Privacy Policy

Spot.xyz Corporation, doing business as Specset ("Specset," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our website (specset.com), web application, and related services (the "Services").

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please do not use our Services.

1.1 Information You Provide

When you use the Services or communicate with us, you may provide personal information, including:

• Account Information – Name, email address, company name, phone number, and other contact details.
• Uploaded Content – Documents and data you upload to the platform, including project specifications and submittals. These may contain sensitive or proprietary information.
• Support and Communications – Information provided when contacting customer support or participating in surveys or feedback.

1.2 Information Collected Automatically

We may collect certain information automatically when you use the Services, including:

• Device and Usage Information – IP address, browser type, operating system, referring URLs, page views, and other technical data.
• Cookies and Tracking Technologies – We use cookies, web beacons, and similar technologies to improve user experience, track usage patterns, and analyze performance.

1.3 Information from Third Parties

We may receive information from third-party services that integrate with Specset (e.g., single sign-on providers or cloud platforms).

We use your information to:

• Provide, operate, maintain, and improve the Services;
• Analyze and validate uploaded documents using AI models;
• Communicate with you about your account, service updates, and customer support;
• Enforce our Terms of Service and comply with legal obligations;
• Understand usage trends and improve product performance and experience.

Specset uses APIs with third-party large language models (LLMs), such as OpenAI and Google Gemini, to perform analysis of documents you upload (e.g., validating submittals against specifications). Your uploaded content may be processed by these LLMs solely for the purpose of providing the Services.

We do not use your data to train third-party models. We implement reasonable measures to restrict the sharing of sensitive information and to maintain confidentiality.

For clarity on our AI model use:

• Google Gemini / Vertex AI: Google does not use your data to train models without explicit permission; data is encrypted in transit and at rest under Google Cloud's enterprise terms.
• OpenAI API: Data sent via the API is not used to train OpenAI models; logs may be retained up to 30 days for abuse monitoring per OpenAI's data usage policy.

We do not sell your personal information. We may share information in the following limited circumstances:

• Vendors and Service Providers – With trusted third parties who help us operate and support the Services (e.g., hosting providers, analytics tools, AI infrastructure).
• Legal Compliance – When required by law, regulation, legal process, or governmental request.
• Business Transfers – In the event of a merger, acquisition, reorganization, or asset sale, your data may be transferred to a successor entity.
• With Consent – In other cases where you expressly consent to sharing.

We retain personal and project-related data for as long as needed to provide the Services and comply with legal obligations. You may request deletion of your data by contacting us at legal@specset.com.

We take reasonable administrative, technical, and organizational measures to protect your data. These include:

• Encryption in transit and at rest;
• Role-based access controls;
• Secure document storage and access policies.

Despite these safeguards, no system can be guaranteed 100% secure, and we cannot ensure or warrant the absolute security of any information.

Depending on your jurisdiction, you may have certain rights with respect to your personal information. These may include:

• Access – The right to know what personal data we collect and how we use it;
• Correction – The right to request correction of inaccurate or incomplete information;
• Deletion – The right to request deletion of your personal data, subject to exceptions;
• Objection/Restriction – The right to object to or restrict certain processing;
• Portability – The right to request your data in a structured, commonly used format.

To exercise these rights, please contact us at legal@specset.com. We may need to verify your identity before fulfilling your request.

If you are located in the European Union, European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR provide you with specific rights in addition to those outlined above:

• Legal Basis for Processing – We process your personal data based on your consent, performance of a contract, compliance with a legal obligation, or our legitimate interests (e.g., improving our Services, preventing fraud).
• Data Transfers – When transferring personal data outside of the EU/EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

You also have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data violates applicable law.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides the following rights:

• The right to know the categories and specific pieces of personal information we have collected about you;
• The right to request deletion of your personal information;
• The right to correct inaccurate personal information;
• The right to opt out of the "sale" or "sharing" of your personal information, if applicable;
• The right to limit the use of sensitive personal information;
• The right to non-discrimination for exercising any of these rights.

We do not sell personal information as defined under the CCPA/CPRA. To submit a request, please contact us at legal@specset.com.

Specset is based in the United States, and your information may be processed in the U.S. or other jurisdictions with different data protection laws than your home country. Where required by applicable law, we will implement appropriate safeguards (e.g., Standard Contractual Clauses) to protect your personal data during international transfers.

Our Services are intended for use by professionals in the construction industry and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without verified parental consent, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top and, where required, notify you of material changes. We encourage you to review this page periodically to stay informed about how we collect and protect your information.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at legal@specset.com.