Sub Structure – Privacy Policy

Sub Structure is a business-to-business software platform designed to help cabinet manufacturers and related trades coordinate sales, production, purchasing, and field operations. We take privacy seriously and are committed to handling data responsibly, transparently, and securely.

This Privacy Policy explains what information we collect, how we use it, and the choices available to you.

1. Scope of This Policy

This Privacy Policy applies to:

• Businesses that create accounts on Sub Structure (“Customers”), and
• Individuals who access the platform on behalf of a Customer, such as employees, contractors, or agents.

Sub Structure does not provide services directly to consumers.

2. Information We Collect

We collect information necessary to operate and improve the service.

a. Account Information

• Name
• Email address
• Phone number (optional)
• Role and permissions within your organization
• Authentication and security metadata

b. Customer-Provided Operational Data

Customers may upload or enter data relating to their own operations, including:

• Customer names, addresses, and contact details
• Job details, schedules, and notes
• Project documentation and photos
• Material orders and vendor information

Sub Structure processes this information solely on behalf of the Customer and according to the Customer’s instructions.

c. Usage and Technical Data

• Pages visited and features used
• System logs, error reports, and performance metrics
• Device, browser, and session information

d. Files and Media

• Photos and documents uploaded for job documentation, verification, or operational workflows

3. How We Use Information

We use collected information to:

• Operate and maintain the platform
• Coordinate workflows across sales, manufacturing, purchasing, and field teams
• Send system notifications and alerts related to platform activity, including email and SMS text messages when enabled by the Customer or user.

  SMS notifications are used for transactional and operational purposes such as scheduling updates, task status changes, arrival notifications, and service coordination. Message frequency varies based on system activity. Message and data rates may apply. Users may opt out of SMS notifications at any time by replying “STOP” or by disabling SMS notifications within the platform.

• Generate reports and operational insights
• Provide customer support and troubleshoot issues
• Improve performance, reliability, and usability of the service
• Comply with legal and regulatory obligations

4. Legal Basis for Processing

Where required by applicable law, we process personal data based on one or more of the following legal grounds:

• Performance of a contract with our Customers
• Consent, where applicable
• Compliance with legal obligations
• Legitimate business interests, such as security, fraud prevention, and service improvement

5. Data Sharing

We do not sell personal data.

We may share information only with:

a. Service Providers (Subprocessors)

Including, but not limited to:

• Payment processors (e.g., Stripe, QuickBooks Online)
• Messaging providers (e.g., Twilio for SMS notifications)
• Hosting and infrastructure providers

These providers are authorized to process data only as necessary to perform services for us.

b. Team Members Within Your Organization

Access is controlled by role-based permissions set by the Customer.

c. Legal and Compliance Obligations

When required by law, court order, or government request.

6. International Data Transfers

Your data may be processed or stored in the United States or other jurisdictions where our service providers operate. Where required, we use appropriate safeguards to protect data during international transfers.

7. Data Retention

We retain data for as long as an account is active.

Upon account termination:

• Data is deleted or anonymized within 90 days, unless retention is required by law or for legitimate business purposes (e.g., compliance, dispute resolution).

8. Security & Incident Response

We use administrative, technical, and physical safeguards designed to protect data, including:

• Encrypted connections (HTTPS)
• Encrypted databases where appropriate
• Role-based access controls

No system is completely secure. In the event of a data breach affecting Customer data, we will notify affected Customers without undue delay and as required by law.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of personal data
• Object to or restrict certain processing

Requests can be submitted to the contact email below.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice.

11. Contact

Questions about privacy can be sent to:

Please use the Support link in the application to contact us.