Privacy Policy

1. Two roles

• Account information (who signs in, and billing). We decide how this is used. This policy covers it directly.
• Customer data (the subcontractor and project information a contractor puts into Kautus, or that its subcontractors upload through a link). The contractor decides what goes in and why. We handle it on the contractor's behalf, only to run the service.

2. What we collect

• Account and sign-in: your email address, your company's name, your role, when and from where you sign in, and your security settings. If you turn on two-step sign-in, your authenticator is held by our sign-in provider; we store only scrambled (hashed) recovery codes and a log of security events such as enrolling or resetting.
• Billing: your plan, subscription status and a customer reference from Stripe. Card details are collected by Stripe and never reach us.
• Subcontractor records entered by a contractor or uploaded by a subcontractor: company name, trade, contact email and phone, insurance certificate details (insurer, limits, expiry), licenses, safety credentials, agreement status, W-9 files, JSAs, closeout and warranty items.
• W-9s, which contain a name, address, signature and a taxpayer identification number (SSN or EIN). They are stored as files in restricted storage and are not read by AI.
• Lien waivers: the waiver text, amounts, drawn or typed signatures, and the signing record from the e-signature provider.
• Contract text a contractor pastes in for Contract Q&A, and the questions and answers.
• Technical information: the pages and features used, error reports, request logs (including IP address and browser type), counters that limit AI use, and the delivery status of reminder emails.
• Messages you send to support@kautus.net.

3. How we use it

• To provide the service: keep records, calculate status, generate waivers and send them for signature.
• To send email: sign-in links, invitations, alerts, and reminders to subcontractors on a contractor's behalf. Reminders come with an upload link, name the contractor, and send replies to the contractor's account owner.
• To read documents with AI (see below).
• To keep the service secure, prevent abuse, find and fix errors, and give support.
• To bill for paid plans and meet legal and tax obligations.

We do not sell personal information, we do not use it for advertising, and we do not use customer data to train AI models.

4. AI processing

When a contractor or subcontractor uploads an insurance certificate, license or safety credential, or a contractor uploads a waiver template, or asks a Contract Q&A question, the document or contract text is sent to Anthropic, which runs the AI model, so that fields can be filled in or a question answered. Under Anthropic's commercial terms, content sent this way is not used to train its models. W-9s are never sent to AI, and nothing on a W-9 is read automatically.

5. Service providers

These companies help us run the service and may handle the information described above, only for that purpose.

6. Who else sees it

• People on the same account. A contractor's team sees the account's records. The owner decides who can open W-9s.
• Subcontractors receive the emails and upload links sent to them, and can see their own company's name and the requests made to them.
• The service providers above, only to run the service.
• Authorities or other parties when the law requires it, or to protect people's safety or our rights.
• A buyer or successor, if we are involved in a merger, sale or reorganization. We would tell you first.

We do not sell personal information or share it for advertising.

7. If you are a subcontractor

A general contractor asked you to use Kautus, or added your company to it. The contractor decides what to collect and for what purpose, and holds your information on its account. To see it, correct it or have it removed, contact the contractor first. You can also email support@kautus.net and we will pass your request on or help.

8. How long we keep it

• Account and customer data are kept while the account is active.
• If a trial or subscription ends, the account is locked and we keep the data for 90 days so that you can return or download a copy. We email the owners about 30 days and again about 7 days before the data is deleted permanently.
• If an owner deletes the account from the Account page, its data is deleted right away. We keep a short record that the account existed and was deleted (the date, the company name and who asked), and Stripe keeps billing records as the law requires.
• W-9s are kept until the contractor removes them. The service flags a W-9 that has been on file longer than its retention period (4 years by default) so the contractor can review it.
• Subcontractor upload links expire after 30 days.
• Counters that limit AI use are deleted after about a week.
• Backups are encrypted and kept for up to 30 days, so deleted data can remain in them for up to 30 days.

9. How we protect it

• Data is encrypted in transit, and encrypted at rest by our storage providers. Our own backups are encrypted again before they are stored.
• Each customer's records are separated at the database level, so one account can't read another's.
• Uploaded documents sit in private storage and are opened only through short-lived links, after a permission check.
• Account owners must use two-step sign-in. Access to W-9s is limited to owners and people the owner allows.
• Error reports are masked, and a session recording is kept only when an error occurs, with text hidden.

No system is completely secure. If we learn of a security incident that affects your information, we will tell you without undue delay.

10. Cookies

We use only the cookies and similar storage needed to keep you signed in and to protect the service. We don't use advertising or cross-site tracking cookies.

11. Your choices and requests

Account owners can download a copy of all their data, and delete the account, from the Account page. You can also ask us to give you a copy of your information, correct it, or delete it. Email support@kautus.net. We may need to confirm who you are, and we aim to answer within 30 days. For customer data, we may refer you to the contractor who controls it. Depending on where you live, you may have additional rights under local law, and you can use the same address to exercise them.

12. Children

Kautus is for businesses and is not meant for anyone under 18. We don't knowingly collect information from children.

13. Where data is processed

Our database and files are hosted in the United States, and our service providers may process data in the United States and in other countries where they operate. By using the service you understand that your information will be handled there.

14. Changes

We may update this policy. We will change the date at the top, and for material changes we will email account owners or tell you inside the app.

15. Contact

Oporta Holdings LLC, doing business as Kautus. Questions or requests: support@kautus.net.