Privacy Policy

We collect information you provide directly, information generated through your use of the Service, and information obtained from third-party services you connect (such as Google).

1.1 Information You Provide

• Account information: name, email address, and profile picture obtained from your Google account when you sign in via Google OAuth.
• Communication data: messages you send to our support team.
• Feedback: responses to surveys or feedback forms.

1.2 Google API Data

When you connect your Google account, we request specific OAuth permissions (scopes) to provide the Service. Depending on the features you use, these may include:

• Google Sheets read access (spreadsheets.readonly or spreadsheets) — to read your Bill of Quantities (BOQ), actual cost sheets, and related project data that you explicitly share with our application.
• Google Drive file metadata — to discover and list spreadsheet files you choose to connect.
• Google account identity (email, name, profile photo) — for authentication and account display purposes.

We request the minimum scopes necessary to operate each feature. We will always ask for your explicit consent before accessing any Google resource, and you can revoke access at any time (see Section 7).

1.3 Usage & Technical Data

• Log data: IP address, browser type, pages visited, timestamps, and error reports.
• Device information: operating system, screen resolution, and browser version.
• Cookies and similar tracking technologies (see Section 5).

We use the information we collect to:

• Provide and operate the Service: analyze your spreadsheet data to detect cost overruns, change orders, and cash-flow gaps in your construction projects.
• Authenticate you securely using your Google account.
• Generate AI-powered insights from the project data you share with us.
• Improve the Service: aggregate, anonymized usage patterns help us fix bugs and prioritize features.
• Communicate with you: send transactional emails (e.g., account alerts, usage summaries) and, with your consent, product updates.
• Comply with legal obligations and enforce our Terms of Service.

We do not use data obtained through Google APIs to train AI or machine-learning models, nor do we sell, rent, or share it with advertisers.

Our use of data obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell your personal information. We may share data only in the following limited circumstances:

• Service providers: trusted vendors who process data on our behalf (e.g., cloud hosting, analytics). These processors are contractually required to protect your data and may not use it for their own purposes.
• AI inference: content you submit for analysis may be sent to AI model providers (such as Anthropic) solely to generate the requested output. We use API services that do not retain submitted data for training purposes.
• Legal requirements: we may disclose information when required by law, court order, or to protect the rights and safety of our users or the public.
• Business transfers: in the event of a merger or acquisition, personal information may be transferred to the successor entity, subject to the same privacy protections.

Spreadsheet & project data: we process your Google Sheets data in real time to generate insights. We store only the derived results (summaries, metrics, alerts) necessary to display your dashboard. Raw spreadsheet content is not permanently stored beyond the current session unless you explicitly save a snapshot.

Account data: retained for as long as your account is active. You may request deletion at any time (see Section 7).

Logs: technical logs are retained for up to 90 days for security and debugging purposes, then automatically deleted.

Upon account deletion, we will delete or anonymize all personal data within 30 days, except where retention is required by law.

We use cookies and similar technologies for:

• Essential operation: session authentication and security tokens. These cannot be disabled without breaking the Service.
• Preferences: remembering your settings and display preferences.
• Analytics: aggregate, anonymized data about feature usage to improve the product.

You can control cookie behavior through your browser settings. Disabling non-essential cookies will not affect core functionality.

We implement industry-standard security measures including HTTPS encryption in transit, encrypted storage at rest, and access controls limiting who can view your data. OAuth tokens issued by Google are stored securely and are never exposed in logs or client-side code.

Despite these measures, no transmission over the internet is 100% secure. Please notify us immediately at privacy@komander.ai if you suspect unauthorized access to your account.

You have the following rights regarding your data:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete information.
• Deletion: request that we delete your account and associated data.
• Revoke Google access: at any time, visit Google Account Permissions to revoke Komander.ai's access to your Google account. We will no longer be able to access your Google data after revocation.
• Data portability: request an export of your data in a machine-readable format.
• Opt out of marketing: unsubscribe from promotional emails using the link in any such email or by contacting us.

To exercise these rights, contact us at privacy@komander.ai. We will respond within 30 days.

The Service is not directed to children under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with their data, please contact us and we will promptly delete it.

Komander.ai operates globally and your data may be processed in countries other than your own. We ensure appropriate safeguards are in place for any cross-border transfers consistent with applicable data protection laws.

The Service may contain links to third-party websites or integrate with external services (e.g., Google Workspace). This Privacy Policy does not cover third-party practices. We encourage you to review the privacy policies of any third-party services you use.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and, where appropriate, by email. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after changes constitutes acceptance.

For privacy-related questions, requests, or concerns, please contact: