Effective Date · September 14, 2026

Estimado AI LLC ("Estimado AI," "we," "us," or "our") respects your privacy. This Privacy Notice explains how we collect, use, share, and protect information when you use our website at estimado.com and our AI-assisted construction estimating platform, applications, APIs, and related services (collectively, the "Service").

This Notice applies to information about: (a) users of the Service (typically construction professionals), (b) third parties whose information appears in content users upload (for example, customers, property owners, architects, or individuals depicted in photographs or video), and (c) consumers or homeowners who use a project-intake, remote-scan, Drive Score, or prequalification experience provided through the Service.

If you do not agree with this Notice, do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account information: name, email, phone, password (stored as a salted hash), business name, business address, license information, trade(s) you work in, and contact details.
• Billing information: payment card data, billing address, and transaction history. Card numbers are processed and stored by our payment processor, not by us.
• Profile and preference information: your typical project tier (budget, mid-range, premium), preferred suppliers, default labor rates, regional preferences, and similar settings.
• Communications: support requests, feedback, survey responses, messages sent through the Service, SMS verification messages, and other communications you send or receive through us.
• Drive Score and prequalification information: if you choose to use an optional Drive Score or prequalification feature, we may collect your name, address, email address, telephone number, date of birth, the last four digits of your Social Security number, estimated income, project budget or financing preferences, consent acknowledgments, consent date and time, IP address, and other information needed to verify identity and process the request. Required fields may vary by provider and applicable law. Only provide this information through the designated secure flow.

1.2 Content you upload ("User Content")

The Service is designed to receive and process construction project content. Depending on how you use it, User Content may include:

• Project inputs: photographs, videos, voice recordings, typed descriptions, uploaded plans and documents, dimensions, and other information you provide about a job;
• Project metadata: addresses, dimensions, scope notes, customer references, and job conditions;
• Customer and project information: names, addresses, phone numbers, email addresses, scope of work, and prior estimates for your customers;
• Documents you upload to your project history or contractor profile.

User Content may contain personal information about your customers or other third parties. By uploading User Content, you confirm you have the legal right and any required permissions to share it with us. See Section 11 for guidance on third-party data.

1.3 Information generated through your use of the Service

• Generated estimate content: bills of materials, line items, quantities, units, assumptions, prices, scope inferences, hazard flags, and other output generated for your projects.
• Drive Score and prequalification output: where the feature is used, qualification status, tier, credit score or score range, credit capacity, estimated prequalification or buying-power amount, debt-to-income indicators, data-quality indicators, reason codes, and a lead-routing recommendation. These outputs are estimates and decision-support information, not a commitment to lend, credit approval, or a guarantee that a consumer will purchase a project.
• Estimate edits and corrections: when you change an estimate we generated, we record the change, including lines added or removed, quantity or price adjustments, and items included or excluded, together with the item involved, its trade, and the time of the change.
• Usage and behavioral data: features accessed; estimates generated, edited, sent, or abandoned; timestamps; session activity; project counts; AI interactions; and similar telemetry.
• Performance data: latency, error logs, model selection, and diagnostic information.

1.4 Information collected automatically

• Device information: IP address, browser type and version, operating system, device type, screen size, and language.
• Log data: timestamps, pages visited, referring URLs, and similar server logs.
• Cookies and similar technologies: see Section 8.

1.5 Information from third parties

We may receive information from:

• Payment processors (transaction status, fraud signals);
• Identity and fraud-prevention services (where applicable);
• Consumer-reporting, identity-verification, and prequalification providers, when the consumer has authorized the request or another permissible purpose exists under applicable law;
• Marketing partners (limited business contact information and ad-performance data);
• Public sources (such as licensing records you reference in your profile);
• Affiliate and referral partners (where you arrive at the Service through a partner link).

2. How We Use Information

We use information for the following purposes:

