Privacy Policy

1Scope and our privacy roles

This Privacy Policy applies to APARBooks Technologies Inc. (“APARBooks,” “we,” “us,” or “our”) and to personal information processed through our websites, web application, construction accounting platform, customer and owner portals, document-processing features, integrations, support, and related services (collectively, the “Services”).

A customer may be a general contractor, subcontractor, project owner, developer, construction manager, accountant, bookkeeper, or another organization using the Services. “Customer Content” means data, records, documents, messages, and files submitted to or generated within a customer account.

This Privacy Policy does not replace a customer’s own privacy notice and does not govern how a customer independently uses information exported from APARBooks.

2Notice at collection

At or before collection, APARBooks may collect the categories of personal information summarized below. We use this information to provide and secure the Services; administer accounts and subscriptions; process construction and accounting records; provide integrations, support, and communications; comply with law; and improve our user-facing products.

• Identifiers and contact information: name, email address, telephone number, business address, account identifiers, IP address, and integration identifiers.
• Professional and organization information: company, role, team, permissions, project relationships, and business contact information.
• Commercial, subscription, and support information: plan, purchases, invoices, support requests, product usage, and communications.
• Financial and construction records: project budgets, cost codes, estimates, contracts, subcontracts, purchase orders, bills, invoices, pay applications, retainage, change orders, transaction records, payment status, and related documents.
• Internet and device activity: browser, device, log, cookie, session, and interaction information.
• Customer Content and communications: documents, attachments, images, comments, mentions, email, SMS/MMS content, and files selected from connected services such as Google Drive.
• Sensitive personal information: only where provided or necessary, such as account credentials, financial account information, contents of communications, tax documents, or other sensitive data contained in Customer Content.

We retain information according to the criteria in Section 14. We do not sell Customer Content or Google user data. Public-website advertising or analytics cookies, if enabled, may be treated as “sharing,” “sale,” or targeted advertising under certain laws; available opt-out methods are described in Section 13.

3Information we collect

Information you provide directly

• Account registration information, including your name, email, telephone number, company name, job title, password or authentication information, and preferences.
• Subscription and billing contact information, purchase history, invoice details, and transaction status.
• Support requests, product feedback, survey responses, demo requests, and other communications.
• Documents, images, spreadsheets, PDFs, and other content you upload or import.
• Information provided when you invite team members, owners, accountants, vendors, subcontractors, or other users.

Information collected automatically

• IP address, browser type, device type, operating system, language, referring URL, and approximate location derived from IP address.
• Login time, session activity, pages or features viewed, actions taken, error logs, audit logs, and security events.
• Cookie, local storage, analytics, and similar technology data, subject to available consent and opt-out controls.

Information from integrations and third parties

• Identity and file information from services you choose to connect, including Google Drive.
• Payment status and limited payment-method metadata from payment processors.
• Delivery, routing, and message metadata from email and telecommunications providers.
• Information supplied by your organization, an account administrator, a referral partner, or another authorized user.

Information we generally do not require

APARBooks is not designed to collect biometric identifiers, precise geolocation, medical records, consumer credit reports, or information about children. Do not upload such information unless it is reasonably necessary for a legitimate business purpose and you are authorized to do so.

4Construction and accounting data

Because APARBooks is a construction accounting and project financial management platform, Customer Content may include:

• Project names, project addresses, owners, clients, vendors, subcontractors, employees, consultants, and other project contacts.
• Estimates, budgets, cost codes and cost items, commitments, purchase orders, subcontracts, schedule-of-values records, and job cost information.
• Vendor bills, owner invoices, AIA-style pay applications, progress billings, retainage, reimbursements, change orders, payment requests, checks, and transaction records.
• Contracts, lien waivers, insurance certificates, W-9s, receipts, photos, supporting files, and other documents selected by the customer.
• Approval history, comments, @mentions, activity logs, user roles, and record-level audit information.

