OpenTakeoff Privacy Notice

Version: v1.0 Effective date: October 13, 2026

This notice explains how Quis Ut Deus LLC, doing business as Kentucky AI ("Kentucky AI," "we") handles information in the hosted OpenTakeoff service (the "Service"). It does not cover OpenTakeoff Lite, the free open-source edition you run yourself; we receive no data from your own copy of Lite. Words such as "Customer," "Customer Data" and "AI Provider" mean what they mean in the OpenTakeoff Terms of Service.

1. What we collect

Account information. Name, work email, company, role, the Seat assigned to you, sign-in records and your acceptance of the Terms (version, time, account). Billing contact details. Card payments, including the card you put on file to start a trial, are handled by our payment processor, Stripe; we never see or store full card numbers.

Uploaded files and project data. Plans, specifications, addenda and other files you upload, and the takeoffs, conditions, markups, estimates, notes and exports you create. Construction documents often include names and contact details of architects, engineers, owners and contractors. We handle all of this as Customer Data on our customer's behalf.

Usage logs. IP address, browser and device type, timestamps, pages and features used, agent and API requests, error and performance logs. We use these to run, secure, support and improve the Service.

Sign-up checks. To keep to one free trial per company, we keep one-way hashes of the email, phone number and network address used to sign up, not the values themselves.

Support messages. What you send us by email or in the Service when you ask for help or give feedback.

Cookies. The Service uses only the cookies and similar storage needed to keep you signed in and keep the app working. It sets no advertising or cross-site tracking cookies.

Product analytics. To learn which parts of the Service work and where people get stuck, our servers record product events such as "trial started", "file uploaded" or "project exported", with counts (for example, how many AI-proposed shapes were accepted). Each event carries only a random company identifier and numbers. It never includes your name, email, company name, file names, project names, drawings or any other contents of your files. We use PostHog to store and analyze these events.

2. How we use it

• To provide the Service: host your Tenant, process your files, run takeoff and estimating features, produce exports and back up your data.
• To run the AI features of the Service through our AI Provider when you or your agents use them.
• To secure the Service, prevent abuse and enforce the Terms.
• To provide support, send service and billing notices, and tell you about changes to the Service or the Terms.
• To understand and improve the Service using usage logs and aggregate, de-identified statistics that do not contain the contents of your files.
• To meet legal obligations.

We do not use your uploaded files or project data to train machine-learning models unless your company opts in in writing, and our AI Provider is not permitted to train its models on them.

3. Where it lives

Each customer company runs in its own isolated Tenant: its own application process and its own data folder, hosted by Railway in the United States (US East). Backups and archives are encrypted and stored in a separate storage bucket used only for that customer, on Cloudflare R2 in North America. Access by Kentucky AI personnel is limited to what is needed to support, secure and run the Service.

4. Who we share it with

• Our service providers, only as needed to provide their services and under obligations to protect the information:
• Railway (hosting, United States)
• Cloudflare (DNS and encrypted storage of backups and archives)
• Anthropic (the AI Provider that runs AI features; it processes the parts of your files you use AI on, and may not train on them)
• Stripe (payments and the card on file)
• Clerk (sign-in and account security)
• Resend (account and trial emails)
• PostHog (product analytics, with no personal data as described above)
• Legal and safety: when the law requires it, or to protect the rights, safety or security of our customers, the Service or Kentucky AI. Where allowed, we tell the customer first.
• Business transfer: to a buyer or successor if Kentucky AI is involved in a merger, acquisition or sale of assets, subject to this notice.

We do not sell personal information, and we do not share it for targeted advertising.

5. How long we keep it

We keep Customer Data while the trial or subscription is active. When it ends, the workspace stays readable for 30 days (60 days after an unpaid subscription lapses) so you can download your projects; we then keep an encrypted archive for 12 months so your company can come back, and delete it after that. Your company can ask us to delete it sooner. Routine encrypted backups age out after about eight weeks. We keep account, billing and acceptance records as long as needed for legal, tax and accounting purposes, and usage logs and product analytics events for 12 months.

6. Security

We use tenant isolation, encryption of backups and archives, access controls and other reasonable safeguards. No system is perfectly secure. If we confirm unauthorized access to your company's data in our systems, we will notify your company without undue delay, and others as the law requires.

7. Your choices and rights

Your company controls its Customer Data. If you are an Authorized User, contact your company's account owner first about project data. You can ask us to access, correct or delete your account information by emailing michael@kentucky-ai.com. Depending on where you live, you may have additional rights under state privacy laws; we will respond to such requests as those laws require. If a request concerns personal information inside a customer's files, we will refer it to that customer and assist them as needed.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

9. Changes

We will post updates to this notice and, for material changes, notify account owners by email or in the Service before they take effect.

10. Contact

Quis Ut Deus LLC, doing business as Kentucky AI Louisville, Kentucky, USA michael@kentucky-ai.com