Privacy Policy

1. Overview

STAXEN ("we," "us," or "our") operates the STAXEN business management platform for trade contractors (the "Service"), available on the web and as mobile apps for iOS and Android. This Privacy Policy describes how we collect, use, and share information when you use our Service. By using STAXEN you agree to the practices described here.

2. Information We Collect

Account information. When you create an account we collect your name, email address, company name, password, and, if you provide one, your phone number and trade. If you sign in with Apple or Google we receive your name and email address from them (an Apple private relay address if you chose to hide yours), never your password.

Business records you create. Estimates, invoices, projects, change orders, schedules and appointments, vendor and subcontractor records, price lists, and the notes and messages you exchange with the AI assistant.

Your clients' information. Names, email addresses, phone numbers, job addresses, and job history for the customers you serve. You provide this by typing it, by importing it from a file, or, on the mobile app, by choosing contacts from your phone to import. You are responsible for having the right to give us this information; see "Third-party data" in our Terms.

Documents, photos, and audio you upload. Invoices and receipts, job photos, walkthrough recordings and notes, blueprints and plan sets, and signed documents. On mobile these may come from your camera or photo library when you choose to add them.

Email content. If you connect a Gmail or Microsoft 365 mailbox, we access email messages and attachments solely to identify and extract invoice and job data on your behalf, and to send estimates and invoices from your address when you ask us to. We do not read, store, or analyze email content for any other purpose.

Google User Data If you connect your Gmail account, STAXEN accesses email messages and attachments solely to identify and extract invoice data for your account. We do not use Google user data for advertising, marketing, or profiling. Google user data is not sold to third parties and is only used to provide the features requested by the user. Gmail data is not used to train AI or machine learning models.

Payment information. Billing on the web is handled by Stripe, and purchases made inside the iOS app are handled by Apple and recorded through RevenueCat. We never see or store full card numbers or sensitive payment credentials. We store your Stripe customer ID, an anonymous purchase identifier, and your subscription status. If you use Stripe Connect to collect payments from your own clients, those payments are processed by Stripe into your own Stripe account and we store only the records needed to show you what was paid.

Device and app information. App version, platform, and the identifier your device uses for push notifications, so we can send the alerts you turn on. Our over-the-air update service (Capgo) receives a random per-install identifier so a device can be told which app bundle to load. Our servers log IP addresses and request metadata for security, rate limiting, and debugging.

Approximate location. We derive an approximate region from your IP address, to pre-fill local pricing and to name your market during signup. We do not request or collect precise device location, and the apps do not ask for location permission.

Marketing attribution. How you first reached us: the page you landed on, the referring site, campaign tags in the link, and, for app installs, the install attribution described in section 9.

Voice and audio. Voice input is push-to-talk dictation: your microphone records your spoken input only while you are dictating, and the recording is sent to our transcription provider (Google Gemini, reached through OpenRouter) to be converted to text so the AI can act on it. On the iOS app, transcription happens on your device using Apple's speech recognition. Staxen does not persistently store your audio. Transcription providers may transiently retain audio in accordance with their own policies (typically short-term abuse monitoring); see their privacy policies for details. Text transcripts of the conversation are stored against your account so you have a history; you can delete a conversation at any time. Notice for users in two-party-consent states (CA, FL, IL, MD, MA, MT, NV, NH, PA, WA): by starting a voice session you consent to this capture and transmission. If anyone else can be heard during the session (an employee, a client, a homeowner), you represent that you have informed them or have their consent.

What we do not collect. We do not collect precise location, we do not read your phone's contacts unless you pick specific ones to import, we do not access your photo library except for the images you choose, we do not use the advertising identifier (IDFA) and the iOS app never shows the App Tracking Transparency prompt, and we do not ask for or store your bank credentials.

2b. Mobile App Permissions

The iOS and Android apps ask for a permission only at the moment a feature needs it, and every one of them can be refused or revoked later in your device settings without losing access to the rest of the Service.

