Privacy policy

Who we are

Obrarum is a web app for building construction estimates, sharing them with clients and collecting their approval. The service is run by Leandro Melchor Cordero Davila under the name Obrarum, with an address for notices at Paseo Revolución 10, Panorama, 76904 El Pueblito, Querétaro, Mexico (“Obrarum”, “we”, “us”). We are responsible for the personal data described in this policy, except in the case explained in the next section.

Your data and your clients' data

We handle two kinds of personal data, and our role is different for each:

• Your account data. The data you give us to use Obrarum, and the data we collect while you use it. We decide how it is used, so we are responsible for it.
• Your clients' data. The contact details you enter for your clients, and the data a client submits when approving or declining a quote you shared. You decide what to collect and why, so you are responsible for it. We store and process it to provide the service to you. We also measure how Obrarum is used and record that use (explained below). Those recordings may show your clients' contact details (name, position, phone, email and tax ID) and the content of your quotes. They never show anything typed, the ID number, the signature or the decline reason. We use them only to improve Obrarum and never sell them. For this use, we are responsible.

If you are a client of an Obrarum user and want to access, correct or delete your data, contact the business that sent you the quote. If you can't reach them, write to us and we will pass your request to that business.

If you visit a shared quote, Obrarum is responsible for the analytics of that visit. You can object by writing to support@obrarum.com.

What we collect

When you create an account

• First name, last name and email address.
• Your password, stored encrypted. We can't see it.
• Optionally, a profile photo and your language preference.
• The date you accepted the terms of service and this policy.

When you set up your business

• Business name, logo, address, phone, email and tax ID.
• The email addresses of the people you invite to your team.

When you use Obrarum

• Your projects: name, description, location and photo.
• Your estimates and quotes: chapters, items, costs, prices, margins, terms and versions.
• Your item library.
• Your clients' details: company name, contact name, position, email, phone and tax ID.

When your client approves or declines a quote

When a client opens a quote you shared and responds to it, we record:

• If they approve: their full name, ID number, drawn signature and the date.
• If they decline: the reason they give and the date.
• In both cases: the IP address, the approximate location it points to (city, region and country), and the browser and device they used.

This record shows that the approval was given and by whom. It appears on the quote page and on the PDF certificate, both visible to you and to anyone with the share link and its access code. We don't check the ID number against any official registry.

Our analytics provider (explained below) also records visits to shared quote pages: when the page was opened, access code attempts, whether the quote was approved or declined, and the browser, device and approximate location. It doesn't identify the client by name or email, and it never records what is typed, the ID number, the signature or the decline reason.

When you subscribe to a paid plan

Payments are handled by our payment provider, which sells you the subscription and charges you. It collects your payment details, billing address and tax information. We never see or store your card number. We only keep the identifiers of your customer account and subscription with that provider, your plan and the subscription status. When you start a checkout, we send it your IP address so it can charge you in your local currency.

Collected automatically

Our servers and providers record technical data such as IP address, browser, access times and errors, to keep the service running and secure.

We also use an analytics provider to understand how people use the website and the app: which pages they visit, what they click, which features they use and where they get stuck. It records those actions together with your browser, device and approximate location (from your IP address). Once you sign in, it links them to your account (your name, email and language, and the team you are working in), including your earlier visits from the same browser. Our analytics provider stores this data in the United States, and keeps analytics data and recordings for up to one year.

It also makes recordings of how the website, the app and shared quote pages are used. Everything typed is hidden in them, and so are the signatures, ID numbers and decline reasons on shared quote pages. Recordings may show your clients' contact details (name, position, phone, email and tax ID) and the content of your quotes. We use analytics and recordings only to improve Obrarum: we never sell them or use them for advertising.

When we can tell from your connection (your IP address) that you are visiting us from the European Union, the European Economic Area, the United Kingdom or Switzerland, we don't use analytics or recordings, including on shared quote pages.

Cookies and local storage

We use:

• Session cookies, to keep you signed in.
• A language cookie, to remember the language you chose.
• A country cookie, set from your IP address, to show prices in your currency and list your currencies first.
• Analytics cookies and local storage from our analytics provider, to recognize your browser between visits, for up to one year. We don't use them when your IP address shows that you are visiting from the European Union, the European Economic Area, the United Kingdom or Switzerland.
• Your browser's local storage, to keep Obrarum AI draft items you haven't applied yet and the suggestions you dismissed. This data stays on your device.