Customers are responsible for determining whether they have a lawful basis and appropriate authorization to submit personal information about employees, project owners, clients, vendors, subcontractors, and other individuals. Customers should limit uploads to information reasonably necessary for construction accounting, project administration, payment, compliance, or recordkeeping.

APARBooks does not independently determine the accuracy, legality, or completeness of Customer Content. Customers and authorized users are responsible for reviewing financial records, extracted document fields, permissions, approvals, and reports before relying on them.

5Sources of personal information

We may obtain personal information from:

• You directly;
• Your employer, customer organization, or account administrator;
• Other authorized users who invite you or enter your information;
• Connected services and integrations you authorize;
• Payment, communications, hosting, analytics, and security providers;
• Publicly available business sources and professional referrals; and
• Automatic collection through the Services and our websites.

6How we use personal information

We may use personal information to:

• Create, authenticate, administer, and secure user and customer accounts.
• Provide construction accounting, project financial management, document storage, reporting, approval, payment-status, and portal features.
• Process files, extract document information, create records, and associate documents with projects, bills, invoices, contracts, change orders, and other customer-selected records.
• Manage subscriptions, invoicing, payments, renewals, and account status.
• Deliver transactional email, SMS/MMS, alerts, reminders, and service communications.
• Provide demos, onboarding, training, support, and customer success services.
• Monitor performance, troubleshoot errors, prevent fraud, detect abuse, investigate security events, and maintain audit logs.
• Analyze and improve user-facing features, usability, reliability, and product performance.
• Comply with legal obligations, enforce agreements, protect rights and safety, and respond to lawful requests.
• Send product or marketing communications where permitted by law; recipients may unsubscribe from marketing communications at any time.

Legal bases for users in the EEA, United Kingdom, or Switzerland

Where applicable, our legal bases may include performing a contract, taking steps requested before entering a contract, complying with legal obligations, pursuing legitimate interests that are not overridden by your rights, and consent. Where processing is based on consent, you may withdraw consent without affecting processing that occurred before withdrawal.

7Google Drive integration and Google user data

Google information we may access

When you connect a Google account or select a Google Drive file, we may receive:

• Your Google account identifier, email address, and basic authentication information made available through the openid and email scopes;
• OAuth access credentials and, where applicable, refresh credentials needed to maintain the connection;
• Metadata for files you explicitly select, such as file name, Google file ID, MIME type, size, ownership or permission information, and modification date; and
• The contents of files you explicitly select or authorize for use with APARBooks.

How APARBooks uses Google user data

We use Google user data only to:

• Authenticate and maintain the connection you request;
• Display the Google file picker and files available to select;
• Retrieve and import files you explicitly select;
• Attach imported files to the APARBooks project, bill, invoice, contract, change order, payment, or other record you designate;
• Provide support, troubleshoot the integration, prevent abuse, and maintain security; and
• Comply with applicable law and enforce our agreements.

Storage of imported Google Drive files

When you import a selected Google Drive file, APARBooks may download and store a separate copy in cloud storage used to provide the Services. The original remains in your Google Drive account. Changes to or deletion of the original Google Drive file may not automatically update or delete the APARBooks copy.

Disconnecting Google Drive or revoking Google permissions stops future access through the revoked credentials, but it does not automatically delete files already imported into APARBooks. Imported files remain subject to the same permissions, retention, deletion, backup, legal-hold, and contractual rules as other Customer Content.

Sharing, advertising, and human access restrictions

• We do not sell Google user data.
• We do not use Google user data for advertising, cross-context behavioral advertising, creditworthiness, lending, or unrelated profiling.
• We do not use Google user data to train general-purpose artificial intelligence or machine-learning models.
• We disclose Google user data only to service providers that process it for the user-facing integration, hosting, security, support, or legal compliance, subject to appropriate contractual restrictions.
• APARBooks personnel may access file contents only when reasonably necessary to provide user-requested support, investigate security or abuse, comply with law, or perform internal operations using aggregated or de-identified information.
• Authorized users within your customer organization may access imported files according to roles and permissions configured by the organization.

