Privacy Policy

1. Information we collect

Account information: name, e-mail address and a salted password hash (we never store your password in clear text). Authentication is handled by the Service itself; no third-party identity provider receives your credentials.

Profile and business information: company name, country, province or state, city, default rates and percentages you configure.

Customer Content: project details, client names and contact details you enter, uploaded price lists and plan files, quotes and export documents.

Payment information: purchases are processed by Stripe. We receive transaction metadata (amount, pack, status) but never see or store full card numbers.

Usage and log data: IP address, browser type, pages viewed, actions taken, timestamps — used for security, rate limiting and product improvement.

Cookies and similar technologies: strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies.

2. How we use information

To provide and operate the Service (calculations, document generation, price imports); to process payments and maintain credit ledgers; to provide support; to secure the Service (fraud and abuse prevention, rate limiting); to communicate service and transactional messages; to improve the product, including via aggregated and de-identified analytics; and to comply with legal obligations.

We send marketing communications only with your consent, in compliance with Canada's Anti-Spam Legislation (CASL). Every marketing e-mail includes an unsubscribe link. Transactional e-mails (receipts, security notices) are sent regardless of marketing preferences.

3. Your clients' personal information

When you enter your clients' names, addresses or e-mails, you are the party responsible for that information; we process it solely on your instructions to provide the Service (for example, rendering it into quote PDFs you choose to export). You warrant that you have the authority or consent required to provide this information to us.

4. Disclosure of information

We do not sell or rent personal information. We disclose it only: (a) to service providers acting on our behalf under contractual confidentiality — currently payment processing (Stripe), cloud hosting (Vercel, Render), database hosting (Supabase), and, if AI plan analysis is used, the AI model provider that processes the plan image you submit; (b) where required by law, court order or lawful government request; (c) to protect our rights, users or the public; (d) in connection with a merger, acquisition or sale of assets, subject to this Policy.

Some service providers may store or process data outside Canada (e.g., in the United States). Where they do, the information may be subject to the laws of those jurisdictions. We use providers with appropriate contractual and security safeguards.

5. Retention

We retain personal information for as long as your account is active and as needed to provide the Service. Upon a verified deletion request we delete account data and files within 30 days, except: (a) financial and tax records, retained as required by law (up to 7 years); (b) minimal records needed to enforce our Terms or resolve disputes; (c) residual copies in encrypted backups, which expire on the backup rotation schedule.

6. Security

We apply reasonable technical and organizational safeguards: encryption in transit (TLS), industry-standard password hashing (PBKDF2-SHA256), signed session tokens, role-scoped access, tenant isolation enforced at the application layer, rate limiting, and private storage for uploads and exports. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. We will notify affected users and the Office of the Privacy Commissioner of Canada of any breach of security safeguards creating a real risk of significant harm, as required by PIPEDA, and will make any breach notifications required by applicable US state law.

7. Your rights

Subject to legal exceptions, you may: access the personal information we hold about you; request correction of inaccurate information; withdraw consent (which may limit the Service we can provide); and request deletion of your account and data. Submit requests to support@buldos.com; we respond within 30 days.

If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial privacy regulator.

8. Children

The Service is intended for business users aged 18 or over. We do not knowingly collect personal information from children. If you believe a minor has provided us personal information, contact us and we will delete it.

8A. United States residents (CCPA/CPRA and state privacy laws)

If you are a resident of California or another US state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Texas and others), this section applies to you.

Categories of personal information we collect: identifiers (name, e-mail, IP address); commercial information (purchases, credit usage); professional information (company, rates); user-generated content (projects, price lists); and internet activity (usage logs). Sources: you, your devices, and our payment/auth providers. Purposes: as described in Section 2.

WE DO NOT SELL PERSONAL INFORMATION AND DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING, as those terms are defined in the CCPA/CPRA. We have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

Your rights: to know/access the personal information we hold; to correct it; to delete it; to data portability; and to non-discrimination for exercising these rights. Authorized agents may submit requests with proof of authorization. Submit requests to support@buldos.com; we verify requests via your account e-mail and respond within the timelines required by your state's law (generally 45 days).

Because we do not sell or share personal information, there is no opt-out to exercise; nevertheless, we honour Global Privacy Control (GPC) signals where applicable.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced by e-mail or in-app before they take effect. The 'Last updated' date above reflects the current version.

Contact for privacy matters: support@buldos.com.