Privacy Policy
Last updated 18 August 2026
EasyTakeoff counts symbols on construction drawings. That means we handle files you may be contractually required to keep confidential, so this policy is specific about what happens to them rather than generic.
Who we are
EasyTakeoff (“we”) provides takeoff software for M&E estimators and is the data controller for the information described here. For any privacy question, or to exercise the rights below, contact hello@easytakeoff.ai.
What we collect
Account details
Name, email address, and a hashed password. If you sign in with Google we receive your name, email address and profile picture from Google — never your Google password.
Profile details
Any display name, job title, phone number or avatar you choose to add. All optional.
Drawings you upload
The PDF files themselves, plus project, drawing-set and sheet names you enter, and anything contained within those files.
Work product
Legend entries, detections, counts, and your review decisions (confirm, reject, reclassify, manual additions), including which user made a change and when.
Technical data
IP address, browser and device information, and request logs — used to run the service, apply rate limits and investigate abuse.
Error reports
When something breaks, a diagnostic report including the page, the error and technical context.
Analytics
Anonymised usage measurement and session recordings of your interactions with the interface — see Analytics and session recording below.
Your drawings, and what reaches third parties
Uploaded PDFs are stored in Amazon S3 in the London (eu-west-2) region and are never made public. Counting itself runs on our own servers: the geometry engine that does the matching is software we operate, and your files are not sent anywhere for it.
The exception worth knowing about. The optional AI features — reading a legend automatically, AI-assisted counting, and AI pre-review of the review queue — work by sending cropped images of the relevant part of your drawing to a third-party vision model. Small regions are transmitted, not the whole file, but those crops are parts of your drawing and they leave our infrastructure. If that is unacceptable for a given project, do not use the AI features; engine counting and manual review do not send anything to a model provider.
The vision providers we currently use are Anthropic (United States) and Alibaba Cloud’s DashScope service. Both are used under their business terms, and transfers outside the UK rely on the safeguards described below.
Analytics and session recording
We use Microsoft Clarity to understand how the product is actually used — which pages get attention, where people hesitate, and where the interface frustrates them. Clarity records interactions such as clicks, scrolling and navigation, and can replay them as a session.
We configure Clarity to mask text content, so project names, client names, sheet titles and other text you enter are obscured rather than recorded. Drawings render on a canvas and are not captured. We use this to improve the product, never to monitor individuals. You can decline it — see Cookies below — and declining does not affect your use of the service.
Why we are allowed to process it
- To perform our contract with you — running your account, storing your files, producing counts and exports. Without this we cannot provide the service.
- Our legitimate interests — keeping the service secure, preventing abuse, diagnosing errors, and improving the product, balanced against your rights.
- Your consent — for analytics and session recording, and for any marketing email. You may withdraw consent at any time.
- Legal obligation — where we must retain records, for example for tax purposes once billing is live.
Who processes data on our behalf
Amazon Web Services
Hosting, database and file storage. London (eu-west-2).
Anthropic · Alibaba Cloud (DashScope)
Vision models for the optional AI features. Receive cropped drawing images only when you use those features.
Resend
Transactional email — verification, password reset, invitations, job notifications.
ImprovMX
Forwarding of email sent to our published addresses.
Microsoft Clarity
Product analytics and session recording, with text masked.
Sentry
Error and crash reporting.
Stripe
Payment processing, once billing launches. Stripe handles card details directly; we never receive or store your card number.
International transfers
Our servers, database and file storage are in the UK/EU region (London). Some processors listed above operate outside the UK, principally in the United States. Where data is transferred outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies.
How long we keep it
- Account and profile data: for as long as your account exists.
- Uploaded drawings and the counts derived from them: until you or your organisation delete them, or until the account is closed.
- Error reports and server logs: typically up to 90 days.
- Analytics and session recordings: retained by Microsoft Clarity for up to 30 days.
- Billing records, once billing is live: retained for six years as required for UK tax purposes.
Deleting your account disables sign-in immediately and removes your profile, organisation memberships and any linked Google account. Files belonging to an organisation may be retained for that organisation’s remaining members.
Security
- All traffic is encrypted in transit with TLS.
- Files are stored in a private bucket with public access blocked and encryption at rest; the application issues short-lived, individually authorised links to view them.
- Passwords are stored only as salted hashes, never in readable form.
- Data is scoped to your organisation, and changing your password or resetting it invalidates every existing session.
Your rights
Under UK GDPR you have the right to access a copy of your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it. Email hello@easytakeoff.ai and we will respond within one month.
If you believe we have handled your data improperly you can complain to the Information Commissioner’s Office (ico.org.uk), though we would appreciate the chance to put it right first.
Changes
If we change this policy materially — a new processor, a new category of data — we will update the date above and, where the change affects you meaningfully, tell you directly.