Privacy Policy

Last updated: 25 October 2026

The short version

• We collect what we need to run the ContractorOS community and the ContractorOS app. We do not sell personal information.
• The app does not see your chats. When your AI app uses ContractorOS, it sends us only the request it is making, such as “find the RFI workflow”. We send back the workflow, template or company information it asked for.
• The app does not open your files. If you add a link to a document in Google Drive or SharePoint, we store the link. Your AI app opens the file with your own Google or Microsoft access.
• We do not use your company’s content to train AI models. The app does not send your company’s content to any AI model itself.
• To get a copy of your information, or to have it deleted, email [email protected].

Who we are

This policy covers the website at contractoros.build, the ContractorOS community on Skool and the ContractorOS app at app.contractoros.build.

ContractorOS is run by ContractorOS Group Limited, a New Zealand company (“ContractorOS”, “we” or “us”). Our address is 725 Back Ormond Road, RD 1, Gisborne 4071, New Zealand. We follow the New Zealand Privacy Act 2020 for all the personal information we hold.

Our privacy officer is Josh Turner, Director, at [email protected].

What we collect

When you visit the website

• Usage. Google Analytics shows us which pages people visit and which links they click. It records the pages you view, your device and browser, your approximate location and the site that sent you. It uses cookies.
• Enquiries. The custom work form asks for your name, email, company, role, the type of work you do, your country, team size, budget range and what you need help with. FormSubmit delivers the form to our team inbox, and Make copies it into our records.
• Bookings. If you book a call, Calendly collects your name, email and your answers to its questions.
• Emails you send us.

When you join the community

• Your Skool membership. Skool runs the community and takes payments through Stripe. We see your name, email, profile and membership status. We do not see your card details. Skool’s privacy policy covers what Skool collects.
• Member records. For each member we keep your name, email, membership status, join and leave dates, and notes from our conversations with you, such as onboarding notes and support messages.
• Calls. If you book a coaching call, we keep the booking. We may record calls and take notes with Gemini in Google Meet, and we keep the recording, transcript and notes. Google Meet shows everyone on the call when recording or note-taking is on.
• Newsletter. If you are on our email list, MailerLite holds your name and email and records whether you open or click our emails. Every email has an unsubscribe link.

When you use the ContractorOS app

• Your account. Your email, password, display name, and when you signed up and last signed in. Supabase stores the password as a one-way hash, so we cannot read it.
• Membership check. Every hour, the app copies your email, membership status and leave date from our member records to confirm that you are a current member.
• Your company’s content. Your company name, the business rules and project details that you or your AI app save, links to your documents, templates you upload (up to 10 MB each) and changes you make to workflows. The app also keeps the history of those changes so you can restore an earlier version.
• AI connections. Which AI apps you connected (for example Claude or ChatGPT), when you connected them and whether you disconnected them.
• Activity records. A log of changes made in your company account, such as creating a workflow or allowing an AI connection to edit. We use the log to show who changed what and to fix problems.
• Product analytics. PostHog shows us which parts of the app people use. It records the app pages opened, the set-up steps started, the tools your AI app calls, whether each call worked and how long it took, and which workflows and templates the app sent back. These records use account and company ID numbers instead of names or emails. They do not include your requests, documents, file names or links. PostHog receives your IP address when the app sends records, but its location lookup is switched off.
• Technical logs. Our hosting providers log requests to the app, including the IP address, browser type and the address requested. We use these logs for security and to fix faults.
• Set-up requests. When someone asks to set up an account, we keep a one-way code made from the email address for one day to stop repeat requests. We do not keep the email address itself.

What the app does not collect

• Your AI chats. Your AI provider (such as OpenAI, Anthropic or xAI) handles your conversations under your agreement with them.
• The contents of files you link to.
• Payment card details, government ID numbers or passwords for other services. Please do not put these in your company’s content or templates.

How we use it

• To run the community: manage memberships, give access to calls and the classroom, and support members.
• To run the app: check membership, sign you in, store and return your company’s content, and connect your AI apps.
• To reply to enquiries and book calls.
• To send our newsletter and community updates. You can unsubscribe at any time.
• To see which parts of the website, community and app people use, and to improve them.
• To keep ContractorOS secure, stop misuse and fix faults.
• To meet our legal, tax and accounting duties.

