Privacy Policy

This policy applies to the GenStruc web application and applies to visitors, account holders, and people whose information a customer uploads into a project workspace. The controller of this data is Cyrus Construction and Consulting Services LLC.

When you create an account we collect your email address, authentication credentials managed by our authentication provider, and, if you sign in with Google, the basic profile information that provider returns. We also store your role, plan, and workspace membership.

We store the project records you create: projects, activities and schedules, budgets and cost records, punch items, inspections, safety records, daily reports, and related metadata.

Files you upload — drawings, specifications, contracts, spreadsheets, PDFs, and other construction documents — are stored in our managed cloud storage. We extract text and structured content from these files so they can be searched, classified, linked to project records, and used to answer questions about your project.

Imported schedules (including .mpp, .xer, .xml, .csv, and .xlsx files) are parsed into activities, relationships, constraints, and baselines, and are stored with version history so changes can be compared over time.

Progress and site photos you upload are stored with the project record and any metadata contained in the file. Photos may be processed by AI to generate descriptions or classify content.

RFIs, submittals, comments, review records, status history, and attachments are stored as project records and may be processed by AI to draft responses, assess schedule impact, or flag risk.

The project directory stores contact details you enter about project participants, including names, companies, roles, email addresses, and phone numbers. This information is uploaded by you, and you are responsible for having the right to provide it.

To deliver AI features, relevant portions of your content — such as document text, schedule data, project records, and your prompts — are transmitted to third-party AI model providers through our AI gateway and processed to produce a response. We send only what is needed for the requested feature. AI outputs are generated content and may be inaccurate; see our Terms of Service.

We do not sell your data, and we do not use your Customer Data to train our own foundation models.

We collect operational logs necessary to run the service, such as request and error logs, authentication events, upload and parsing results, background job outcomes, and audit entries for administrative actions. These logs may include account identifiers, IP address, browser information, and timestamps.

Payments are processed by Stripe. Checkout, card entry, and payment authentication happen on Stripe's infrastructure — GenStruc never receives or stores your full card number. We store the subscription identifiers, plan, status, and billing period that Stripe returns so we can apply the correct entitlements to your account. Stripe's handling of payment data is governed by Stripe's own privacy policy.

Application data is stored in a managed PostgreSQL database and uploaded files are stored in managed object storage, both operated by our cloud infrastructure provider. Data is encrypted in transit using TLS and encrypted at rest by the storage provider. Access to project data is enforced at the database layer by row-level security policies tied to your account and workspace membership.

We rely on the following categories of subprocessors to operate the service:

• cloud application hosting and edge delivery;
• managed database, authentication, and file storage;
• AI model providers, accessed through our AI gateway;
• Stripe, for payments and subscription management;
• weather data services, for forecast and weather-risk features;
• transactional email delivery for authentication and notification messages.

A current subprocessor list is available on request at hello@genstruc.com.

We use authenticated access with session tokens, row-level security policies on customer tables, server-side authorization checks on privileged operations, scoped storage access rules, encrypted transport, and audit logging of administrative actions. No system is perfectly secure; we do not claim that unauthorized access is impossible.

We retain Customer Data for as long as your account is active. Operational logs and audit records are retained for a limited period for security and troubleshooting. Backups of the database are retained by our infrastructure provider on a rolling schedule and expire automatically.

You may request deletion of your account and associated project data by contacting us. On deletion we remove your account, project records, and uploaded files from active systems. Residual copies may persist in backups until those backups expire on their normal schedule.

We use cookies and browser local storage that are strictly necessary to operate the application: keeping you signed in, preserving your session, and remembering interface preferences. We do not use third-party advertising cookies.

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal information, or to object to certain processing. You can exercise these rights by contacting us; we will verify your identity before acting. Where GenStruc processes personal information on behalf of a customer, we will direct the request to that customer.

The service is intended for business use and is not directed to children under 16.

We may update this policy. We will revise the “Last updated” date and, for material changes, provide notice in the application or by email.

Privacy questions and rights requests: hello@genstruc.com. You can also reach us through our contact page.