• Microphone: to dictate to the AI assistant and to record walkthrough notes. Recording happens only while you hold or toggle the mic.
• Camera and photos: to attach job photos and to capture receipts and documents. We receive only the images you select or shoot.
• Contacts: to import specific people as clients. We read only the contacts you choose on that screen, and we do not upload your address book.
• Notifications: to alert you when an estimate is signed, an invoice is paid, or a job needs you.

Apple requires apps to disclose data collection in a privacy label on the App Store listing. That label describes the same collection described here.

2a. Third-Party AI Services

The Service includes an AI assistant, voice mode, and document understanding features that rely on third-party AI providers. The first time you use any AI feature in the Staxen app, we ask for your explicit permission before sending any data to these providers. You can change this decision later from Settings.

What we send. Messages you type to the assistant, voice audio while voice mode is active, the textual or image contents of invoices, receipts, and blueprints you upload, and the project/vendor/billing records the assistant needs to answer the question you asked.

What we do not send. Your password, payment card information, or the contents of your connected mailbox beyond what a feature you asked for requires. Gmail and Microsoft message contents are used only to extract invoice and job details on your behalf, and are never used for model training.

Who receives the data.

• OpenRouter, Inc.: routing broker for text chat, voice dictation transcription, and document extraction. OpenRouter passes our requests on to underlying AI providers and returns the response. OpenRouter does not retain content beyond the request lifecycle.
• Anthropic, PBC and Google LLC (Gemini): the underlying large language models reached through OpenRouter for chat, voice transcription, and document understanding. Both providers confirm that API content is not used to train their models.
• Fish Audio: text-to-speech, when you have the assistant read a reply aloud. It receives the text to be spoken and returns audio.
• Our own blueprint measurement service: when you upload a plan set for a takeoff, the file's page geometry is processed by a Staxen-operated service hosted on Railway to snap measurements to real wall lines. It is our infrastructure, not a third-party product, and the file is not retained after the takeoff completes.

Each provider listed above operates under its own privacy policy and is contractually required to protect your data at a level equivalent to this policy. Staxen does not authorize any of them to use your content for advertising, profiling, or model training.

3. How We Use Your Information

• To provide, operate, and improve the Service
• To extract invoice, receipt, and blueprint data and populate your account using AI
• To send the estimates, invoices, reminders, and texts that you ask us to send to your clients
• To process payments and manage your subscription, including purchases made through the App Store
• To send transactional emails and push notifications (account confirmations, billing receipts, signed estimates, paid invoices)
• To send you occasional product and onboarding email about your account, which you can unsubscribe from at any time
• To measure which marketing brought people to Staxen
• To respond to support requests
• To detect and prevent fraud or abuse

4. Data Sharing

We do not sell your data. We share information only with:

• Supabase: database, authentication, and file storage infrastructure
• Vercel and Railway: application hosting
• Stripe: subscription billing, and payments you collect from your own clients through Stripe Connect
• Apple and RevenueCat: in-app purchases and subscription status for the iOS app. Apple bills you directly and tells us only whether a subscription is active
• Google: sign-in, Gmail, and Calendar (only when you explicitly connect your account), plus Google Places when you ask the assistant to look up your business profile
• Microsoft: 365 and Outlook mail (only when you explicitly connect your account)
• Intuit: QuickBooks Online sync (only when you explicitly connect your account)
• Twilio: delivery of the text messages you and we send, and carrier registration of your sending number
• Cloudflare: bot protection on public forms
• AppsFlyer and Meta: marketing attribution and conversion measurement, described in section 9
• AI providers (OpenRouter, Anthropic, Google): see section 2a for what is shared, with whom, and on what terms. Each AI provider is contractually required to protect your data at a level equivalent to this policy and may not use it for training, advertising, or profiling.
• Law enforcement or regulators when required by law
• A buyer or successor, if Staxen is involved in a merger, acquisition, or sale of assets. We would give notice before your information became subject to a different policy

If you contact us as a prospect (a demo request, a contact form, a lead capture on a marketing page) rather than as a customer, your name, email, phone, and what you asked about are also copied into our own customer relationship database so we can follow up. That database is operated by us on the same infrastructure and under this policy.

