SmartGrants Costimate
SmartGrantsPowered by SmartGrants

Privacy Policy

Last updated: 12 July 2026

1. Who we are

SmartGrants Costimate is operated by Solutions Intelligentes SmartGrants Sougou Inc. ("SmartGrants", "we", "us"), a corporation registered in Canada, with registered address 129 Lerta Way, Orleans, ON, Canada. SmartGrants Costimate ("the Platform") is the AI-powered construction cost estimation service.

For data submitted by customers (their account information, company details and project content), SmartGrants is the data controller. For plans and project data that a customer uploads and processes through the Platform, the customer is the controller and SmartGrants acts as a processor.

Contact: privacy@smartgrants.io · 129 Lerta Way, Orleans, ON, Canada.

2. Scope of this Policy

This Policy applies when:

  • you visit our marketing website;
  • you create an account, start on the Free tier, or pay for a subscription;
  • you upload plans, specifications or other project data to the Platform;
  • you use the Platform to generate cost estimates and export professional reports.

3. Personal data we process

3.1 Data you give us directly

  • Account data: name, work email, company, password (hashed).
  • Billing data: billing contact, address, tax identifiers and transaction history (full card numbers are held by our PCI-compliant payment processor, Stripe, not by SmartGrants).
  • Project data: project details, uploaded plans (PDF/image), specifications and estimator preferences.
  • Communications: messages you send us via email or support.

3.2 Data processed on your behalf

  • Plan content: the architectural plans and specifications you upload for AI analysis.
  • Generated estimates: the bill of quantities, unit prices and totals produced by the estimator.
  • Workflow metadata: execution logs, versioning, and audit entries.

4. How and why we use personal data

  • Provide the Platform — account provisioning, hosting, support, billing. Legal basis: performance of contract.
  • AI plan analysis — read your uploaded plans and generate a phase-by-phase bill of quantities. Legal basis: performance of contract.
  • Regional pricing — apply market-specific unit prices to produce region-aware estimates. Legal basis: performance of contract.
  • Security, fraud prevention, audit logging — legitimate interests.
  • Billing, accounting, tax compliance — legal obligation.
  • Marketing about our own services — consent or legitimate interests with opt-out.

5. How we use Artificial Intelligence

5.1 What AI does on the Platform

  • Plan reading: our AI models read your uploaded plans, extract specifications, and produce a structured takeoff.
  • Estimate generation: the AI applies regional unit-price data to produce a professional bill of quantities.

5.2 What AI does NOT do

  • No training on your data. Content sent to our AI providers via commercial APIs is not used to train their foundation models — this is the contractual default of the commercial tiers we use.
  • No data sales. We do not sell personal data and do not share it for cross-context behavioural advertising.

6. Who we share personal data with

  • Sub-processors: Supabase (database and authentication), Cloudflare (edge hosting), Anthropic and other AI providers (plan analysis), Stripe (payments).
  • Professional advisers under duties of confidentiality.
  • Authorities where required by law or court order. We notify the affected customer where lawful.
  • Corporate transactions in connection with a merger, financing or sale, subject to confidentiality and continuity of this Policy.

7. International data transfers

Personal data may be processed in Canada (SmartGrants operations) and the United States (Anthropic, Stripe, Cloudflare and Supabase as applicable). For EEA/UK transfers we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, plus technical and organisational safeguards (encryption, access control, audit logging).

8. Data retention

  • Active accounts: data is retained for the duration of your subscription.
  • After termination: customer data is returned or deleted within 60 days, except where retention is required by law (accounting, tax).
  • AI provider retention: commercial API providers retain inputs/outputs for a limited period in line with their terms (typically up to 30 days).
  • Billing records: retained as required by applicable tax law (typically 6–10 years).

9. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, Quebec Law 25, PIPEDA, CPRA), you have rights to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent. To exercise any of these rights, contact privacy@smartgrants.io.

10. Security

We apply industry-standard safeguards: TLS in transit, encryption at rest, Row-Level Security for tenant isolation, audit logging and continuous vulnerability scanning.

11. Cookies

See our Cookie Policy.

12. Changes to this Policy

We will post material changes on this page and notify customers by email at least 14 days before they take effect.

13. Contact

Questions about this Policy or our processing: privacy@smartgrants.io.