Privacy Policy

CM Vision is operated by Mitchell Souza, a sole proprietor in California doing business as CM Vision (“CM Vision,” “we,” “us,” or “our”). This policy explains how we handle personal information through our websites, web and mobile applications, support, and optional integrations (the “Services”). Our Services are offered to users in the United States.

For privacy questions or requests, contact support@cmvision.app.

1. Information we collect

• Account and profile information. Email address, authentication information, account identifiers, and profile or report details you provide, such as your name, company name, contact details, and logo. We also maintain your plan, usage, and consent records.
• Property and inspection content. Addresses and saved property coordinates, property details, inspections, photos, annotations, field notes, voice notes, Punch Lists, uploaded bids and documents, AI questions and results, and generated reports. Content can include information about owners, occupants, contractors, or other people.
• Collaboration and connections. Invitations, collaborator identities and permissions, shared activity, and authorizations for services you choose to connect. Other users may provide your email address when inviting you or include information about you in their work.
• Billing information. Subscription and transaction identifiers, plan status, payment history, and billing information provided by our payment services. Payment details are collected by the checkout provider; CM Vision does not store full payment card numbers.
• Technical and usage information. IP addresses, browser and device information, requested pages, referring pages, approximate location derived from network information, timestamps, errors, and service activity. Our hosting and analytics providers process this information to operate, secure, and measure the Services.
• Support correspondence. Information you send when requesting help, including messages and attachments. Please do not send passwords or unnecessary sensitive information.

We receive information directly from you, automatically from your use of the Services, from collaborators, and from the authentication, payment, and other providers involved in the features you use. Device permissions, such as camera, photo library, or microphone access, support features you choose to use and can be managed in your device settings. The web app saves the property address you submit; it does not send your address typing to a map service for suggestions. Mobile address selection may use Apple Maps and save the selected address and coordinates.

2. How we use information

We use information to create and secure accounts; store, retrieve, and share your work as directed; deliver AI features and exports; administer subscriptions and usage limits; provide support; diagnose problems and improve the Services; prevent fraud and abuse; meet legal obligations; and resolve disputes or enforce our terms.

We send service-related communications, such as account verification, password recovery, collaboration invitations, billing notices, security alerts, and important policy updates. We do not currently send promotional emails. We do not sell personal information or share it for cross-context behavioral advertising, and we do not provide customer contact lists to third parties for their own direct marketing.

3. Service providers and other disclosures

We disclose information as needed for the following purposes:

• Operating the Services. Supabase provides authentication, database, and file storage services. Vercel provides web hosting and web analytics. Email delivery, support, and security providers process information needed to perform those functions. Authorized personnel assisting CM Vision may access information as needed for operation, support, security, or legal compliance.
• Payments. Stripe and Link handle web checkout and related payment, tax, fraud prevention, and billing support. Where checkout uses Stripe Managed Payments, Stripe acts as merchant of record. These providers also process information under their own policies, including the Stripe Privacy Policy. If you purchase through an app store, that store processes the purchase under its own policies.
• Your sharing choices. Property owners and authorized collaborators can access shared property content. Recipients of files you export or share can retain their own copies. Review your permissions and the information in a report before sharing it.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law or valid legal process, investigate abuse, enforce agreements, or protect rights and safety.
• Business changes. Information may be transferred in a reorganization, formation of a successor entity, acquisition, or sale of the business, subject to applicable law and this policy. We will provide notice of material changes to how your information is handled.

4. AI processing and connected services

When you authorize and use an AI feature, CM Vision sends the information needed for that request through OpenRouter to model providers. Depending on the feature, this includes property details, notes, photos, selected bid documents, questions, prior conversation context, or saved findings. Some requests also use a search provider to retrieve supporting information. Saved results are part of the property record and are available to people with access to that property.

Our managed AI requests use OpenRouter’s setting that excludes model providers permitting data collection under its routing policy. This is not a guarantee of zero retention: providers may process or retain data for purposes such as delivering the service, security, or legal compliance. See OpenRouter’s Privacy Policy and its data collection documentation. Do not submit information you lack permission to disclose to these providers.

If you choose to connect ChatGPT, Claude, or another supported third-party service, the connection can disclose information within the permissions presented during authorization. That service’s handling of information it receives is governed by its own terms, privacy policy, and your settings. Disconnecting a service does not erase copies already received by it. Contact support if you need help revoking a connection, and contact the third party about deleting its copies.

5. Cookies, analytics, and tracking preferences

We use authentication cookies and browser or device storage to keep you signed in, remember preferences, and support work in progress. You can clear or block browser storage, but doing so may sign you out or prevent features from working. Clearing browser data does not delete your cloud account.

Vercel Web Analytics measures page visits using information such as page URLs, referrers, device and browser type, and approximate location. It does not use third-party cookies for visitor identification. Hosting and security logs are separate from analytics. See Vercel’s analytics privacy documentation.

We do not use advertising trackers to follow you across unrelated websites. Our Services do not change their behavior in response to browser Do Not Track signals. Because we do not sell information or share it for cross-context behavioral advertising, there is no such activity for a Global Privacy Control signal to opt out of. External services you visit or connect, including payment services, may process activity across their own services under their separate policies.

6. Retention and deletion

We retain account and property information while needed to provide the Services. Retention also depends on the type of information, your deletion choices, security and fraud prevention needs, unresolved disputes, and applicable legal and financial recordkeeping obligations. Generated report files expire 30 days after they are ready; the underlying property and inspection records are separate from those exports.

You can request account deletion in your account settings or contact support. Deletion processes your owned property records and stored files and removes account access. It is not necessarily immediate: billing, active operations, and file cleanup may need to finish first. Contributions you made to another person’s property, including photos and reports, can remain with that property. Files already downloaded or shared outside CM Vision are not removed from recipients’ devices.

Limited records may remain where necessary for legal obligations, accounting, security, or resolving disputes. Payment providers maintain their own transaction records. Residual backup copies, where present, are subject to the applicable backup lifecycle rather than immediate deletion from every backup.

7. Your choices and privacy requests

You can review and update available profile information in your account, manage property access where you have permission, export supported reports and files, and choose whether to use AI or connect external services. Contact support@cmvision.app to request access, correction, a copy, or deletion of your personal information, or to ask about withdrawing an authorization.

Depending on your location and the law applicable to our business, you may have additional rights, including an appeal of a denied request. We will handle requests within applicable legal deadlines and explain any limitations. We may need to verify your identity or an authorized agent’s authority while protecting other people’s information. You can ask us to reconsider a response by replying to it. We do not retaliate against you for exercising applicable privacy rights.

If another customer uploaded information about you, contacting that customer may help resolve your request. You can also contact us; we will consider our responsibilities and that customer’s role rather than treating their ownership of a property record as eliminating your rights.

8. Security and processing locations

We use safeguards such as authenticated access, property permissions, and private file storage. No online service can guarantee absolute security. Keep your credentials private and contact us if you suspect unauthorized access. Although the Services are offered in the United States, our providers may process information in the United States and other countries; this is not a promise of US-only data residency.

9. Adults only

CM Vision accounts are for people age 18 and older. The Services are not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps to remove it.

10. Changes and contact

We will post updates here with a revised effective date. For material changes, we will also provide a prominent service notice or a service-related email, and obtain consent where required by law before applying a new use of information. Questions or requests for an accessible version can be sent to Mitchell Souza, operating as CM Vision, at support@cmvision.app.