Privacy Policy

Effective Date: May 10, 2026

Last Updated: August 8, 2026

1. Introduction

This Privacy Policy describes how Legacy Construction Consulting Inc ("LegacyDesk," "we," "us," or "our") collects, uses, and protects information when you use the LegacyDesk mobile application, website at thelegacydesk.com, and related services (collectively, the "Service").

By using LegacyDesk, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Contact: info@thelegacydesk.com
Mailing Address: 2803 S 301st Ln, Federal Way, WA 98003

2. SMS / Text Messaging Program (Mobile Information)

This commitment applies to all categories of users: account holders, end-customers receiving messages from LegacyDesk users, and any other recipients of SMS communications through our Service.

2.1 Information We Collect Through SMS

When you participate in our SMS program, we may collect:

• Mobile phone number
• Carrier information (e.g., Verizon, T-Mobile, AT&T)
• Date and time of messages
• Message content
• Delivery status
• Subscription status (opted-in / opted-out)

2.2 How We Use SMS Information

We use mobile information ONLY to:

• Send service-related notifications you requested
• Deliver estimates, invoices, and project updates from contractors to their clients
• Send authentication and security codes
• Respond to your inquiries
• Process opt-out requests
• Comply with legal requirements

2.3 SMS Information Sharing — Limited and Service-Only

We share mobile information ONLY with:

• Carriers (T-Mobile, AT&T, Verizon, etc.) — for message delivery only
• SMS service providers (Telnyx, Twilio) — to send messages on our behalf
• Government authorities — only when legally required

We DO NOT share mobile data with:

• ❌ Affiliates or partners for marketing purposes
• ❌ Third-party advertisers
• ❌ Data brokers
• ❌ Marketing companies
• ❌ Any party for promotional purposes

2.4 Opt-In Consent

By providing your phone number, you consent to receive SMS messages from LegacyDesk and its users. Standard message and data rates may apply.

2.5 Opt-Out

You may opt out of SMS messages at any time by:

• Replying STOP to any message
• Texting STOP to the originating number
• Emailing info@thelegacydesk.com

Once opted out, you'll receive a confirmation message, and we will not send further marketing SMS communications. Transactional messages (security codes, urgent service alerts) may still be sent.

2.6 Help

For SMS support, reply HELP to any message or email info@thelegacydesk.com.

2.7 Frequency

Message frequency varies based on your activity. You may receive up to 50 messages per month per active project.

2.8 SMS Disclaimer

Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

3. Other Information We Collect

3.1 Information You Provide Directly

When you create an account and use LegacyDesk, we collect:

• Account Information: name, email address, phone number, business name, business address, business license number, and password (encrypted)
• Payment Information: processed securely through Stripe; we do not store full credit card numbers on our servers
• Business Data You Upload: client contact information, project details, estimates, line items, prices, photos, files, blueprints, signatures, communication logs
• Voice Input: if you use voice commands with MAX (our AI assistant), we process the audio transcription temporarily to fulfill your request

3.2 Information Collected Automatically

• Usage Data: features used, time spent, clicks, errors encountered, device performance
• Device Information: device type, operating system, browser type, IP address, mobile device identifiers
• Cookies and Similar Technologies: for authentication, preferences, and analytics
• Location Data: approximate location (ZIP code level) to calibrate regional pricing — we do NOT track precise location

3.3 Information From Third Parties

• Stripe: payment status and subscription information
• Authentication providers: if you sign in with Google, Apple, or Microsoft accounts
• Resend: email delivery status for emails sent through our system
• Telnyx/Twilio: SMS delivery status and carrier information

3.4 Information About Your Clients

When you use LegacyDesk to manage your construction clients, you input information about those clients (names, contact info, project details). You are responsible for ensuring you have the right to collect and store this information about your clients under applicable laws.

3.5 Bank & Card Connections (via Plaid)

If you choose to connect a business bank or credit card account to reconcile your expenses, we use Plaid Inc. to securely link your account. We never see or store your bank login credentials — those are handled directly by Plaid.

Through Plaid, we access transaction data (date, amount, merchant/description, and account type with a masked account number such as the last 4 digits) solely to match your charges against the receipts scanned in the app and flag charges that are missing a receipt.

• This financial data is used only for expense reconciliation for the account that connected it.
• We do NOT sell, rent, license, or share it for advertising or marketing purposes.
• Access tokens are stored server-side only and are protected; each business can access only its own data.
• You can disconnect a linked account at any time; on disconnection we remove the stored access token and revoke the connection at Plaid.

Your use of Plaid is also governed by Plaid's Privacy Policy, available at plaid.com/legal.

4. How We Use Your Information

We use collected information to:

• Provide the Service: maintain your account, save your data, sync across devices
• Process Payments: handle subscription billing through Stripe
• Communicate: send service announcements, security alerts, customer support responses
• AI Features: allow our AI assistant MAX to help you create estimates, manage clients, send emails — your queries and data may be processed by third-party AI providers (Anthropic) to generate responses
• Improve the Service: analyze usage patterns to fix bugs and add features
• Regional Pricing: use your ZIP code to calibrate your price list for your local market
• Legal Compliance: comply with laws, court orders, or government requests
• Security: detect and prevent fraud, abuse, and security incidents

We do NOT:

• Sell your personal information to third parties
• Sell mobile information (phone numbers, SMS content) to anyone for any purpose
• Sell your business data or client information
• Use your client lists for marketing
• Read your private communications without legal cause

5. Sharing Your Information

We share information only in these specific cases:

5.1 Service Providers

We share data with trusted vendors who help operate LegacyDesk:

Each provider is contractually bound to protect your data and use it only to provide their service to us. None of these providers may use your mobile information for promotional or marketing purposes.

