payment processor, not stored by us). Sources: you; payment processor. Purposes: only to provide the Services, security, and payment — purposes permitted under 11 CCR §7027(m). Disclosed for a business purpose to: payment processor; hosting provider. Sold: no. Shared: no.
• Other content. Examples: floor plans, measurements, designs, renders, mood boards, documents, contracts, change orders, invoices, messages, comments, reviews, support tickets. Sources: you; other project participants. Purposes: provide Services; support; improve Services; showcase (de-identified; see §10). Disclosed for a business purpose to: service providers; project participants you select. Sold: no. Shared: no.

Google Calendar. If you choose to connect your Google Calendar (with Google sign-in, or by pasting your calendar's secret iCal address), ModulaTech reads your calendar events (Google scope calendar.events.readonly: read-only) and uses them only to show your events in your own ModulaTech calendar. We never change or delete anything in your Google account, we do not use this data for advertising, we do not sell it, we do not use it to train AI models, and people at ModulaTech do not read it unless you ask us to (for support), it is needed for security, or the law requires it. Disconnecting in My Dashboard deletes the imported events and our access; you can also remove ModulaTech's access in your Google Account settings. ModulaTech's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Directly from you — when you sign up, create projects, upload files, request quotes, sign documents, contact support, or report content.
• From Professionals and other users — e.g., when a Professional invites you to a project, enters your details as a client or lead, or a Contractor posts site updates.
• Automatically — from your device and browser via cookies, pixels, local storage, and logs.
• From third parties — sign-in and connected-account providers (Google, and Apple or Pinterest where offered); our payment processor (payment status); public sources (e.g., CSLB license records, business websites, public review sites, for Professionals); and Supplier websites (product information — generally not personal information).

We use personal information to:

1. Provide the Services — accounts, organizations and roles, projects, floor plans, 3D, AI renders, marketplace, budgets, scopes, documents, e-signatures, invoices, portals, messaging, notifications, and sharing;

2. Run AI features — send relevant inputs (e.g., room photos, plans, product images, and prompts) to AI providers to generate Outputs;

3. Connect homeowners and professionals — deliver inquiries and quote requests you submit, and, if we launch a leads program, provide leads as described in §8;

4. Communicate — verification codes, security alerts, transactional and service messages, invitations, and (with your choices respected) marketing;

5. Billing — process subscriptions and payments through our payment processor;

6. Support and quality assurance — including authorized staff viewing accounts to resolve issues (access is logged);

7. Security and integrity — detect and prevent fraud, abuse, spam, and security incidents; enforce our Terms;

8. Improve and develop the Services — analytics, debugging, research, and improving our features and models;

9. Marketing — promote ModulaTech, including showcasing designs as described in §10;

10. Create de-identified and aggregated data — see §9;

11. Legal — comply with law, respond to legal process, and establish or defend legal claims;

12. Business transfers — as described in §8.6.

We will not collect additional categories of personal information or use it for purposes materially different from or incompatible with those disclosed here without notice and, where required, your consent.

AI training. We do not use your personal information or project content to train third-party generative AI models. Our AI providers process inputs on our behalf under contract. We use Google's Gemini API under a paid plan. Under Google's terms for paid services, Google does not use the content we send to improve its products. We may use de-identified data to improve our own features.

6.1 Service providers (sub-processors). We disclose personal information to vendors that process it on our behalf under written contracts restricting their use. Current providers include:

• Render (Render Services, Inc.) — application hosting and background workers (U.S.); data involved: all Service data in transit/processing.

• Supabase — database and file storage; data involved: all stored account and project data, uploaded files.

• Redis hosting provider — job queues and caching; data involved: job metadata, limited content.

• Google — Gemini API (AI renders, plan reading, assistants), Custom Search API (price comparison), Maps API (address autocomplete), Google Sign-In — AI processing, search, maps, and authentication; data involved: photos, plans, prompts, product images; address text; sign-in identifiers.

• Stripe — subscription billing and payment processing; data involved: name, email, billing details, payment card data.

• Resend — transactional and notification email delivery; data involved: name, email, email content.

• Twilio — SMS (verification codes, notifications); data involved: phone number, message content.

• PostHog — product analytics and error monitoring (web and server); data involved: usage data, device data, account identifiers.

• Tidio — support chat widget; data involved: chat content, contact details you provide, device data.

• Web push services (browser vendors, e.g., Google, Apple, Mozilla) — push notifications; data involved: push token, notification content.

• Pinterest and Unsplash APIs — importing inspiration images you choose; data involved: your Pinterest account token (if connected); search terms.

• Other infrastructure and professional vendors (domain/DNS, backups, logging, accounting, legal advisers) — operating and administering the business; data involved: limited data as needed for each service.

6.2 Other users, as you direct. Information you put in a project is visible to the participants you or your Professional invite, according to project permissions. Information you send to a Professional via "Contact," "Send inquiry," or "Get quotes" is disclosed to the Professional(s) you select or that are matched to your request. Public directory profiles and published reviews are visible to everyone. Share links can be opened by anyone who has the link.

