Privacy Policy — FieldPE

Last updated: 2026-09-20. This policy is unchanged from the 2026-09-19 version; it carries today's date because it is accepted together with the Terms of Service, which changed.

1. Scope and our role

This policy covers FieldPE (the "Service"), operated by Kashi LLC, a Florida limited liability company ("we", "us"), and the data it handles for the companies that subscribe to it ("Customers") and the people they authorize to use it ("Authorized Users").

Two different roles apply, and the distinction decides who answers a data-subject request:

For account data — the names and email addresses of Authorized Users, billing contacts, audit records of who did what in the Service — we act as a controller. We decide what to collect and why.
For project data — everything read from a Customer's Procore project, the correspondence routed in, the documents uploaded, and the drafts produced from them — we act as a processor on the Customer's instructions. The Customer is the controller. If you are an Authorized User, a project owner, an architect, or a subcontractor whose details appear in a Customer's project, direct your request to that Customer; we will assist them in answering it.

2. What we collect

Account identity. Name and email address from your Google or Microsoft sign-in. Signing in requests basic profile and email only — not your mailbox, files, or calendar. We never receive your password.

Mailbox connection (optional, and only if you choose it). Separately from signing in, an Authorized User may connect their mailbox. What we receive depends on what they connect:

Gmail — sending only. Permission to send email as you (Google scope https://www.googleapis.com/auth/gmail.send). We use it only to send the messages you review and choose to send from the Service, such as review comments to a subcontractor. This permission does not allow us to read, change, or delete your Gmail messages.
Outlook / Microsoft 365 — reading and sending. Permission to read your mailbox (Mail.Read) and to send as you (Mail.Send). The read permission Microsoft grants covers the whole mailbox. To find project correspondence, the Service periodically retrieves the sender, subject, and a short preview of recent messages, and handles them as described under "Correspondence routed in" below. The Service does not mark mail as read, move it, or delete it, and it sends only the messages you choose to send from the Service.

Either connection gives us an OAuth token, encrypted at rest, which you can revoke at any time from the Service's account menu, which deletes the stored permission, or from your Google or Microsoft account settings.

Procore connection. When an Authorized User connects Procore, we receive an OAuth token that lets the Service act as that person. We never see the Procore password. The token is encrypted at rest and can be revoked by the user at any time from Procore or from the Service.

Project data. Through the connected Procore account and limited to what that account can already see: project directory contacts, drawings, specifications, RFIs, submittals, change events, and related records.

Correspondence routed in. Emails and attachments that reach an Authorized User's FieldPE address — sent there directly, forwarded by the user or a mail rule they set up, or copied there by a routing rule their email administrator configures — and, for connected Outlook mailboxes, messages retrieved from that mailbox. These are typically subcontractor proposals, submittal packages, and replies, and frequently contain third-party business contact details.

The Service is designed to draft only from messages whose sender is in the Customer's Procore project directory, works at a company that is, or is an Authorized User of that Customer. Other messages are not drafted and are not added to project records, though operational logs may record their subject line. If the Customer's project directory is empty or cannot be retrieved, the Service may draft from a message without that check; every draft still waits for a person's review before anything is issued or sent. When an Authorized User sets up Gmail forwarding, Gmail's forwarding confirmation code sent to their FieldPE address is recorded so the Service can show it to that user.

Documents uploaded. Drawings, specifications, proposals, contract provisions, and trade templates a Customer chooses to upload.

Billing data. Company name, billing contact, subscription tier and status. Payment card details are collected by our payment processor on its own systems and never reach ours.

Operational records. Request paths, timings, error diagnostics, and an audit log of administrative changes. Error records are designed to capture the exception *type* and not its arguments, because a third-party error message can carry an address or a token in it.

3. What we do not collect

The Service is a business tool for construction project administration. It is not designed for and must not be used to process special categories of personal data — health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation — nor payment card numbers, government identifiers, or criminal records. Customers must not upload such material, and are responsible for any they do.

4. Why we process it

We process data to provide the Service and for nothing else: to identify who is signed in, to find subcontractor mail in a connected Outlook mailbox, to route an inbound message to the right project and person, to ground drafts in the Customer's own drawings and specifications, to produce those drafts, to create them as unissued drafts in the Customer's Procore project, to file or issue them once a person approves them, to send the messages an Authorized User approves — from their own mailbox if connected, otherwise from the Service's address in their name — to bill the subscription, to keep the Service secure and working, and to comply with law.

4a. Google user data

FieldPE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data obtained through Google APIs — your Google sign-in identity and, if you connect Gmail, the permission to send email as you — is used only to provide and improve the user-facing features described in this policy. It is not used for advertising, is not sold, is not transferred to others except as needed to provide the Service or as required by law, is not used to train any AI or machine-learning model, and is not read by people except with your consent, for security purposes, or where the law requires.

5. AI processing, and our position on training

To produce a draft, project text and images relevant to that draft are sent to a third-party AI provider for inference.

Customer data is never used to train any model — not ours, and not a provider's. Our AI provider's commercial terms prohibit it from training on content submitted through its API. The provider may retain submitted content for a limited period under its own policies, for example for abuse and safety monitoring. Aggregated operational statistics that cannot identify a Customer, a person, or a project may be used to run and improve the Service.