• Provide the Service. Process User Content to generate estimates, bills of materials, takeoffs, and related output. This necessarily includes transmitting content to AI providers; see Section 4.
• Provide Drive Score and prequalification features. When requested and legally permitted, submit the required consumer information to an authorized provider, receive and normalize the provider's response, generate Drive Score or routing output, and display the result to the Estimado business user serving that consumer.
• Document authorization and compliance. Record consent acknowledgments, date and time, IP address, the stated purpose for a request, and related audit information where needed to demonstrate authorization, prevent unauthorized inquiries, respond to disputes, and comply with law.
• Learn how you work. Analyze the changes you make to your own estimates so future drafts can start closer to the way you bid. For example, if you consistently remove an item, the Service may suggest excluding it by default. Any account-specific learned default applies only to your account, and you can override it on an individual estimate.
• Communicate with you. Send transactional messages (account, billing, security, service updates) and, with your consent or where permitted, marketing messages. You can opt out of marketing at any time.
• Improve the Service. Analyze usage, measure model performance, debug, and develop new features. We do not currently use one user's identifiable estimates, prices, customers, or business practices to generate defaults for another user's account. Before introducing any cross-account correction or aggregate-pricing program, we will update this Notice and implement the controls described in the updated version.
• Eval and quality assurance. Use representative samples (typically de-identified) to evaluate AI output quality, benchmark new models, and detect regressions.
• Security and fraud prevention. Detect, investigate, and prevent fraud, abuse, security incidents, and Terms violations.
• Legal compliance. Comply with applicable law, respond to lawful requests, and enforce our Terms.
• Corporate transactions. Evaluate and execute mergers, acquisitions, financings, or asset sales (with confidentiality protections).

We do not sell your data. Your prices, markups, customer list, and identifiable business practices are yours. We do not show your identifiable prices to another user, identify you as the source of a price, or license your business information to third parties.

3. Legal Bases (for users in jurisdictions that require them)

Where applicable law requires a legal basis, we rely on:

• Contract: to provide the Service you requested;
• Legitimate interests: to improve the Service, secure our systems, prevent fraud, and run our business, balanced against your rights;
• Consent: for marketing communications and certain cookies;
• Legal obligation: to comply with applicable law.

Under some laws, we may be permitted to process information until you object to that processing, without relying on consent or another legal basis listed above. Where an objection right applies, you may exercise it as described in Section 9. We will clarify on request the legal basis that applies to a particular processing activity and whether providing personal information is a statutory or contractual requirement, or is necessary to enter into a contract.

4. Use of AI; Third-Party AI Providers

The Service uses large language models, computer vision models, and other AI systems. Some of these systems are operated by third-party AI providers, currently including, without limitation: Anthropic, OpenAI, Google, and DeepSeek. The set of providers may change over time.

When you use the Service:

• User Content and prompts may be transmitted to and processed by these providers to generate output;
• Each provider processes data under its own terms of service and data-handling commitments;
• We select providers with commitments not to train their foundation models on customer content via standard API access, but you should not upload information you would not want to be processed by a third-party AI provider;
• Output of these models is probabilistic and may be inaccurate, incomplete, or fabricated. The Service is decision-support and requires human verification.

If you need a list of current AI sub-processors, please contact us at hello@estimado.com.

5. How We Share Information

We do not sell personal information for money. We share information as described below:

5.1 Service providers and sub-processors

We share information with vendors that help us run the Service, including: cloud hosting and storage providers; AI providers (see Section 4); payment processors; email and customer support providers; analytics providers; security and fraud-prevention services; consumer-reporting, identity-verification, prequalification, and compliance providers; and material-pricing data partners. These vendors are bound by contractual or legal obligations governing their use of information.

Current service providers used by the Site or Service include:

• Supabase: database, authentication, and file storage for account, project, estimate, and uploaded-file data;
• Anthropic and OpenAI: AI interpretation, estimate generation, and derived text embeddings, depending on the feature used;
• Pinecone: storage and retrieval of derived text embeddings used for knowledge search;
• Twilio: phone verification and transactional SMS processing;
• Plausible: privacy-focused website analytics;
• Meta: advertising measurement through the Meta Pixel on our public website; and
• Google Ads: advertising measurement and remarketing through the Google tag on our public website. Depending on applicable law, advertising measurement and remarketing may be treated as "sharing" for cross-context behavioral advertising; and
• Consumer-reporting and prequalification providers (when Drive Score is enabled): permission-based prequalification and soft-inquiry processing, including returning normalized credit and financial-readiness indicators used to produce Drive Score output.

The categories of sharing described above expressly exclude mobile phone numbers and SMS opt-in consent data, which are never shared with third parties or affiliates for marketing or promotional purposes.

5.2 At your direction

We share information when you direct us to — for example, when you export an estimate, share a project link with a customer, or connect a third-party integration.

If you are a consumer using a link provided by an Estimado business customer, we disclose the project-intake information and Drive Score or prequalification result generated for that request to the business customer that sent you the link or is preparing your project estimate. The result may include the indicators described in Section 1.3. We do not disclose the last four digits of your Social Security number to that business customer.