Disconnecting and deleting Google information

You may revoke APARBooks’ access through your Google Account’s third-party access settings or through an APARBooks disconnect control where available. When access is revoked or no longer needed, APARBooks will stop using the affected credentials and will delete or invalidate stored OAuth credentials, subject to limited security, legal, and backup retention.

To delete a file previously imported into APARBooks, use the applicable deletion controls in the Services or contact us. Deletion may be restricted by organization permissions, legal holds, accounting-record requirements, unresolved disputes, or customer instructions.

8OCR, AI-assisted, and automated document processing

APARBooks may use optical character recognition, document intelligence, rules-based automation, and machine-learning services to extract information from invoices, bills, contracts, receipts, and other documents selected by a customer. Extracted information may include vendor or customer names, invoice numbers, dates, amounts, line items, and other document fields.

We may transmit selected documents to contracted cloud or document processing providers acting on our behalf. These providers are permitted to process information only to provide contracted services, maintain security, and comply with law, and not for their independent advertising purposes.

Automated extraction can be incomplete or inaccurate. APARBooks users must review extracted fields, accounting classifications, amounts, approvals, and reports before posting, paying, submitting, or otherwise relying on them.

APARBooks does not use automated processing described in this section to make decisions that produce legal or similarly significant effects about individuals. If we introduce such functionality, we will provide any notices and controls required by applicable law.

9Payments and financial information

Subscription payments and certain customer payment features may be processed by third-party payment providers such as Stripe. Payment providers may collect card, bank account, ACH, billing address, identity verification, and other information under their own privacy notices and contractual obligations.

APARBooks may receive limited payment-related information, such as customer and transaction identifiers, payment status, payment method type, last four digits, billing contact, amount, currency, and dispute or refund status. We generally do not store complete payment card numbers.

Financial records entered or uploaded by customers—including bills, invoices, checks, bank-related records, tax forms, and payment details—are Customer Content and are processed according to customer instructions and applicable law.

10Email, SMS, MMS, and service communications

We may collect and process email addresses, telephone numbers, message content, attachments, delivery status, carrier information, timestamps, and routing metadata when users communicate with APARBooks or use messaging features.

Messages may include invoices, receipts, photos, project documents, alerts, authentication messages, reminders, and support communications. Communications providers may process this information on our behalf.

You may opt out of marketing email through the unsubscribe link in the message. You may opt out of recurring promotional text messages by replying STOP, where applicable. Opting out of marketing does not prevent necessary account, security, transaction, or service messages.

Mobile information, text-message originator opt-in data, and consent are not sold or shared with third parties or affiliates for their independent marketing or promotional purposes. We may disclose such information to communications providers and other service providers solely to deliver and support the requested messaging service.

11Cookies and online tracking

APARBooks and service providers may use cookies, pixels, local storage, SDKs, and similar technologies on our public websites and Services.

You can control cookies through our consent or cookie-preference tool where available and through your browser settings. Disabling some cookies may affect functionality.

Global Privacy Control and Do Not Track

Where required by applicable law, we treat a recognized Global Privacy Control signal as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal. Because there is no universally accepted standard for other “Do Not Track” signals, we may not respond to those signals unless required by law.

12How we disclose personal information

We may disclose personal information to the following recipients:

Customer organizations and authorized users

Information may be visible to organization administrators, team members, owners, accountants, bookkeepers, vendors, subcontractors, clients, and other users according to customer-configured roles, permissions, invitations, and sharing settings.

Service providers and subprocessors

We may use service providers for cloud hosting, storage, backups, security, logging, email, telecommunications, payment processing, document processing, analytics, customer support, and business operations. Examples may include Microsoft Azure, Amazon Web Services, Stripe, Google, Telnyx, and other providers used to operate the Services. Providers may process information only for contracted purposes and subject to applicable confidentiality and data protection obligations.

