Privacy
What we keep, and why
Short, because there is not much of it. The first part is about the website you are reading; the last is about the documents your firm puts into the product, and where they go.
The contact form
To write to us you first sign in with Microsoft or Google — a work, school or personal account. The provider tells us your name, your email address and the id of your account (and, from Microsoft, of its organisation), and nothing else: no password, no files, nothing from your organisation's directory. We keep those with your message, the company and phone if you gave them, and the message itself. The name and address on a message are the account's, not typed, so nobody can write to us in your name. We send an acknowledgement to that address — that a message arrived, and when, never what it said — so you have a record. One address, and one connection, may send us a few messages an hour. A message is deleted a year after we mark it answered, and we will delete it sooner if you ask. The sign-in lasts an hour in your browser and is then forgotten.
Signing up for a plan
Signing up works the same way: you sign in with Microsoft or Google first, and the name and address on a sign-up are the account's. We keep them with the plan you chose and what you told us — your firm, and your role, phone, how many people would sign in, which AI provider your firm uses and any notes, if you gave them — and send an acknowledgement to that address. Nothing is set up or billed from the form: it is how a conversation with us starts. A sign-up is deleted a year after we mark it answered, and we will delete it sooner if you ask.
Applicant accounts
Your name, email address, phone if you gave it, a hash of your password if you set one, and each application you submit: the position, your cover letter, a link if you gave one, and the résumé file. You can open the account by signing in with Microsoft or Google instead of a password; the provider then tells us your name and address and whether it has confirmed the address, and nothing else. The email address is confirmed before an application can be submitted: by the provider's word when it has confirmed it, otherwise with a one-time code. Applications are read by the people hiring for that position and nobody else.
You can delete the account, every application on it and every résumé file from your account page, at any time, with your password or a sign-in from the last fifteen minutes; the files go when the rows do. Otherwise: an application is deleted a year after the position was closed on it, résumé included, and an account with no applications left on it is deleted a year after it was last signed in to.
What we do not do
No advertising trackers, no analytics scripts, no third-party cookies. The one cookie this site sets is a session cookie so a form can carry a token and a signed-in applicant stays signed in.
The product itself
Documents your firm uploads are stored by us, on our hosting on Microsoft Azure, together with the projects and results made from them. Each firm's documents are kept in a store of their own, separate from every other firm's: the people at your firm can see them, and people at other firms cannot.
Who else receives what
We use these subprocessors, and only these. Each receives what it needs for its job and nothing more.
| Subprocessor | What it does | What it receives |
|---|---|---|
| Microsoft Azure | Hosts the service, keeps our secrets, sends the email the service sends | Your firm's files and database, on the platform's own encrypted disks; the addresses the service emails, and the scheduled reports your firm's admin chooses to have emailed |
| Anthropic, OpenAI or Google | Reads a document's prose — parties, clauses, comments, requirements | The passages of text needed to read it, and for a construction report the figures counted from your firm's Procore company. Which of the three is the one your firm connects with its own key, or the one behind the CivitasOPS key where your plan includes it and your firm chooses it |
| OpenAI or Google | Builds your firm's search index | The text of each document, in short passages |
Your firm reads on its own agreement with one of those providers by entering its own key: the provider then sees your text under your terms. On the Team and Premium plans your firm may instead choose the CivitasOPS key, and the provider behind it then sees your text under our agreement with that provider; the service names which. Either choice is recorded against the person at your firm who made it, and only a key's last four characters are ever shown again.
Where it is
One region: Microsoft Azure, West US 3, in the United States. Your firm's data does not leave it except for the model and search providers above, which are sent text, not files.
How long we keep it
A document you delete in the application is removed at once — its text, its search entries, its upload and anything a project read from it. If your firm cancels, its data is deleted within 30 days of asking, and backups age out within a further 14 days.
What we log
Who signed in and to which firm, and counts — documents analysed, questions asked — so a subscription can be metered and a problem can be traced. Never the contents of a document, its filename, or a project or client name. The account service that meters usage is told your firm's id and the counts, and nothing about the work.
Procore
A firm that connects its Procore company gives us the client ID and secret of an app its Procore admin installed. The secret is kept encrypted for that firm alone and used only to read what the admin granted the app: submittals, RFIs, commitments and the company directory. What a report reads is kept in the firm's own database. A scheduled report is emailed, with its PDF attached, only to people of that firm whom its admin chose.
Signing in
To run your firm's account we keep the name and email address of each person the firm adds. Each signs in with the Microsoft or Google account that holds that address, or with the email and a password of their own. When you sign in with Microsoft we are told your Microsoft tenant and account ids, your email and name, and whether Microsoft has verified the address; when you sign in with Google, Google's id for your account, your email and name, and whether Google has verified the address. Nothing else, and no password of yours. The contact form on this site asks everyone to sign in with Microsoft, through a separate registration, and is told the same things.
We do not sell your data. The questions an IT department usually asks next we answer in writing, under an NDA if your client requires one — ask through the contact page — and the terms of service put the commitments in writing.