1. Overview
AEC Hub, Inc. (“AEC Hub,” “we,” “us,” or “our”) provides AEC Hub Proposals, a pursuit and proposal workflow product for architecture, engineering, and construction firms (the “Service”). This policy explains what information we collect when you or your firm use the Service, how we use it, who we share it with, and the choices available to you.
This policy covers the AEC Hub Proposals application at [INSERT PRODUCTION DOMAIN] and related subdomains. It does not cover third-party sites we link to, or services you connect to the product that have their own privacy practices (see Connected accounts).
We built the Service around a simple rule: your firm’s data belongs to your firm. We use it to run the Service you asked for, we do not sell it, and we keep it isolated from every other firm on the platform.
2. Information we collect
Account and firm information
Name, work email, password (stored as a salted hash, never in plain text), firm name, role (owner, admin, or member), and teammate invitations you send or accept.
Firm content you provide
Solicitations and RFP/RFQ text you paste or upload, reference documents (PDF/DOCX) up to 15 MB, past proposals and qualifications, project and personnel records, resumes, headshots and other imagery, generated proposal drafts and their edit history, and pursuit records (stage, outcome, notes).
Information from connected sources
If you connect Microsoft, Google, or Autodesk Construction Cloud, we access only the files you explicitly select for import and the pursuit-specific mailbox searches an owner or administrator explicitly starts. For files, we retain the selected content and metadata needed to read and deduplicate it. For mailbox searches, message bodies are processed transiently and are not stored; we retain only extracted facts and source metadata such as message ID, subject, sender, date, and provider link so your team can verify the result. We do not automatically ingest a connected account’s full contents. See Connected accounts.
Billing information
Subscription status, plan, and credit balance. Payment card details are collected and processed directly by Stripe; we do not receive or store full card numbers.
Usage and technical information
Log data (IP address, browser type, pages visited, timestamps), authentication events, and product usage needed to operate, secure, and improve the Service, such as which features are used and how AI-generated outputs are edited.
Opportunity and public procurement data
When you use opportunity discovery, we retrieve and store public solicitation notices from sources such as SAM.gov and NYC PASSPort. This is public government data, not personal information about you.
3. How we use information
We use the information described above to:
- Provide, maintain, and secure the Service, including your firm’s isolated workspace;
- Extract requirements from solicitations, run qualification and readiness scoring, and generate evidence-grounded proposal drafts;
- Process billing, enforce plan limits, and manage your subscription and credits;
- Send transactional email such as verification links, password resets, and team invitations;
- Investigate and prevent fraud, abuse, and security incidents;
- Provide customer support;
- Understand aggregate product usage so we can improve the Service; and
- Comply with legal obligations.
We do not use your firm’s content to train AI models on behalf of other customers, and we do not sell personal information.
4. AI processing
The Service uses AI models supplied by Anthropic, Google, and OpenAI to extract requirements from solicitation text, score qualification and readiness, draft proposal content, and perform structured quality review. When you use these features, relevant content (such as the pasted solicitation text, your firm’s approved project and personnel records, prior draft content, or the bounded email messages returned by a pursuit-specific search) is sent to the provider used for that feature to generate a response.
Generated content is designed to be traceable to your firm’s own approved records. Where the underlying evidence is missing or unclear, the Service is designed to flag the gap rather than invent a fact. Even so, AI-generated output can be incomplete or incorrect, and a qualified person at your firm is responsible for reviewing and approving any content before it is submitted to a client or agency. See the AI disclosures in our Terms of Service.
[CONFIRM: Anthropic’s API data-retention and training terms applicable to this account, and state them here rather than assuming zero-retention.]
6. Data location and security
Firm data is stored in a Supabase project hosted in ca-central-1. Every firm-owned record is protected by row-level security scoped to your firm; our own internal testing and the product’s security review confirm that authenticated users in one firm cannot read another firm’s pursuits, documents, people records, or billing data. Uploaded files are stored in private, firm-scoped storage rather than a shared or public location.
We use industry-standard safeguards including encryption in transit (TLS), encryption at rest provided by our infrastructure providers, and server-only handling of privileged credentials, which are never exposed to your browser. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
7. Retention and deletion
We retain firm content for as long as your firm’s workspace is active, plus a reasonable period afterward to allow recovery from accidental deletion and to meet legal, tax, and accounting obligations. When you delete a document, image, or record inside the product, we remove the original file from storage along with its indexed content.
If your firm cancels its subscription or closes its account, we will delete or anonymize firm content within 60 days of closure, except where we are required to retain it for legal, security, or accounting purposes. You can request deletion of your account and firm data at any time by contacting us at support@aechub.org; we will confirm what is deleted and what must be retained and why.
8. Your choices and rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate information;
- Request deletion of your personal information, subject to the limits described above;
- Object to or restrict certain processing; and
- Receive a copy of your information in a portable format.
To exercise any of these rights, contact us at support@aechub.org. We will respond within the time required by applicable law. Because most content in the Service belongs to a firm workspace rather than to any one individual, some requests may need to be made or confirmed by your firm’s owner or admin.
9. Connected accounts
Connecting Microsoft, Google, or Autodesk Construction Cloud to the Service does not import or scan your account’s full contents. You choose specific files to bring into the library. Mailbox access is separate and opt-in: a firm owner or administrator starts a bounded search from a specific pursuit, and the resulting extracted facts are suggestions until a user links or dismisses them. Proposals does not send email.
Mail message bodies are used transiently to identify explicit commitments, client requests, decisions, scope changes, and risks. Bodies are not retained in AEC Hub’s database. We retain the extracted fact and enough source metadata to reopen and verify the original message in the connected provider. You can disconnect a provider or revoke its access at any time from Settings, or directly from your Microsoft, Google, or Autodesk account security settings.
Your use of Microsoft, Google, and Autodesk services remains subject to those providers’ own privacy policies and terms.
11. Children’s privacy
The Service is a business tool intended for professional use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at support@aechub.org and we will delete it.
12. Changes to this policy
We may update this policy as the Service changes. If we make a material change, we will notify firm owners and admins by email or in-product notice before the change takes effect, and we will update the “Last updated” date above.
13. Contact us
Questions about this policy or your data can be sent to:
AEC Hub LLC.
support@aechub.org