Professional advisers

We may disclose information to attorneys, accountants, auditors, insurers, financing sources, and other professional advisers where reasonably necessary and subject to confidentiality obligations.

Legal, safety, and security disclosures

We may disclose information if we reasonably believe disclosure is required by law, subpoena, court order, or legal process; necessary to protect rights, property, safety, or security; or appropriate to investigate fraud, abuse, security incidents, or violations of our agreements.

Corporate transactions

Information may be disclosed in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, due diligence, or similar transaction. A recipient may continue to process information subject to this Privacy Policy unless users are notified otherwise.

At your direction or with consent

We may disclose information when you or your customer organization directs us to do so, enables an integration, invites another user, or otherwise consents.

Aggregated or de-identified information

We may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to an individual, and we will not attempt to reidentify it except as permitted by law to test our de-identification processes.

13Sale, sharing, targeted advertising, and data use restrictions

• Customer Content: We do not sell Customer Content and do not use it for third-party advertising.
• Google user data: We do not sell Google user data or use it for advertising.
• SMS consent data: We do not sell or share mobile opt-in or consent data for third-party marketing.
• Public website data: If APARBooks enables advertising pixels or similar technologies, disclosure of identifiers and internet activity to advertising partners may be considered “sharing,” “sale,” or targeted advertising under some privacy laws, even when no money is exchanged.

Where applicable, you may opt out through our cookie-preference tool, a “Do Not Sell or Share My Personal Information” link, a recognized Global Privacy Control signal, or by contacting us. We do not knowingly sell or share personal information of individuals under 16 years of age.

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about individuals. If our practices change in a way that creates a right to limit such use, we will provide the required notice and control.

14Data retention

We retain personal information only for as long as reasonably necessary and proportionate for the purposes described in this Privacy Policy, as directed by a customer, or as required by law. Retention depends on the type of information, sensitivity, business need, customer contract, account status, security needs, disputes, legal holds, and applicable accounting, tax, and recordkeeping obligations.

Deletion from active systems may not immediately remove information from encrypted backups. Backup copies are isolated from ordinary use and are deleted or overwritten according to backup cycles, unless a legal hold or security need requires longer retention.

15Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system and risk, safeguards may include access controls, authentication, encryption in transit and at rest, network protections, logging, backups, vendor reviews, least-privilege access, and incident response procedures.

We restrict employee and contractor access based on role and business need. Service providers that process personal information on our behalf are expected to protect it and use it only for authorized purposes.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Users are responsible for protecting credentials, using appropriate account permissions, maintaining secure devices, and notifying us promptly of suspected unauthorized access.

If we become aware of a security incident affecting personal information, we will investigate and provide notices to customers, individuals, regulators, or others as required by applicable law and contractual obligations.

16Customer controls, organization administrators, and permissions

Customer organizations control many aspects of information within their accounts, including:

• Who is invited and authorized to access the account;
• User roles, project access, approval permissions, and portal access;
• Which records, files, and integrations users may access;
• Whether information is shared with owners, clients, vendors, subcontractors, or accountants;
• Record retention, export, correction, and deletion, subject to the Services and law; and
• Whether an individual remains an authorized user.

Organization administrators may access, review, export, correct, restrict, or delete information associated with managed accounts. They may also suspend or terminate user access. If you use an account provided by an employer or other organization, that organization’s administrator—not APARBooks—may control your account and Customer Content.

17Privacy rights and choices

Depending on your location, the nature of our relationship, and applicable law, you may have the right to:

• Confirm whether we process your personal information;
• Access or obtain a copy of personal information;
• Correct inaccurate personal information;
• Delete personal information, subject to exceptions;
• Obtain portable data in a usable format;
• Opt out of sale, sharing, targeted advertising, or certain profiling;
• Limit certain uses of sensitive personal information;
• Withdraw consent where processing is based on consent;
• Object to or restrict certain processing;
• Appeal a decision on a privacy request where applicable; and
• Receive equal service and not be unlawfully discriminated against for exercising privacy rights.