5.3 Material pricing and product data partners

To display pricing and product information, we obtain data from retailers, manufacturers, distributors, and aggregators. We send only limited information necessary for that purpose (such as product categories or zip codes), not your full project content.

5.4 Legal and safety

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, subpoena, court order, or other legal process; (b) protect the rights, property, or safety of Estimado AI, our users, or the public; (c) investigate or prevent fraud or security incidents; or (d) enforce our Terms.

5.5 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.

5.6 Aggregated or de-identified data

We may share aggregated or de-identified information (which cannot reasonably be used to identify you) for any lawful purpose, including industry benchmarking and research.

5.7 SMS and Text Messaging

When you book an appointment or request a demo on our website, you may provide a mobile phone number and consent to receive text messages from Estimado AI LLC. Consent is collected through a separate, unchecked checkbox and is not a condition of purchasing any product or service.

We use that number solely to send appointment confirmations, reminders, and scheduling updates. We do not use it for marketing or promotional messaging unless you separately opt in.

Estimado AI LLC does not share, sell, rent, or lease mobile phone numbers or SMS consent data with third parties or affiliates for marketing or promotional purposes. All other categories of data sharing described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We share mobile phone numbers only with the telecommunications providers required to deliver the messages you requested.

You may withdraw consent at any time by replying STOP, or by contacting us at hello@estimado.com.

6. Data Retention

We retain information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, enforce agreements, support security and fraud prevention, and maintain backups. Typical retention periods:

• Account and billing records: for the life of your account plus up to seven (7) years to satisfy tax, accounting, and legal obligations.
• User Content: retained while your account is active. Upon account deletion, we will delete or de-identify User Content within a commercially reasonable period, except for content retained in routine backups (deleted on rolling cycles) or that we are legally required to retain.
• Usage and log data: typically up to twenty-four (24) months.
• Drive Score and prequalification records: normalized results and related audit records may be retained while the applicable business account is active and for a reasonable period afterward to meet contractual, dispute, security, and legal obligations. Identity-verification fields used only to submit a request, including the last four digits of a Social Security number, are not included in the normalized result shown to the Estimado business customer and are retained only as required to process the request, document authorization, prevent fraud, or comply with law.
• De-identified and aggregated data: may be retained indefinitely.

Account deletion. When you request account deletion, we delete or de-identify information as described above, subject to legal, security, fraud-prevention, billing-record, and backup obligations. We do not yet rely on a permanent, irreversible de-identification process to retain estimate-correction records after account deletion. If we introduce that process, we will update this Notice before using it and will describe the information retained, the de-identification method, and the applicable retention periods.

7. Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit, encryption at rest for sensitive stores, access controls, audit logging, vendor security review, and incident response procedures. No system is perfectly secure. You are responsible for keeping your credentials confidential and notifying us promptly of any suspected unauthorized access.

8. Cookies and Similar Technologies

We use cookies, pixels, local storage, and similar technologies for:

• Strictly necessary functions (authentication, security, session management);
• Functional purposes (saving preferences and settings);
• Analytics (measuring how the Service is used and detecting issues);
• Marketing (where applicable, measuring campaign performance — with consent where required).

You can control cookies through your browser settings. Disabling certain cookies may affect the Service. Where required by law, we present a cookie banner allowing you to manage non-essential cookies. We do not currently respond to "Do Not Track" browser signals, but we honor opt-outs where required by law (including Global Privacy Control signals as applicable).

9. Your Privacy Choices and Rights

9.1 Choices available to all users

• Update your information in your account settings.
• Delete your account by contacting hello@estimado.com or using the in-app option (where available).
• Opt out of marketing by clicking unsubscribe in any marketing email or contacting us.
• Export your data in a commercially reasonable format on request.

9.2 California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, may give you the right to know the personal information we collect, use, disclose, and share; request deletion; correct inaccurate information; receive a portable copy of certain information; and receive equal service and pricing without discrimination for exercising your rights.

During the preceding twelve months, the categories of personal information we may have collected include identifiers (such as name, email address, phone number, date of birth, partial Social Security number, IP address, and account identifiers); commercial information (such as subscriptions, transactions, estimates, project activity, project budget, and financing preferences); credit and financial information used for optional Drive Score or prequalification features; internet or other electronic network activity; approximate location inferred from IP address or project location you provide; audio, visual, and similar information (including photographs, video, and voice recordings); professional or employment-related information; and inferences drawn from activity, preferences, credit or financial-readiness indicators, and project information.