4a. Text Messaging (SMS)

Staxen lets contractors send transactional text messages to their own clients: estimate and invoice links, appointment confirmations and reminders, and "on the way" arrival notices. Clients provide their mobile number and agree to receive these texts when they request a quote, book a job, or sign an estimate. These messages are transactional only and are never marketing or promotional. Recipients can reply STOP to opt out at any time and HELP for assistance; message frequency varies with job activity and message and data rates may apply.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers are used solely to deliver the job-related messages described above.

5. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription and request account deletion, we will delete your data within 30 days, except where retention is required by law. Cancelling alone does not delete your account: your records stay in place, in read-only form, so you can come back or export them.

• Assistant conversations: kept so you have a history, and deleted when you delete the conversation.
• Voice recordings: not stored by us at all. Only the transcript is kept.
• Uploads (photos, receipts, blueprints, documents): kept until you delete them or the account.
• Abandoned signups: if you started a checkout and never finished, that record is kept for up to 90 days and then removed.
• Marketing attribution: kept on your own device for up to 180 days, and attached to your account only if you sign up.
• Billing records: kept as long as tax and accounting law requires, which is longer than the account itself.

Deleted data may persist in encrypted backups for a short period before those backups roll over.

6. Security

We use industry-standard safeguards including encrypted connections (TLS), row-level security on our database, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing us at gavin@getstaxen.com. We will respond within 30 days.

8. Notice for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you the right to know what personal information we collect, to request deletion or correction, to opt out of "sale" or "sharing" of personal information, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights. Staxen does not sell personal information and does not share it for cross-context behavioral advertising.

To exercise any of these rights, email gavin@getstaxen.com. We will verify your request and respond within 45 days. You may also designate an authorized agent to make a request on your behalf.

Categories of personal information collected in the last 12 months: identifiers (name, email, phone, account and device identifiers); commercial information (subscription status, billing history, purchases made through the App Store); internet and in-app activity (pages viewed, features used, marketing attribution); audio data (voice input, transmitted to our transcription provider for processing, not stored by us); visual data (photos and documents you upload); coarse geolocation (an approximate region derived from IP address, never precise device location); professional information (company name, trade, role); and the contact details of your own clients that you enter or import. We do not use or disclose sensitive personal information for any purpose that would require offering you a right to limit it.

9. Cookies

We use essential cookies and browser storage for authentication and session management. We also store a first-party record of how you first reached our site (the page you landed on, the referring site, and any campaign tags in the link) so we can tell which marketing is working. That record stays on your own device for up to 180 days and is attached to your account only if you sign up.

Accounts are made in the app, so when you tap one of our App Store or Google Play buttons that record goes with you. On an iPhone we copy a link holding it to your clipboard, and the app asks to read your clipboard the first time it opens. On Android it travels in the Play Store's install referrer. It holds the page you landed on, the referring site and any campaign tags, and nothing that identifies you.

We run the Meta advertising pixel on our marketing pages, which sets third-party cookies and reports conversions back to Meta. We also report the same conversions to Meta from our servers, which is the standard Conversions API: where that report includes your email address it is hashed before it is sent, so Meta receives a fingerprint rather than the address itself. You can block the browser pixel with your browser's tracking protection or an ad blocker without affecting your ability to use Staxen. Clearing your browser storage clears everything described above.

In the iOS app. We use AppsFlyer to tell which advertising campaign an install came from, which is how a phone signup gets credited to the same campaign a web signup would. Two things it does NOT do here: it does not use Apple's advertising identifier (IDFA), and the app never shows the App Tracking Transparency prompt, because we do not track you across other companies' apps and websites. Apple's own privacy-preserving install measurement (SKAdNetwork) also reports installs to ad networks in aggregate. The Android app has no attribution SDK.

9a. Children

Staxen is a business tool sold to contractors and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email us and we will delete it.

9b. Where Your Data Is Handled

Staxen is operated from the United States and sold to contractors working in the United States. Your information is stored and processed in the United States, and the providers listed in section 4 may process it in other countries where they operate. If you use the Service from outside the United States, you are sending your information to the United States and consenting to that transfer.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

Questions about this policy? Email us at gavin@getstaxen.com.