Privacy Policy & Terms of Service

1.1 Identity & Contact Data

What: Name, email, phone number, company name, company address, VAT/tax registration.

Why: To create your account, send you invoices, provide customer support, and verify your business for platform access.

Your Control: You can update or request deletion of this data at any time.

1.2 User-Submitted Content

What: Project descriptions, homeowner enquiries, scope details, quotes, pricing inputs, labour rates, material selections, blueprints, images, customer names and contact details, notes, and any other files you upload.

Why: This is the core of what makes the platform work. We process it to generate structured scopes, draft quotes, and provide your account's outputs.

1.3 Operational & Workflow Data

What: Non-personal project categories (e.g., "heat pump installation," "electrical rewiring"), structural scope parameters (e.g., system size, room count, material type), trade types, workflow configurations, feature usage patterns, quote completion time, scope accuracy, and system performance metrics.

Why: To train our automated scope-structuring and first-offer generation algorithms. This data helps us understand what a "typical" plumbing job looks like, so our AI can provide better suggestions to builders who use the platform.

What We Do NOT Collect: Your specific pricing formulas, labour rates, or customer margins. We extract structure, not your numbers.

Transparency: If you want to see exactly what operational data we've extracted from your account, request a data export.

1.4 Usage & Technical Telemetry

What: IP address, browser type, device type, operating system, pages visited, features used, error logs, API response times, and system performance metrics.

Why: To detect fraud and abuse, maintain platform security, identify bugs, and improve performance.

What We Do NOT Do: We do not track individual keystroke patterns, mouse movements, or time spent on individual fields for behavioral profiling or marketing purposes.

1.5 Customer Data from Homeowner Enquiries

What: Any data homeowners submit through the intake form (names, contact details, project descriptions, budgets, images, preferences).

Why: To deliver the service. We also use anonymized patterns from homeowner enquiries to improve our intake form logic and scope-structuring AI.

Your Role: You are the data controller for homeowner data. When a homeowner requests their data or asks for deletion (GDPR/UK GDPR right of access), we fulfill it through you first. If a homeowner contacts us directly, we direct them to you.

2.1 Platform Operation

We use all collected data to:

• Generate your account's outputs (structured scopes, draft quotes, dashboards)
• Provide customer support
• Maintain platform security and stability
• Detect and prevent fraud and abuse

2.2 AI Training & Model Improvement

Private Training (Your Benefit):

• We train models on your anonymized project data to improve scope suggestions and first-offer templates specific to your trade and region.
• These models run on ISKAL's servers and improve only your experience and other builders' on the platform.

Public Training (What We Don't Do):

• We do not train any public, third-party, or open-source foundation models on your data.
• We do not contribute your data to datasets like Common Crawl, Hugging Face, or research projects without explicit permission.
• Even anonymized, proprietary operational data (e.g., "HVAC jobs in Alpine regions") is never shared with external AI labs or researchers.

2.3 Aggregated & Anonymized Insights

What This Means: We aggregate operational data across minimum cohorts of 50+ comparable jobs. Data is only considered anonymized when:

• No individual builder can be identified, even when combined with other datasets
• Specific pricing, labour rates, or customer details are completely removed
• Results are expressed as trends, averages, or distributions, not individual data points

Examples of Aggregated Data We May Use:

• "Heat pump installations in Alpine climates average 8–12 kW capacity"
• "Electrical rewiring projects take 3–5 days on average"
• "Material costs for kitchen renovations in Region X range from €5K–€15K"
• "HVAC technicians spend 2 hours on average site surveys in this region"

Examples We Will Never Share:

• "Christian's heat pump jobs average 10 kW" (identifies a builder)
• "Builder X's labour rate is €75/hour" (reveals proprietary pricing)
• Individual customer names, contact details, or project specifics (belongs to you)

What We Do With This Data:

• Improve product recommendations (showing relevant materials/suppliers based on regional trends)
• Build benchmark reports builders can opt-in to view ("How do I compare to others in my region?")
• Help suppliers optimize inventory and logistics ("We see strong demand for 10kW units in Alpine regions")
• Improve platform algorithms and feature suggestions

Your Control: You can request exclusion of your data from aggregated analysis. Contact us to opt out.

2.4 Supplier Integration & Product Recommendations

How It Works: When you select products from integrated supplier catalogs within the quote builder, we share the following with the relevant supplier:

• Job location (region, not street address)
• Product model and specifications
• Estimated quantity
• Price range bracket (e.g., "€2K–€3K")

We do NOT share:

• Your company name or builder identity
• Customer names or contact details
• Your specific labour rates or margins
• Your full pricing formula

Why: Suppliers need this information to optimize stock, confirm availability, arrange logistics, and improve their product recommendations. It benefits you (faster delivery, better alternatives) and them (better demand forecasting).

Your Control: You can disable supplier data sharing in account settings, though this may limit product availability and recommendations.

3.1 How Long We Keep Your Data

• Account Data (Identity, Contact): For the duration of your subscription + 30 days after cancellation
• User-Submitted Content (Quotes, Scopes, Customer Data): Until you request deletion or 12 months after last login (whichever comes first)
• Operational Data (Aggregated Insights): Retained indefinitely in anonymized, aggregated form
• Telemetry (Logs, Performance Data): Retained for 90 days, then deleted

3.2 Deletion Rights

You can:

• Delete individual projects or quotes from your dashboard at any time
• Request full account deletion via email. We will delete all personal data associated with your account within 30 days
• Export your data at any time (quotes, scopes, customer details, everything)

Important: Deletion of your data does not retroactively remove insights already aggregated into our algorithms. For example, if your data was used to improve our scope-structuring model, retraining the model without your data is not feasible. However, your specific pricing, customer names, and identifiable business information are permanently removed.