We do not sell personal information for money. The Meta Pixel, Google tag, and similar advertising-measurement technology on our public website may constitute "sharing" for cross-context behavioral advertising under California law. You may request to opt out by emailing hello@estimado.com with the subject line "Do Not Sell or Share," and we honor legally recognized opt-out preference signals where required.

To exercise a California privacy right, email hello@estimado.com with the subject line "California Privacy Request." We may verify your identity and authority to make the request. We will respond within forty-five (45) days as required by law and may extend the response period once, up to a total of ninety (90) days, when reasonably necessary and permitted by law. You may use an authorized agent, subject to verification.

9.3 Other U.S. state privacy rights

Depending on where you live, you may have additional rights under state privacy laws (including Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, and others). These may include the right to:

• Know / access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete personal information, subject to exceptions;
• Portability — receive a copy of certain personal information in a portable format;
• Opt out of sale or sharing of personal information (we do not sell personal information for money; some advertising cookies may constitute "sharing" under California law, and you can opt out via our cookie controls or by contacting us);
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects;
• Non-discrimination for exercising your rights;
• Appeal a decision we make on a privacy request (in states that require an appeal process).

To exercise these rights, email hello@estimado.com with the subject line "Privacy Request." We may need to verify your identity before responding. You may authorize an agent to act on your behalf, subject to verification.

9.4 California "Shine the Light"

California residents may request information about disclosures of personal information to third parties for direct-marketing purposes by emailing hello@estimado.com.

9.5 Sensitive personal information

When the optional Drive Score or prequalification feature is used, we intentionally collect and process the limited identity-verification, credit, and financial information described in Sections 1.1 and 1.3. We use this information only to provide the consumer-requested feature, protect the Service, document authorization, and comply with law. We do not sell this information or use it to infer protected characteristics. Depending on applicable law, you may have the right to limit certain uses or disclosures of sensitive personal information by contacting us as described below.

9.6 Automated decision-making

The Service generates AI output and may generate a Drive Score, prequalification tier, or routing recommendation by evaluating project and financial-readiness indicators. This is profiling and decision-support information. Estimado does not itself extend credit, approve financing, or make a final decision about whether a contractor will serve a consumer. Estimado business users must apply human review and may not use the output as the sole basis for a legal or similarly significant decision. Where applicable law provides a right to information, human review, correction, objection, or contest, contact us using the details in Section 15.

9.7 Consumer reports and FCRA rights

We obtain or facilitate access to consumer-report information only for a purpose permitted by the FCRA, including where a consumer provides written instructions, and only for the purpose disclosed at the time of the request. Estimado business users may not obtain or use Drive Score information for employment, tenant screening, insurance underwriting, or any other undisclosed or impermissible purpose.

If information from a consumer-reporting agency contributes to an adverse action, the person taking that action may have separate duties to provide an adverse-action notice containing the provider's contact information and explaining the consumer's rights to obtain a copy and dispute inaccurate or incomplete information. Consumers may contact hello@estimado.com with the subject line "Drive Score Request" to request information about a Drive Score request, the applicable provider, available correction or dispute channels, or Estimado's processing of the result. Rights provided by the FCRA and other laws are not limited by this Notice.

10. Children's Privacy

The Service is not intended for, marketed to, or designed for children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a child, contact us at hello@estimado.com and we will delete it.

11. Information About Third Parties in User Content

When you upload User Content that contains information about your customers, property owners, employees, or other third parties:

• You are the controller of that information for the purpose of your relationship with those individuals;
• We act as your processor or service provider with respect to that information;
• You are responsible for providing any required notices to those individuals and obtaining any required consents;
• If a third party contacts us directly about their information, we will generally refer them to you and assist as appropriate.

12. International Users

Estimado AI is based in the United States. The Service is intended for use within the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have data protection rules different from those of your country. By using the Service, you consent to that transfer and processing.

13. Third-Party Sites and Services

The Service may link to or interoperate with third-party sites and services (including retailers, manufacturers, and aggregators). Their privacy practices are governed by their own policies, not by this Notice.

14. Changes to This Notice

We may update this Notice from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice (such as by email or an in-product banner). Your continued use of the Service after the effective date constitutes acceptance of the updated Notice.

15. Contact Us

For questions, requests, or complaints about this Notice or our privacy practices:

Estimado AI LLC
Attn: Privacy
4440 PGA Blvd, Ste 600 #9012
Palm Beach Gardens, FL 33410
hello@estimado.com

You may also have the right to lodge a complaint with your state's attorney general or applicable privacy regulator.