To route mail better over time, the Service remembers corrections a Customer's team makes — for example, which project a given sender's messages belong to — within that Customer's workspace only. These are stored as settings for that Customer and are not used to train any model.

The Service may create drafts in a Customer's Procore project automatically. A draft is not issued or sent to anyone: every draft is reviewed by a person before it is issued or sent. The Service performs no automated decision-making that produces legal or similarly significant effects on any individual.

6. Service providers

We use the following providers to operate the Service. Each is engaged under its own commercial terms, which include confidentiality and security commitments.

Anthropic — AI inference for drafting. Processes project text and images. United States.
Procore Technologies — the Customer's own construction platform, connected by the Customer. Source and destination of project records. United States.
Supabase — managed Postgres database and file storage. Holds project records, documents, and account data.
Railway — application hosting and compute, including application storage that can hold project documents and working files. United States.
Resend — outbound and inbound email delivery. Processes message content and addresses.
Stripe — subscription billing and payment processing. Processes billing contact details and payment methods; we do not receive card numbers.
Google — sign-in identity and, if the Authorized User connects Gmail, sending email as that user. United States.
Microsoft — sign-in identity and, if the Authorized User connects Outlook, reading their mailbox and sending email as that user. United States.
Sentry — error monitoring. Receives error diagnostics labelled with the Customer's workspace identifier; it is configured not to receive the individual user, document contents, or message contents. United States.
Cloudflare — domain name service for our domains, and delivery of a script library used by our public website.

We will update this list before a new provider begins processing project data.

Beyond these, data is disclosed only where legally compelled, or in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to the data transferred. Where we are lawfully able to, we will notify the affected Customer before disclosing their data in response to legal process.

7. International transfers

The Service and its providers are primarily hosted in the United States. Data from other regions is transferred there.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect the data we handle, including:

Tenant isolation in the database. Every record carries the company it belongs to, and Postgres row-level security is applied in addition to application checks, so that a query for another company's data returns nothing.
Credentials encrypted at rest with authenticated encryption. They are never displayed back in any interface; the console shows whether a credential is set, never what it is.
Encrypted traffic and signed sessions. The Service is served over HTTPS, sessions are signed and time-limited, and standard security response headers including a content security policy are applied.
Least-privilege access. The application's database role cannot alter schema. Cross-tenant administrative access is restricted to a small operator list held in deployment configuration rather than in the database, so that no customer administrator can grant it to themselves.
Audited administrative changes. Changes to membership, roles, and connections are recorded with who made them and when.

No system is perfectly secure, and we cannot guarantee the security of data. Customers and Authorized Users are responsible for safeguarding their own accounts, devices, and identity providers.

9. Breach notification

If we become aware of a personal data breach affecting a Customer's data, we will notify that Customer without undue delay and within any period required by applicable law, with what we know about the nature of the breach, the categories and approximate volume of data involved, the likely consequences, and the steps taken. Where we act as processor, notice goes to the Customer as controller so they can meet their own regulatory obligations.

10. Retention and deletion

Account data is retained while the workspace is active, and afterwards for as long as needed to allow export and reinstatement, resolve disputes, and meet legal, accounting, and security obligations.
Project data, documents, and drafts are retained while the workspace is active and deleted when the Customer requests deletion of the workspace. Extracted document text may be cached to speed up drafting and is deleted with the record it came from.
Mailbox and Procore connections are deleted when the user disconnects them.
Gmail forwarding confirmation codes are shown to the user for seven (7) days and are kept with the audit log.
Audit records are retained for as long as needed to answer questions about past administrative activity and to meet security and legal obligations. They record who did what and do not contain document contents or credentials.
Billing records are retained as long as tax and accounting law requires.

A Customer administrator may request deletion of the workspace at any time by writing to the address below. Once we have confirmed the request, deletion is permanent, removes project records, documents, drafts, and stored credentials, and cannot be reversed. Residual copies in logs or in any backup or recovery systems are removed as those copies expire in the ordinary course.

11. Your rights

Depending on where you are, you may have the right to access the personal data we hold about you, to correct it, to delete it, to obtain a portable copy, to restrict or object to processing, and to complain to a supervisory authority.

Authorized Users may exercise these rights over their account data by writing to the address below.
Anyone whose details appear in a Customer's project data should contact that Customer, who controls it. We will assist the Customer in responding.
Customers may request an export or deletion of their entire workspace by writing to the address below from an administrator account. We will verify the request and respond within a reasonable time and within any period required by law.

We may need to verify your identity before acting on a request. We will not discriminate against anyone for exercising these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We have not done so in the preceding twelve months.

12. Cookies

The Service sets a single signed session cookie so that you stay signed in. It is necessary for the Service to function, is not used for advertising or cross-site tracking, and expires when the session does. The public marketing pages set no analytics or advertising cookies. They load a script library from Cloudflare's content-delivery network, which receives your IP address and browser details in order to serve it.

13. Children

The Service is a business tool, is not directed to anyone under 18, and does not knowingly collect data from children.

14. Changes and contact

We may update this policy. We will post the updated version here with a new date, and for material changes we will notify workspace administrators before they take effect.

Questions, data requests, or privacy concerns: hello@capstones.ai.