Effective Date · September 1, 2026

Estimado AI LLC ("Estimado AI," "we," "us," or "our") respects your privacy. This Privacy Notice explains how we collect, use, share, and protect information when you use our website at estimado.com and our AI-assisted construction estimating platform, applications, APIs, and related services (collectively, the "Service").

This Notice applies to information about: (a) users of the Service (typically construction professionals), and (b) third parties whose information appears in content users upload (for example, customers, property owners, architects, or individuals depicted in photographs or video).

If you do not agree with this Notice, do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account information: name, email, phone, password (stored as a salted hash), business name, business address, license information, trade(s) you work in, and contact details.
• Billing information: payment card data, billing address, and transaction history. Card numbers are processed and stored by our payment processor, not by us.
• Profile and preference information: your typical project tier (budget, mid-range, premium), preferred suppliers, default labor rates, regional preferences, and similar settings.
• Communications: support requests, feedback, survey responses, messages sent through the Service, SMS verification messages, and other communications you send or receive through us.

1.2 Content you upload ("User Content")

The Service is designed to receive and process construction project content. Depending on how you use it, User Content may include:

• Project inputs: photographs, videos, voice recordings, typed descriptions, uploaded plans and documents, dimensions, and other information you provide about a job;
• Project metadata: addresses, dimensions, scope notes, customer references, and job conditions;
• Customer and project information: names, addresses, phone numbers, email addresses, scope of work, and prior estimates for your customers;
• Documents you upload to your project history or contractor profile.

User Content may contain personal information about your customers or other third parties. By uploading User Content, you confirm you have the legal right and any required permissions to share it with us. See Section 11 for guidance on third-party data.

1.3 Information generated through your use of the Service

• Generated estimate content: bills of materials, line items, quantities, units, assumptions, prices, scope inferences, hazard flags, and other output generated for your projects.
• Estimate edits and corrections: when you change an estimate we generated, we record the change, including lines added or removed, quantity or price adjustments, and items included or excluded, together with the item involved, its trade, and the time of the change.
• Usage and behavioral data: features accessed; estimates generated, edited, sent, or abandoned; timestamps; session activity; project counts; AI interactions; and similar telemetry.
• Performance data: latency, error logs, model selection, and diagnostic information.

1.4 Information collected automatically

• Device information: IP address, browser type and version, operating system, device type, screen size, and language.
• Log data: timestamps, pages visited, referring URLs, and similar server logs.
• Cookies and similar technologies: see Section 8.

1.5 Information from third parties

We may receive information from:

• Payment processors (transaction status, fraud signals);
• Identity and fraud-prevention services (where applicable);
• Marketing partners (limited business contact information and ad-performance data);
• Public sources (such as licensing records you reference in your profile);
• Affiliate and referral partners (where you arrive at the Service through a partner link).

2. How We Use Information

We use information for the following purposes:

• Provide the Service. Process User Content to generate estimates, bills of materials, takeoffs, and related output. This necessarily includes transmitting content to AI providers; see Section 4.
• Learn how you work. Analyze the changes you make to your own estimates so future drafts can start closer to the way you bid. For example, if you consistently remove an item, the Service may suggest excluding it by default. Any account-specific learned default applies only to your account, and you can override it on an individual estimate.
• Communicate with you. Send transactional messages (account, billing, security, service updates) and, with your consent or where permitted, marketing messages. You can opt out of marketing at any time.
• Improve the Service. Analyze usage, measure model performance, debug, and develop new features. We do not currently use one user's identifiable estimates, prices, customers, or business practices to generate defaults for another user's account. Before introducing any cross-account correction or aggregate-pricing program, we will update this Notice and implement the controls described in the updated version.
• Eval and quality assurance. Use representative samples (typically de-identified) to evaluate AI output quality, benchmark new models, and detect regressions.
• Security and fraud prevention. Detect, investigate, and prevent fraud, abuse, security incidents, and Terms violations.
• Legal compliance. Comply with applicable law, respond to lawful requests, and enforce our Terms.
• Corporate transactions. Evaluate and execute mergers, acquisitions, financings, or asset sales (with confidentiality protections).

We do not sell your data. Your prices, markups, customer list, and identifiable business practices are yours. We do not show your identifiable prices to another user, identify you as the source of a price, or license your business information to third parties.

3. Legal Bases (for users in jurisdictions that require them)

Where applicable law requires a legal basis, we rely on:

• Contract: to provide the Service you requested;
• Legitimate interests: to improve the Service, secure our systems, prevent fraud, and run our business, balanced against your rights;
• Consent: for marketing communications and certain cookies;
• Legal obligation: to comply with applicable law.