3.3 GDPR & Data Subject Rights

Under GDPR and UK GDPR, you have the right to:

• Access: Request all data we hold about you or your account
• Rectification: Correct inaccurate data
• Deletion: Request deletion (subject to lawful retention periods)
• Portability: Receive your data in a machine-readable format
• Restriction: Restrict processing of your data
• Objection: Object to specific processing (e.g., aggregated insights)

To exercise these rights, email christian@iskal.si with "GDPR Request" in the subject line. We'll respond within 30 days.

4.1 What You Own

Absolute ownership:

• All pricing data (labour rates, material costs, overhead formulas, margins)
• All customer data (names, contact details, project descriptions, budgets)
• All quotes, scopes, and project files you create on the platform
• All company information, configurations, and custom workflows

You retain these rights indefinitely. ISKAL does not claim any ownership over this data.

4.2 What ISKAL Owns

• The platform interface, algorithms, and code
• The guided intake workflows and scope-structuring logic
• All UI/UX components, templates, and layout designs
• The aggregated, anonymized insights derived from platform data

You cannot copy, reverse-engineer, or reproduce these elements.

4.3 License Grant

By using the platform, you grant ISKAL:

• A worldwide, royalty-free, non-exclusive license to host, process, and store your content to deliver the platform's services
• A license to use anonymized, aggregated insights from your data to improve algorithms and build platform features
• A license to share non-identifying operational parameters (location, job type, product model, price range) with integrated suppliers to facilitate product selection and logistics

You retain all other rights to your content.

5.1 How We Protect Your Data

• All data in transit is encrypted (TLS 1.2+)
• All data at rest is encrypted (AES-256)
• Access to customer data is restricted to authorized personnel only
• We conduct regular security audits and penetration testing
• We maintain comprehensive audit logs for data access

5.2 International Data Transfer

ISKAL is based in Slovenia (EU). If you are outside the EU, your data may be transferred to and processed in the EU under standard contractual clauses (SCCs) and GDPR adequacy agreements.

By using the platform, you consent to this transfer.

6.1 Who Has Access to Your Data

We use the following service providers:

• Cloud Infrastructure: [e.g., AWS, Digital Ocean] — for hosting and storage
• Email & Communication: [e.g., SendGrid, Mailgun] — for sending invoices and notifications
• Analytics: [e.g., Plausible, Fathom] — for aggregated, anonymized platform usage
• Payments: [e.g., Stripe] — for processing subscription billing

All service providers are bound by confidentiality agreements and process data only as instructed.

6.2 Suppliers

As described in Section 2.4, integrated suppliers may receive non-identifying operational data to optimize their services. We do not share your identity with suppliers unless you explicitly grant permission.

7.1 Prohibited Activities

You are strictly prohibited from:

• Automated scraping, crawling, or data extraction from the platform
• Feeding platform outputs, structured data, or aggregated insights into external AI models, competitors' systems, or third-party services
• Reproducing, copying, or distributing the platform's workflows, algorithms, or interface designs
• Using bots, scripts, or tools to bypass platform controls or extract data at scale
• Attempting to reverse-engineer the platform's code or logic

Violations will result in account suspension and may expose you to legal liability.

8.1 Acceptable Use

You agree to use the platform only for legitimate business purposes:

• Preparing professional quotes and scopes for your customers
• Managing customer enquiries and project workflows
• Improving your business operations

You agree not to:

• Use the platform to train competing software or AI systems
• Share your login credentials with other users or competitors
• Interfere with platform infrastructure or security
• Harass, spam, or contact other builders through the platform
• Violate any applicable laws or regulations

8.2 Service Availability

ISKAL aims to maintain 99.5% uptime, but we do not guarantee 100% availability. We are not liable for:

• Data loss due to your failure to backup your work
• Service interruptions due to maintenance, security updates, or infrastructure issues
• Lost revenue or business interruption caused by platform downtime

We will notify you of planned maintenance via email.

8.3 Limitation of Liability

ISKAL is provided "as-is." To the fullest extent permitted by law:

• We are not liable for indirect, incidental, special, or consequential damages
• Our total liability for any claim is limited to 12 months of fees you've paid
• We are not liable for third-party integrations, suppliers, or data loss from your own negligence

However: This limitation does not apply to claims involving personal data violations, fraud, or gross negligence.

8.4 Pricing & Billing

• Billing Cycle: Monthly, on the same date each month
• Payment Methods: Credit card via Stripe
• Failed Payments: After 3 failed attempts, your account will be suspended. We'll contact you to retry payment
• Refunds: No refunds for partial months. You can cancel anytime and service will continue until the end of your billing cycle
• Price Changes: We will notify you 30 days before any price increase. Founding members' pricing (30% discount) is locked for life

8.5 Cancellation

You can cancel your subscription at any time via your account dashboard or by emailing us. Your data will be retained for 12 months from cancellation, after which it will be deleted unless you request export.

8.6 Changes to This Policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. We'll notify you of material changes via email at least 30 days in advance. Your continued use of the platform after an update constitutes acceptance of the new terms.

• Data Privacy Questions: privacy@iskal.com
• Legal Inquiries: legal@iskal.com
• General Support: support@iskal.com
• Data Subject Requests (GDPR/UK GDPR): privacy@iskal.com — include "GDPR Request" in subject line

This policy and all use of the platform are governed by the laws of the European Union (GDPR) and Slovenia (local law).

Dispute Resolution:

1. We'll attempt to resolve disputes informally via email
2. If unresolved after 30 days, disputes may be escalated to mediation
3. Unresolved disputes may be brought before the courts of Slovenia