Privacy Policy

This Privacy Policy explains how Bullwork Automation (“Bullwork,” “we”) collects, uses, and protects information when you use our platform and websites (the “Service”).

1. Information we collect

Account information: name, company, email, and login credentials.
Business & financial data you enter: projects, estimates, invoices, bills, accounting records, and related documents.
Employee & payroll data: if you use payroll, you may enter employee information including names, pay rates, hours, and sensitive identifiers such as Social Security numbers and, where applicable, direct-deposit details, entered by you, as the employer, to run payroll.
Uploaded documents: receipts, plans, insurance certificates, and similar files.
Usage data: log and device information used to operate and secure the Service.

2. How we use information

We use your information to provide, maintain, secure, and improve the Service; to power features you use (including AI-assisted features); to process payments; and to communicate with you. We do not sell your personal information.

Improving accuracy with aggregated data. We use aggregated and de-identified data derived from how the Service is used, including cost, pricing, and estimating inputs, to improve the platform’s accuracy, cost data and benchmarks, and the quality of its AI features. This data is aggregated and stripped of anything that identifies you, your business, your clients, or your projects; it is never published or shared in a form that could identify you.

3. Service providers (sub-processors)

We use trusted third parties to operate the Service, including cloud hosting and database (Supabase), application hosting and analytics (Vercel), website analytics (Google Analytics), payment processing (Stripe), email delivery (Resend), and AI processing (Anthropic). When you use AI-assisted features, relevant content you submit (for example, an uploaded document or a question to the copilot) is processed by our AI provider to generate a response. These providers process data on our behalf under their own security and confidentiality commitments; we do not authorize them to use your data to train their models where their terms allow us to opt out.

4. Cookies & analytics

On our public website we use Vercel Web Analytics, a privacy-friendly, cookieless measurement tool that helps us understand traffic without tracking you across sites or storing identifying cookies.
We also use Google Analytics 4 (provided by Google) to measure how the site is used. It is enabled by default for U.S. visitors and configured for analytics only, with advertising and personalization signals turned off and IP anonymization enabled; we do not use it to sell or share your personal information. You can opt out at any time using the Cookie preferences link in the footer (or the notice shown on your first visit), and we honor Global Privacy Control (GPC) browser signals, treating them as a valid opt-out. You can also opt out of Google Analytics with Google’s opt-out browser add-on. California residents may treat opting out as exercising the “Do Not Sell or Share My Personal Information” choice. The product application itself does not run third-party advertising trackers.

5. How we protect data

Data is encrypted in transit. Access is restricted by tenant isolation (row-level security) and role-based permissions, so each organization’s data is segregated and sensitive records are limited to authorized roles. No system is perfectly secure, but we take commercially reasonable measures to protect your data and will notify affected customers of a data breach as required by applicable law.

6. Data retention

We retain your data for as long as your account is active and as needed to provide the Service and meet legal obligations. You can export your data at any time. After account termination, we delete or anonymize data within a reasonable period, except where retention is required by law.

7. Your rights (including California residents)

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to limit certain processing. California residents have rights under the CCPA/CPRA, including the right to know, delete, and not be discriminated against for exercising those rights. To make a request, contact us at the email below. Note that for employee data you enter as an employer, you are the controller of that data and responsible for your employees’ privacy rights.

8. Changes

We may update this Policy; material changes will be posted here with a new effective date.

9. Contact

Privacy questions or requests: hello@bullworkautomation.com.