4. Use of AI; Third-Party AI Providers

The Service uses large language models, computer vision models, and other AI systems. Some of these systems are operated by third-party AI providers, currently including, without limitation: Anthropic, OpenAI, Google, and DeepSeek. The set of providers may change over time.

When you use the Service:

• User Content and prompts may be transmitted to and processed by these providers to generate output;
• Each provider processes data under its own terms of service and data-handling commitments;
• We select providers with commitments not to train their foundation models on customer content via standard API access, but you should not upload information you would not want to be processed by a third-party AI provider;
• Output of these models is probabilistic and may be inaccurate, incomplete, or fabricated. The Service is decision-support and requires human verification.

If you need a list of current AI sub-processors, please contact us at hello@estimado.com.

5. How We Share Information

We do not sell personal information for money. We share information as described below:

5.1 Service providers and sub-processors

We share information with vendors that help us run the Service, including: cloud hosting and storage providers; AI providers (see Section 4); payment processors; email and customer support providers; analytics providers; security and fraud-prevention services; and material-pricing data partners. These vendors are bound by contractual obligations to use information only on our behalf.

Current service providers used by the Site or Service include:

• Supabase: database, authentication, and file storage for account, project, estimate, and uploaded-file data;
• Anthropic and OpenAI: AI interpretation, estimate generation, and derived text embeddings, depending on the feature used;
• Pinecone: storage and retrieval of derived text embeddings used for knowledge search;
• Twilio: phone verification and transactional SMS processing;
• Plausible: privacy-focused website analytics; and
• Meta: advertising measurement through the Meta Pixel on our public website. Depending on applicable law, this measurement activity may be treated as "sharing" for cross-context behavioral advertising.

The categories of sharing described above expressly exclude mobile phone numbers and SMS opt-in consent data, which are never shared with third parties or affiliates for marketing or promotional purposes.

5.2 At your direction

We share information when you direct us to — for example, when you export an estimate, share a project link with a customer, or connect a third-party integration.

5.3 Material pricing and product data partners

To display pricing and product information, we obtain data from retailers, manufacturers, distributors, and aggregators. We send only limited information necessary for that purpose (such as product categories or zip codes), not your full project content.

5.4 Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, subpoena, court order, or other legal process; (b) protect the rights, property, or safety of Estimado AI, our users, or the public; (c) investigate or prevent fraud or security incidents; or (d) enforce our Terms.

5.5 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.

5.6 Aggregated or de-identified data

We may share aggregated or de-identified information (which cannot reasonably be used to identify you) for any lawful purpose, including industry benchmarking and research.

5.7 SMS and Text Messaging

When you book an appointment or request a demo on our website, you may provide a mobile phone number and consent to receive text messages from Estimado AI LLC. Consent is collected through a separate, unchecked checkbox and is not a condition of purchasing any product or service.

We use that number solely to send appointment confirmations, reminders, and scheduling updates. We do not use it for marketing or promotional messaging unless you separately opt in.

Estimado AI LLC does not share, sell, rent, or lease mobile phone numbers or SMS consent data with third parties or affiliates for marketing or promotional purposes. All other categories of data sharing described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We share mobile phone numbers only with the telecommunications providers required to deliver the messages you requested.

You may withdraw consent at any time by replying STOP, or by contacting us at hello@estimado.com.

6. Data Retention

We retain information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, enforce agreements, support security and fraud prevention, and maintain backups. Typical retention periods:

• Account and billing records: for the life of your account plus up to seven (7) years to satisfy tax, accounting, and legal obligations.
• User Content: retained while your account is active. Upon account deletion, we will delete or de-identify User Content within a commercially reasonable period, except for content retained in routine backups (deleted on rolling cycles) or that we are legally required to retain.
• Usage and log data: typically up to twenty-four (24) months.
• De-identified and aggregated data: may be retained indefinitely.

Account deletion. When you request account deletion, we delete or de-identify information as described above, subject to legal, security, fraud-prevention, billing-record, and backup obligations. We do not yet rely on a permanent, irreversible de-identification process to retain estimate-correction records after account deletion. If we introduce that process, we will update this Notice before using it and will describe the information retained, the de-identification method, and the applicable retention periods.

7. Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit, encryption at rest for sensitive stores, access controls, audit logging, vendor security review, and incident response procedures. No system is perfectly secure. You are responsible for keeping your credentials confidential and notifying us promptly of any suspected unauthorized access.

