Privacy
Privacy Policy
Carbide List uses personal information to run the punch-list service—not to sell profiles or show ads. This policy covers the public website, workspace accounts, project links, project content, support, exports, and Google sign-in.
1. Who we are and what this covers
Carbide List is operated by Lynn & Matthews LLC, doing business as Carbide Studios (“Carbide List,” “we,” “us,” or “our”), P.O. Box 781422, San Antonio, Texas 78278, USA.
This Privacy Policy covers carbidelist.com, Carbide List workspace and project applications, account sign-in, project-specific Builder, Crew, and Homeowner links, support communications, and exports produced through the Service.
A business that owns a Carbide List workspace controls why its project information is collected and who is invited. We process that project information to provide the Service for the workspace owner. We also process limited information for our own account administration, security, billing, legal compliance, and support.
2. Information we collect
Account and organization information
When a workspace owner or member creates or uses an account, we may receive a name, email address, profile image, authentication-provider identifier, organization and membership information, role, sign-in history, and acceptance of the current Customer Terms. Sign-in may use Google or a one-time code sent by email. We do not offer an app password and do not receive a user’s Google password.
Project and punch-list information
We process the information people add to a workspace, including project names and locations, punch items, notes, trades, status, dependencies, photos, photo markup, completion evidence, review reasons, archives, dates, attribution, and event history. Some content may identify a homeowner, worker, contractor, property, or person visible in a photo.
Project-link and guest information
A Crew, Homeowner, or Builder project link acts as a credential. When someone uses one, we process the project and role associated with the link, a session identifier, language choice, actions taken, and security records. We may not know the guest’s individual identity unless they provide it in project content.
Offline and device information
The app may keep project records, queued changes, photos, language preferences, and session information in browser storage so it can work with poor or no signal. The device sends that information to Carbide List when it reconnects. Clearing browser data can remove the local copy and require the person to open the project link or sign in again.
Technical, security, and usage information
When a person visits the website or Service, we and our hosting provider may process IP address, date and time, requested URL, browser and device type, operating system, referring page, response status, session and security events, error information, and coarse network or geographic information derived from an IP address. We use this information to deliver, secure, troubleshoot, and improve the Service.
Billing, communications, and support
If Customer purchases the Service, we and a payment provider may process billing contact information, subscription status, invoices, payment status, and limited payment-method details such as brand and last four digits. We do not store complete card numbers. We also keep emails and other information sent to our support, legal, privacy, or security addresses.
3. Google sign-in data
When public account sign-in launches, Carbide List will offer Google sign-in through WorkOS, our identity provider. When a person chooses Google, we will request only the basic sign-in identity needed to create or connect an account: the Google account’s unique identifier, name, email address, profile image if available, and confirmation that Google authenticated the person.
We use Google sign-in data only to authenticate the user, connect the sign-in to the correct Carbide List account and organization, display basic account identity, prevent fraud, secure the Service, and provide support.
Carbide List does not request access to Gmail, Google Drive, contacts, calendars, documents, or the user’s Google password. We do not sell Google user data, use it for advertising, or allow people to read another user’s Google account data.
Google sign-in information may be shared with WorkOS and the infrastructure providers needed to authenticate and operate Carbide List. We do not share it with advertisers or data brokers. A user may revoke Carbide List’s Google access through the security settings in their Google Account. Revocation prevents Carbide List from using that Google authorization for future Google sign-in, but it may not end an existing session or another sign-in method and does not automatically delete the Carbide List account or project records; contact privacy@carbidestudios.ai for a deletion request.
Our use and transfer of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
4. How we use information
We use personal information to:
- create and administer accounts, organizations, projects, roles, sessions, and links;
- display, synchronize, translate, archive, restore, and export punch-list records;
- allow offline work and reconcile queued changes;
- authenticate users and enforce project and role boundaries;
- provide billing, support, service notices, and requested communications;
- detect abuse, investigate incidents, prevent fraud, and protect the Service;
- diagnose errors and improve reliability, accessibility, and usability;
- create de-identified or aggregated service statistics that do not identify a person, project, property, or customer; and
- comply with law, enforce our Terms, and protect legal rights.