We don't use advertising cookies. You can block or delete cookies in your browser settings: blocking analytics cookies doesn't affect the service, but without session cookies you won't be able to sign in.

Why we use your data

We use your data to:

• Create and manage your account, and let you work with your team.
• Store your projects, estimates, library and clients, and generate your exports.
• Share your quotes with your clients and record their response.
• Run Obrarum AI when you use it.
• Process your subscription and apply the limits of your plan.
• Send you the emails the service needs, such as account confirmation and password reset.
• Answer your support requests.
• Keep the service secure, prevent abuse and fix errors.
• Comply with our legal and tax obligations.

All of these purposes are necessary to provide the service you signed up for.

We also use your data to measure how Obrarum is used and improve it. This purpose isn't necessary for the service, so you can object to it at any time by writing to support@obrarum.com, and it won't affect your use of Obrarum.

We don't sell your data, we don't use it for advertising, and we don't send marketing emails without your consent. If we ever want to use your data for a new purpose, we will update this policy and, when the law requires it, ask for your consent first.

Obrarum AI

When you use Obrarum AI, we send our AI provider the information it needs to suggest or review items and build drafts: the project name, description and location, the names of the chapters and items in your estimate and your library, and the text you write to Obrarum AI when you ask for a draft. We don't send your clients' contact details or the data of their approvals.

Our AI provider doesn't use this data to train or fine-tune its models.

Who we share data with

We share personal data only with the providers we need to run Obrarum, and only the data each one needs for its job:

• Supabase: database, sign-in, file storage and account emails. Privacy policy
• Polar: payments and subscriptions. Privacy policy
• TypeSafe: Obrarum AI. Privacy policy
• PostHog: product analytics. Privacy policy
• Cloudflare: hosts the website and the app, delivers them to your browser, and protects sign-up, sign-in, password reset and other sensitive account actions with bot detection. Privacy policy

We also share data:

• With the people you choose: your team members see your business's data, and anyone with a share link and its access code sees that quote.
• When the law requires it: if a court or competent authority orders us to.
• If the business changes hands: if Obrarum is sold or merged, your data would pass to the new owner, who must respect this policy. We would tell you first.

Where your data is stored

Your data is stored on servers in the United States, and our providers may process it there or in other countries. By using Obrarum, you accept this transfer, which is necessary to provide the service. We only work with providers that commit to protecting the data.

How long we keep it

We keep your data while your account is active. When you delete your account from your account settings, we delete it from Obrarum right away, together with your personal workspace and every team where you are the only member, including their projects, clients and quote responses. A team with other members isn't deleted: it passes to another member, and its data stays with that team. A team's owner can also delete it when no one else is in it. If you ask us by email instead, we delete your data within 30 days. The copies held by our analytics provider (your name, email and usage recordings) are deleted within 30 days too.

Until then, quote responses stay with the quote they belong to, because they are the record of the approval for you and for your client.

When you delete a project, you can restore it for 30 days. After that, we delete it permanently, together with its estimates and quote responses.

Deleted data can remain for a few more days in our providers' automatic backups, until they are overwritten. When an account or team is deleted, we also ask our payment provider to cancel its subscription and anonymize its customer record. Payment and billing records are kept by our payment provider, under its own policy and the tax obligations that apply to it.

Your rights

You can ask us at any time to:

• Tell you what personal data we have about you and how we use it.
• Correct data that is wrong or incomplete.
• Delete your data.
• Stop using your data for a specific purpose, even if you gave us your consent before.

You can edit most of your data and delete your account yourself in your account settings. For everything else, write to support@obrarum.com from the email of your account, say what you want us to do and, if it applies, which data. We will answer within 20 business days.

If you think we haven't handled your data correctly, you can also file a complaint with the data protection authority of your country.

Security

Data travels encrypted between your browser and our servers. Each business can only access its own data, and share links use a long random address plus a 6-digit access code, which locks for one hour after 5 wrong attempts. No system is 100% secure, so if a breach affects your data, we will notify you and the competent authorities as the law requires.

Minors

Obrarum is a tool for businesses and professionals. It isn't meant for people under 18, and we don't knowingly collect their data. If you learn that a minor gave us their data, write to us and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top. If the change is important, we will tell you by email or with a notice in the app before it takes effect.

Contact

For any question about this policy or your data, write to support@obrarum.com.