8. Cookies and Similar Technologies

We use cookies, pixels, local storage, and similar technologies for:

• Strictly necessary functions (authentication, security, session management);
• Functional purposes (saving preferences and settings);
• Analytics (measuring how the Service is used and detecting issues);
• Marketing (where applicable, measuring campaign performance — with consent where required).

You can control cookies through your browser settings. Disabling certain cookies may affect the Service. Where required by law, we present a cookie banner allowing you to manage non-essential cookies. We do not currently respond to "Do Not Track" browser signals, but we honor opt-outs where required by law (including Global Privacy Control signals as applicable).

9. Your Privacy Choices and Rights

9.1 Choices available to all users

• Update your information in your account settings.
• Delete your account by contacting hello@estimado.com or using the in-app option (where available).
• Opt out of marketing by clicking unsubscribe in any marketing email or contacting us.
• Export your data in a commercially reasonable format on request.

9.2 California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, may give you the right to know the personal information we collect, use, disclose, and share; request deletion; correct inaccurate information; receive a portable copy of certain information; and receive equal service and pricing without discrimination for exercising your rights.

During the preceding twelve months, the categories of personal information we may have collected include identifiers (such as name, email address, phone number, IP address, and account identifiers); commercial information (such as subscriptions, transactions, estimates, and project activity); internet or other electronic network activity; approximate location inferred from IP address or project location you provide; audio, visual, and similar information (including photographs, video, and voice recordings); professional or employment-related information; and inferences drawn from activity and preferences to personalize the Service.

We do not sell personal information for money. The Meta Pixel and similar advertising-measurement technology on our public website may constitute "sharing" for cross-context behavioral advertising under California law. You may request to opt out by emailing hello@estimado.com with the subject line "Do Not Sell or Share," and we honor legally recognized opt-out preference signals where required.

To exercise a California privacy right, email hello@estimado.com with the subject line "California Privacy Request." We may verify your identity and authority to make the request. We will respond within forty-five (45) days as required by law and may extend the response period once, up to a total of ninety (90) days, when reasonably necessary and permitted by law. You may use an authorized agent, subject to verification.

9.3 Other U.S. state privacy rights

Depending on where you live, you may have additional rights under state privacy laws (including Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, and others). These may include the right to:

• Know / access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete personal information, subject to exceptions;
• Portability — receive a copy of certain personal information in a portable format;
• Opt out of sale or sharing of personal information (we do not sell personal information for money; some advertising cookies may constitute "sharing" under California law, and you can opt out via our cookie controls or by contacting us);
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects;
• Non-discrimination for exercising your rights;
• Appeal a decision we make on a privacy request (in states that require an appeal process).

To exercise these rights, email hello@estimado.com with the subject line "Privacy Request." We may need to verify your identity before responding. You may authorize an agent to act on your behalf, subject to verification.

9.4 California "Shine the Light"

California residents may request information about disclosures of personal information to third parties for direct-marketing purposes by emailing hello@estimado.com.

9.5 Sensitive personal information

We do not intentionally collect "sensitive personal information" as defined under state law. If sensitive information appears in User Content you upload, we process it only as needed to provide the Service.

9.6 Automated decision-making

The Service generates AI output that is informational and requires human verification. We do not use the Service to make legal or similarly significant decisions about you without human involvement.

10. Children's Privacy

The Service is not intended for, marketed to, or designed for children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a child, contact us at hello@estimado.com and we will delete it.

11. Information About Third Parties in User Content

When you upload User Content that contains information about your customers, property owners, employees, or other third parties:

• You are the controller of that information for the purpose of your relationship with those individuals;
• We act as your processor or service provider with respect to that information;
• You are responsible for providing any required notices to those individuals and obtaining any required consents;
• If a third party contacts us directly about their information, we will generally refer them to you and assist as appropriate.

12. International Users

Estimado AI is based in the United States. The Service is intended for use within the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have data protection rules different from those of your country. By using the Service, you consent to that transfer and processing.

13. Third-Party Sites and Services

The Service may link to or interoperate with third-party sites and services (including retailers, manufacturers, and aggregators). Their privacy practices are governed by their own policies, not by this Notice.

14. Changes to This Notice

We may update this Notice from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice (such as by email or an in-product banner). Your continued use of the Service after the effective date constitutes acceptance of the updated Notice.

15. Contact Us

For questions, requests, or complaints about this Notice or our privacy practices:

Estimado AI LLC
Attn: Privacy
4440 PGA Blvd, Ste 600 #9012
Palm Beach Gardens, FL 33410
hello@estimado.com

You may also have the right to lodge a complaint with your state's attorney general or applicable privacy regulator.