6.3 Professionals who invited you. If you are a Client or Contractor, the Professional that invited you can see what you submit in that project.

6.4 Legal and safety. We may disclose information to comply with law, subpoenas, or court orders; to protect the rights, property, or safety of ModulaTech, our users, or others; and to investigate fraud or security issues.

6.5 With your consent or at your direction.

7.1 We use strictly necessary cookies and local storage (sign-in, security, preferences), analytics (PostHog), and a support chat widget (Tidio). We do not use affiliate or attribution tracking technologies. If we add advertising pixels (such as Meta or Google Ads) in the future, we will update this Policy first, and they will load only if you allow non-essential cookies. See our Cookie Policy (modulatech.io/cookies).

7.2 Allowing third-party advertising or attribution partners to collect identifiers and browsing activity on our site for their own or others' advertising may be a "sale" or "sharing" under California law. You can opt out using the Do Not Sell or Share link or a Global Privacy Control signal, or by rejecting non-essential cookies.

7.3 Do Not Track. Browsers' "Do Not Track" signals have no common standard, and we do not respond to them. We do honor Global Privacy Control (GPC) signals as described in §8.5.

7.4 Third parties may collect information about your online activities over time and across websites when you use our Services only through the technologies described in our Cookie Policy.

8.1 What "sale" and "sharing" mean. Under the CCPA, a "sale" is disclosing personal information to a third party for money or other valuable consideration, and "sharing" is disclosing it for cross-context behavioral advertising. It is not a sale when you intentionally direct us to disclose your information to a third party (Cal. Civ. Code §1798.140(ad)(2)(A)).

8.2 When you ask to be contacted (not a sale). When you use "Contact this pro," "Send inquiry," "Get quotes from local pros," or a similar feature, you direct us to disclose your name, your project type and description, your city and ZIP code (or general area), and the contact method you chose (for example, email or phone) to the Professional(s) you select or that are shown to you as matched to your request at the time you submit. We do not send your street address. Your street address is shared with a Professional only if you give it to them yourself (for example, when scheduling a site visit) or use an explicit "share my address with this pro" option. Those Professionals may contact you about your request. If you agree on that form, they may call or text you using automated technology (see §8.7).

8.3 Homeowner leads program (a "sale"), if we launch one. We have not launched this program yet. If we do, and you are a Homeowner User and have not opted out, ModulaTech may disclose your name, the contact method you chose (email or phone), project city and ZIP code (or general area), project type and description, scope, timeline, budget range, and style preferences — never your street address — to independent Professionals who serve your area (for example, contractors, designers, and showrooms) in exchange for a fee or other value, so that they can offer you their services. This is a "sale" of personal information. Professionals receiving leads must use them only to respond to your project and may not resell them (Terms, Schedule B). We do not sell information about Clients or Contractors invited by a Professional, or any information that a Professional enters about its clients.

8.4 Information collected before this Policy takes effect. We will not sell personal information collected before the effective date of this Policy unless you affirmatively agree.

8.5 Your right to opt out. You may opt out of the sale and sharing of your personal information at any time:

• click "Do Not Sell or Share My Personal Information" (also labeled "Your Privacy Choices") in the footer of every page or in the privacy section of your account settings;

• turn on a Global Privacy Control (GPC) signal in your browser or extension — we treat it as a valid opt-out request for that browser and, if you are signed in, for your account; or

• email support@modulatech.io.

Opting out does not affect requests you choose to send to a Professional yourself (§8.2). We will wait at least 12 months before asking you to opt back in. If you opt out, we will notify any third party to whom we sold or shared your information after you submitted the opt-out but before we processed it (11 CCR §7026(f)).

8.6 Business transfers. If ModulaTech is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the successor or acquirer as part of that transaction. This is not a sale under California law (Cal. Civ. Code §1798.140(ad)(2)(C)). If the successor materially changes how it uses or discloses your information in a way inconsistent with this Policy, it will give you prior notice and obtain consent where required.

8.7 Calls and texts from Professionals. Professionals will use autodialed or prerecorded/artificial-voice calls or automated texts to contact you only if you gave prior express written consent on the request form that identifies them. Consent is never a condition of purchase. You can revoke consent at any time by replying STOP to a text, telling the caller, or emailing support@modulatech.io; revoking consent with ModulaTech will be forwarded to Professionals who received your request.

8.8 Minors. We do not knowingly sell or share the personal information of consumers under 16 years of age.

9.1 We may create, use, publish, license, sell, and transfer de-identified and aggregated information derived from the Services — for example, trends in popular design styles, products, brands, finishes, layouts, room sizes, regional cost ranges, and project timelines — for any lawful purpose, including our blog and reports, research, product development, and data licensing to third parties. This information is not personal information.

9.2 Our public commitment. We will (a) take reasonable measures to ensure de-identified information cannot be associated with a consumer or household (including removing names, contact details, street addresses, images of people, signatures, and identifying free-text, and generalizing location to no finer than the county or 3-digit ZIP code level); (b) maintain and use it only in de-identified form and not attempt to re-identify it, except to test our de-identification as permitted by law; and (c) contractually prohibit recipients from re-identifying it (Cal. Civ. Code §1798.140(m)).