We do not sell personal information. We do not share it for cross-context behavioral advertising or use project information to build advertising profiles.
5. Automated translation and artificial intelligence
When automated translation is enabled, Carbide List sends the relevant user-written text—such as a work item, note, completion note, or review reason—to an artificial-intelligence provider so it can return a translation. A summary feature may send relevant structured project facts and text needed to create that summary. Carbide List keeps the source wording, and the source controls over an automated translation.
Built-in text translation does not intentionally send project photos to the AI model. If we later offer an image-based AI feature, we will explain it before that feature is enabled.
We do not use Customer Data to train our own or a shared general-purpose model and do not opt Customer Data into a provider’s model training unless the workspace owner affirmatively opts in after a clear explanation. A provider may temporarily retain inputs and outputs for service delivery, security, or abuse prevention under its business terms. Before an AI feature is enabled for a public paid workspace, its provider configuration must support these promises; otherwise the feature will remain off.
Automated translations can be wrong. Workspace owners are responsible for reviewing material instructions and using a qualified person when safety, code, legal, architectural, engineering, or trade accuracy matters.
8. Retention and deletion
We retain active workspace and project information while needed to provide the Service. Items or projects archived inside an active workspace remain part of the project record and are included in applicable exports; archiving is not account-level deletion.
After a paid term ends: ordinary access and reusable project links pause. The workspace owner has 30 calendar days of read-only access to export active and archived project data and may reactivate. At the end of day 30, we delete the workspace’s project data and photos from active systems.
Backup copies may remain for no more than 30 additional days while they expire through the ordinary rolling backup cycle. During that time they are isolated from ordinary use and used only for disaster recovery, security, or legal obligations.
We may retain minimal account, billing, Terms-acceptance, security, and legal records as reasonably needed for law, fraud prevention, contractual history, or disputes. Those retained records do not include project photos or ordinary punch-list content unless legally required. Our processors may retain limited information under their contractual backup, security, and legal schedules.
Support emails and related records are kept only as long as reasonably needed to resolve the request, maintain service history, and meet legal or security obligations. A downloaded export remains under the recipient’s control.
9. Your choices and privacy rights
Depending on where a person lives and how the information is used, they may have rights to request access, correction, deletion, restriction, or a portable copy of personal information, and to appeal a denied request. We do not sell personal information or use it for targeted advertising, so there is no sale or targeted-advertising opt-out to exercise.
A workspace participant can correct much of their project information in the Service. A workspace owner can export project records and manage members and links. Any person may email privacy@carbidestudios.ai to make a privacy request. We may need to verify identity and authority before acting, and we will respond within the period required by applicable law.
Because a customer business controls its project records, we may direct a request about those records to the relevant workspace owner or work with that owner to fulfill it. We will not discriminate against a person for exercising a privacy right.
10. Security
We use reasonable administrative, technical, and organizational safeguards designed for the nature of the Service, including encrypted network connections, role and project scoping, restricted administrative access, backups, protected secrets, and security logging. No method of transmission or storage is completely secure.
Project links are credentials and should be protected like passwords. Workspace owners should replace a link when it is shared with the wrong person or no longer needed. Report suspected unauthorized access or a vulnerability to security@carbidestudios.ai.
11. Processing in the United States
Carbide List is based in Texas and primarily operates in the United States. Information may be processed in the United States and other locations where our service providers operate. Those locations may have privacy laws different from a user’s home jurisdiction. Where required, we use contractual or other lawful transfer safeguards.
12. Children
Carbide List is a business construction service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact privacy@carbidestudios.ai so we can investigate and take appropriate action.
13. Changes to this policy
We may update this policy as the Service, providers, or law changes. We will post the new version and effective date here. If a change materially affects how we use personal information already collected, we will provide additional notice when required.
14. Contact us
Privacy questions and requests: privacy@carbidestudios.ai
Security reports: security@carbidestudios.ai
General support: support@carbidestudios.ai
Mail: Lynn & Matthews LLC d/b/a Carbide Studios, P.O. Box 781422, San Antonio, Texas 78278, USA.