How to submit a request

Email support@aparbooks.com with the subject line “Privacy Request.” Describe the right you wish to exercise, the APARBooks account or organization involved, and enough information for us to locate the relevant records.

We may verify your identity or authority before completing a request. Verification may require confirmation through your email address, account, organization administrator, or other reasonable means. We will use verification information only for verification, security, fraud prevention, and compliance.

An authorized agent may submit a request where allowed by law. We may require proof of authorization and may ask you to verify your identity directly. Some requests may be denied or limited when an exception applies, including where retention is required for security, accounting, legal compliance, contracts, disputes, or the rights of others.

Customer-controlled information

If APARBooks processes your information solely on behalf of a customer, we may refer your request to that customer or require the customer’s instructions before taking action.

Marketing choices

You may unsubscribe from marketing email using the link in the message. You may opt out of applicable promotional texts by replying STOP. You may manage cookies through the controls described in Section 11.

18California privacy disclosures

This section applies to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to APARBooks’ processing as a “business.” It does not convert APARBooks into a business for Customer Content that we process solely as a service provider or contractor.

The following table summarizes categories of personal information that APARBooks may have collected during the preceding 12 months. Actual collection depends on how an individual interacts with us.

California rights

Subject to applicable limitations, California residents may request to know, access, correct, or delete personal information; obtain information about categories, sources, purposes, and recipients; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive non-discriminatory treatment.

Shine the Light

California residents may request certain information about disclosures of personal information to third parties for their own direct marketing purposes, where applicable. APARBooks does not disclose Customer Content or Google user data to third parties for those third parties’ own direct marketing.

Metrics and financial incentives

APARBooks does not currently offer a financial incentive in exchange for personal information. If we introduce one, we will provide a separate notice describing the material terms and the method used to calculate the value of the information.

19International users and data transfers

APARBooks is based in the United States. Personal information may be processed in the United States and other countries where APARBooks, customers, or service providers operate. Those countries may have privacy laws that differ from the laws of your location.

Where required, we use lawful transfer mechanisms and appropriate safeguards, which may include contractual protections such as standard contractual clauses, vendor data protection agreements, access controls, and security measures.

Individuals in the European Economic Area, United Kingdom, or Switzerland may have rights to access, correct, erase, restrict, or object to processing; receive portable data; withdraw consent; and lodge a complaint with a competent supervisory authority.

20Children’s privacy

The Services are business products and are not directed to children. Users must be at least 18 years old or the age of legal majority required to enter a binding business agreement in their jurisdiction.

We do not knowingly collect personal information directly from children under 13. If we learn that we collected such information without legally valid authorization, we will take reasonable steps to delete it. Contact us if you believe a child has provided personal information to APARBooks.

21Third-party services, websites, and integrations

The Services may link to or integrate with third-party services. Your use of a third-party service may be governed by that provider’s privacy policy and terms. APARBooks is not responsible for third-party privacy practices that occur outside our control.

Enabling an integration authorizes APARBooks and the provider to exchange the information required for the requested functionality. Review the integration permissions before connecting it. You may disconnect integrations through available account controls or the third party’s authorization settings.

22Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, data practices, laws, or business operations. The “Last updated” date shows when the policy was most recently revised.

If a change materially affects how we use personal information, we will provide additional notice where required, such as through the Services, by email, or on our website. Continued use of the Services after an update is subject to the revised policy, except where affirmative consent is required by law.

23Contact us

For privacy questions, rights requests, complaints, or concerns, contact:

We will respond within the period required by applicable law. If you are not satisfied with our response and your local law provides an appeal right, reply to our decision with the subject line “Privacy Appeal.”