We may display designs, renders, 3D scenes, and floor plan images created in the Services on our website, blog, inspiration galleries, and social media (such as Facebook and Instagram) to promote ModulaTech, as described in Section 14.3 of our Terms. Before public use we remove names, contact details, street addresses, and other information that directly identifies a private individual or the exact location of a home, and we do not use images of identifiable people without their consent. You can opt out of future showcase use by emailing support@modulatech.io.

We keep personal information only as long as reasonably necessary for the purposes described, then delete or de-identify it. Typical periods:

• Account and profile data: While the account is active; deleted within 90 days after account deletion, except as below.
• Project content (plans, designs, files, documents): While the account/Organization is active; Organizations control their projects; 3 years after last activity for inactive accounts, with notice before deletion.
• Signed documents and e-signature audit trails: 7 years after signing or as the Professional configures, to support legal and tax requirements.
• Billing and transaction records: 7 years (tax and accounting).
• Lead and inquiry records, and TCPA consent records: 5 years after the request (to evidence consent; the TCPA has a 4-year statute of limitations).
• Auto-renewal consent records: At least 3 years or 1 year after termination, whichever is longer (Cal. Bus. & Prof. Code §17602).
• Analytics and logs: 25 months.
• Opt-out and privacy request records: At least 24 months (11 CCR §7101).
• Backups: Overwritten on a rolling basis within 35 days.
• De-identified and aggregated data: Indefinitely.

12.1 California residents have the right to:

• Know / access the categories and specific pieces of personal information we collected, the sources, purposes, and the categories of third parties to whom we disclosed, sold, or shared it;

• Delete personal information we collected from you, subject to legal exceptions;

• Correct inaccurate personal information;

• Opt out of sale and sharing (§8.5);

• Limit use of sensitive personal information — we use sensitive personal information only for purposes that do not give rise to this right (11 CCR §7027(m)), so we do not offer a separate "Limit" link;

• Non-discrimination / no retaliation for exercising your rights. We do not charge different prices or provide a different level of service because you exercised a right, except as permitted by law.

12.2 How to submit a request. Use our contact form at modulatech.io/contact, or email support@modulatech.io.

12.3 Verification. We will verify your identity by matching information you provide with information we hold (for signed-in users, by your authenticated session). For deletion or specific pieces of information we may require additional verification. Opt-out requests do not require verification.

12.4 Authorized agents. You may use an authorized agent. We may require proof of the agent's authorization and that you verify your identity directly with us, unless the agent holds a power of attorney.

12.5 Timing. We confirm receipt within 10 business days and respond within 45 calendar days (extendable by 45 days with notice). Opt-out requests are processed within 15 business days.

12.6 Information we process for Professionals. If your information was provided by a Professional (for example, you are their client or contractor), please contact that Professional; we will forward requests to them and assist them as their service provider.

12.7 Other U.S. states. Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) may have similar rights to access, correct, delete, obtain a copy of, and opt out of the sale of personal data and targeted advertising. We extend the rights in this section to all U.S. users. If we deny your request, you may appeal by replying to our decision or emailing support@modulatech.io with "Appeal" in the subject; we will respond within the time required by your state's law, and if denied you may contact your state attorney general.

California Civil Code §1798.83 permits California residents to request information about disclosures of certain personal information to third parties for their direct marketing purposes in the preceding calendar year. If we launch a homeowner leads program, we may disclose Homeowner Users' information to Professionals for their direct marketing purposes as described in §8.3; you may opt out at any time using the Do Not Sell or Share link, which also stops these disclosures. To make a request, email support@modulatech.io with "Shine the Light" in the subject.

We do not currently offer any financial incentive or price or service difference in exchange for the collection, retention, sale, or sharing of personal information.

We use administrative, technical, and physical safeguards appropriate to the risk, including encryption in transit, access controls and role-based permissions, logging of staff access, and monitored cloud infrastructure. No system is perfectly secure. If a breach of unencrypted personal information occurs, we will notify affected individuals and regulators as required by law (Cal. Civ. Code §1798.82). Please use a strong, unique password and avoid uploading sensitive information that is not needed for your project.

The Services are intended for adults 18 and older. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share personal information of anyone under 16. If you believe a child provided us information, contact support@modulatech.io and we will delete it.

The Services are operated from and intended for users in the United States. Information is stored and processed in the United States (and, by our providers, in other locations where they operate). If you use the Services from outside the U.S., you understand that your information will be transferred to the U.S., where privacy laws may differ.

• Marketing emails: use the unsubscribe link in any marketing email.
• Text messages: reply STOP to opt out, HELP for help. Message and data rates may apply.
• Push notifications: disable in your device or browser settings.
• Calls/texts from Professionals: see §8.7.
• Transactional and security messages cannot be turned off while you have an account.

We will post updates here with a new "Last Updated" date. For material changes, we will notify you by email or in the Services before the change takes effect. We will not use previously collected personal information in a materially different way (including selling it) without your consent where required by law.

Accessibility: this Policy is available in alternative formats on request.