We do not sell personal information or share it for advertising.

If you are in the EU or UK, these are our legal reasons for using your information:

• The contract with you, to provide the membership and the app.
• Our legitimate interests: analytics, security, improving ContractorOS and replying to enquiries.
• Your consent, for the newsletter and for cookies where consent is needed.
• Legal obligations, for tax and accounting records.

Who we share it with

We use these service providers to run ContractorOS. Each provider handles information for us under its own security and privacy terms.

We also share information:

• With the AI apps you connect. A connected AI app gets your company’s workflows, templates and company information to use in your chats. You choose which apps to connect, and you can disconnect them in the app.
• With people in your company. People in your company account can see your company’s shared content.
• With the ContractorOS team, meaning the founders and the people who help run the community, so we can support you.
• When the law requires it, or to protect people’s safety or our rights.
• If ContractorOS is sold or reorganised. This policy would still apply to your information.

Where it is stored

Supabase stores the app’s database and uploaded files in Sydney, Australia. Our other providers, including the app host and app analytics, process information mainly in the United States. When information moves between countries, our providers’ contracts protect it, including standard contractual clauses where the law requires them.

How long we keep it

Your choices and rights

• See and change your company’s content in the app at any time.
• Disconnect an AI app on the app’s Account page.
• Unsubscribe from emails with the link in each one.
• Ask for a copy of your personal information, or ask us to correct or delete it, by emailing [email protected]. We will reply within 30 days. We may need to confirm who you are first.
• Turn off analytics. If you turn on Do Not Track or Global Privacy Control, the app stops sending analytics from your browser. That setting does not cover the records of tools your AI app calls, because those requests come from the AI app. For the website, block cookies or use Google’s opt-out add-on.
• Complain. Tell us first so we can fix the problem. You can also contact your privacy regulator, listed below.

Extra rights depending on where you live

• Canada. You can access and correct your information under PIPEDA, and complain to the Office of the Privacy Commissioner of Canada. In Quebec, the person responsible for personal information is our privacy officer, named under “Who we are”. You can complain to the Commission d’accès à l’information.
• Australia. We handle personal information in line with the Australian Privacy Principles. You can complain to the Office of the Australian Information Commissioner.
• New Zealand. You can access and correct your information under the Privacy Act 2020, and complain to the Office of the Privacy Commissioner. Some information, such as your membership status, reaches the app from our member records instead of from you. This policy tells you about that collection.
• EU and UK. You can access, correct or delete your information, restrict or object to how we use it, ask for a portable copy and withdraw consent at any time. You can complain to your local data protection authority, or to the ICO in the UK.
• California. We do not sell personal information or share it for cross-context behavioural advertising. In your browser, the app’s analytics respect Do Not Track and Global Privacy Control. The website’s Google Analytics does not respond to Do Not Track signals. Google may collect information about your activity across other websites that use Google Analytics.

Security

• We keep each company’s content separate, and only people in that company can see it.
• An AI app can connect only after you approve it. It cannot change your company’s saved content unless an owner allows editing for that connection.
• Our providers encrypt information in transit and when stored.
• Only the ContractorOS team has admin access.

We cannot guarantee that any system is completely secure. If a breach is likely to cause serious harm, we will tell the people affected and the regulators, as the law requires.

Cookies

• The website uses Google Analytics cookies. “Your choices and rights” explains how to turn them off.
• The app uses cookies to keep you signed in and to complete sign-in safely. The app needs these cookies to work. The app’s analytics do not use cookies.

Children

ContractorOS is for people who run or work in construction businesses. It is not for anyone under 18, and we do not knowingly collect information from children.

Changes to this policy

When this policy changes, we will update the date at the top. If we make a significant change, we will tell members by email or in the community before the change applies.

Contact

Email [email protected] or write to ContractorOS Group Limited, 725 Back Ormond Road, RD 1, Gisborne 4071, New Zealand.