5.2 Legal Disclosure

We may disclose information when required by:

• Subpoena, court order, or legal process
• Government investigations
• Defending our legal rights
• Preventing fraud or harm

5.3 Business Transfer

If LegacyDesk is acquired, merged, or sells assets, your information may be transferred. We'll notify you and you'll have the option to delete your account.

5.4 With Your Consent

Any other sharing requires your explicit permission.

6. Your Privacy Rights

6.1 All Users

You can:

• Access your data — export from Settings
• Correct inaccurate information — edit your profile
• Delete your account — Settings → Account → Delete
• Opt-out of marketing emails — unsubscribe link in any email
• Opt-out of SMS — reply STOP to any message
• Disable specific features (voice, AI, location, SMS) in Settings

6.2 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have additional rights:

• Right to Know what personal information we collect
• Right to Delete your personal information
• Right to Correct inaccurate information
• Right to Opt-Out of "sale" or "sharing" of personal information (we do not sell)
• Right to Non-Discrimination for exercising these rights
• Right to Limit use of sensitive personal information

To exercise these rights, email info@thelegacydesk.com with subject "California Privacy Request."

6.3 European Users (GDPR)

If you're in the EU/EEA/UK, you have rights under GDPR:

• Access, rectification, erasure, restriction, portability, and objection
• Right to lodge a complaint with your data protection authority
• Right to withdraw consent at any time

Legal Basis for Processing: We process your data based on (a) contract performance, (b) legitimate interests, (c) legal obligations, and (d) your consent where required.

6.4 Washington State (My Health My Data Act)

We do not collect or process consumer health data.

7. Data Security

We protect your data using industry-standard measures:

• Encryption: TLS/SSL for data in transit, AES-256 for data at rest
• Access Controls: Role-based permissions, multi-factor authentication available
• Monitoring: Continuous security monitoring through our infrastructure providers
• Backups: Regular automated backups with disaster recovery
• Incident Response: We will notify affected users within 72 hours of confirmed data breaches as required by law

However, no system is 100% secure. You're responsible for keeping your account password confidential.

8. Data Retention

• Active accounts: We retain your data while your account is active
• Cancelled accounts: Data is retained for 30 days, then permanently deleted
• SMS records: Retained for 6 months for opt-in/opt-out compliance verification, then deleted
• Backups: May persist for up to 90 days after deletion
• Legal obligations: Some data may be retained longer to comply with tax, accounting, or legal requirements
• Anonymized data: May be retained indefinitely for analytics

9. Children's Privacy (COPPA)

LegacyDesk is intended for users 18 and older in a business/professional capacity. We do not knowingly collect information from children under 13. If we learn we have, we will delete it promptly.

If you believe we have collected information from a child, contact: info@thelegacydesk.com

10. International Data Transfers

LegacyDesk operates servers in the United States. If you access from outside the US, your data will be transferred to and processed in the US. By using LegacyDesk, you consent to this transfer.

For EU users: we rely on Standard Contractual Clauses (SCCs) for international transfers when applicable.

11. Third-Party Services and Links

LegacyDesk may contain links to third-party websites or integrate with third-party services. Their privacy practices are governed by their own policies. We are not responsible for their privacy practices.

12. AI and Machine Learning

LegacyDesk uses AI to power features like MAX (our voice assistant) and pricing calibration:

• Your inputs to MAX may be sent to Anthropic (Claude AI) to generate responses
• We do not use your data to train AI models without explicit consent
• Anthropic does not retain your queries for training under their commercial API agreement
• You can disable AI features in Settings

13. Cookies

We use cookies for:

• Essential: authentication, session management (required)
• Functional: preferences, language settings
• Analytics: understanding usage patterns (you can opt-out)

You can control cookies through your browser settings. Disabling essential cookies may break the Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Email to your registered address (30 days notice for material changes)
• In-app notification
• Update to the "Last Updated" date at the top

Continued use after changes constitutes acceptance.

15. Contact Us

For privacy questions or to exercise your rights:

Email: info@thelegacydesk.com
SMS Opt-Out: Reply STOP to any message
Mail: Legacy Construction Consulting Inc
2803 S 301st Ln
Federal Way, WA 98003

We aim to respond to all requests within 30 days.

16. Definitions

• "Personal Information" means information that identifies or could reasonably identify an individual
• "Mobile Information" means data acquired through your participation in our SMS messaging program, including phone numbers, mobile-originated content, opt-in/out status, and delivery metadata
• "Service" means the LegacyDesk app, website, and related services
• "You" means the individual or business using LegacyDesk
• "Client Information" means information you input about your construction clients

This Privacy Policy is effective as of the date above and applies to all users of LegacyDesk.