Privacy Policy

This Privacy Policy explains how Asterpolaris ("we", "us") handles personal information when you visit our websites, create an account, use Sora Build, take part in a project as a client or trade partner, open an invoice link, or contact us.

We decide how account and website information is used. For that information we are responsible for it (a "controller" in some laws).

Your builder decides how project information is used. When a company uses the Service to manage its jobs, the information in its workspace (projects, tasks, comments, approvals, invoices, and the details of its clients and trade partners) belongs to that company. We process it on the company's behalf and on its instructions, under our Data Processing Addendum. If you're a client or trade partner, the builder's own privacy notice applies to that information too, and requests about it are best sent to them. We'll help them respond.

Information you give us

• Account details: name, email address, and your sign-in method. Passwords and single sign-on are handled by our authentication provider; we never see your password.
• Company details: company name, logo, address, business and tax numbers, and invoice settings.
• Project content: projects and addresses, schedules, tasks, templates, scope and prices, invoices and draw schedules, comments and messages, approvals and decisions, and any photos, videos or files uploaded.
• People you add: the names, email addresses, roles and (where a feature needs them) phone numbers of your team, clients and trade partners.
• Messages to us: what you send through our contact page, the AI waitlist or support, such as your name, email, company, team size, the features you're interested in and your message.

Information from payments and connected services

• Paying for Sora Build: Stripe processes your card. We receive the billing contact, plan, card brand, last four digits and expiry, and payment status, never the full card number.
• Client payments: when your clients pay your invoices online, Stripe processes the payment in your own Stripe account. We receive the amount, method type (card or bank), status, and the details needed to show the invoice as paid.
• Accounting: if an admin connects QuickBooks Online, we store the access tokens and company identifier Intuit gives us, and the data needed for the features you use.

Information collected automatically

• Technical and usage data: IP address, browser and device type, pages and features used, times, and error and security logs.
• Cookies and similar storage for sign-in, security and your display preferences, and, if you allow them, analytics cookies. See our Cookie Policy. We don't use advertising cookies.
• Analytics: with your permission where the law requires it, we use Google Analytics to measure which pages and features are used, how people find us, and sign-ups and subscription purchases. It receives a random identifier for your browser, your account's internal id, your company's plan and your role, never your name, email address, or company or project names.

• To provide the Service: create and secure accounts, show each person what their role lets them see, calculate schedules, and run the features your company turns on.
• To run the optional AI features on paid plans when someone uses one: the information that feature needs is sent, through OpenRouter, to the AI model that answers that request. We don't keep a copy of what's sent or what comes back; only what a person accepts is saved.
• To send messages the Service needs: invitations, sign-in and security emails, comment and approval notifications, invoices and receipts, and billing notices. Where a feature sends text messages, it follows our Text Message Terms.
• To bill for paid plans and to show your clients' payments.
• To keep the Service safe: detect and prevent fraud, abuse and security incidents, and keep audit records of changes.
• To support you and answer your messages.
• To understand and improve the Service, using aggregated or de-identified information where we can.
• To meet legal obligations, enforce our terms, and protect rights and safety.

If we send product news or marketing email, we'll do so only where the law allows, and every message will have an unsubscribe link.

We don't use Customer Data to train general-purpose artificial intelligence models.

Where the law asks for a legal basis (for example in the EEA or the UK), we rely on: performing our contract with you or your company; our legitimate interests in running, securing and improving the Service, balanced against your rights; your consent, where we ask for it; and complying with the law.

In Canada, we rely on your consent, which may be implied from your use of the Service for its purposes, and on the exceptions the law provides.

• People on the same project. What someone sees depends on the role the company gives them. For example, the builder decides what clients see, and clients never see internal comments, other people's email addresses, or prices the builder hasn't shared with them.
• Service providers who host, secure, email, process payments and run optional AI features for us, under contracts that limit their use of the information. They're listed on our Subprocessors page.
• Services you connect, such as QuickBooks Online or Stripe, when your company turns them on.
• Legal and safety. When required by law or valid legal process, or to protect the rights, property or safety of our users, the public or us.
• Business changes. If we're involved in a merger, acquisition or sale of assets, subject to this policy.

We don't sell personal information, and we don't share it for cross-context behavioural advertising.

If you're a homeowner, owner, trade partner or anyone else invited to a project, the company that invited you added your name and contact details and controls the project. You'll see what they share with you, and what you post (messages, approvals, photos) is visible to them and to others they let see it.

You can ask the builder to correct or remove your information. You can also contact us, and we'll pass the request on or help where we're responsible for the information.

We and our service providers store and process information in Canada, the United States and other countries where they operate. Those countries may have different data-protection laws from yours. Where the law requires it, we use contractual and other safeguards for these transfers. Information stored in another country can be subject to that country's laws, including lawful access by its authorities.

We keep account and workspace information while the account is active. After a workspace is closed, we delete or de-identify its Customer Data within a reasonable time, except for copies in backups (which are overwritten on their normal cycle) and records we must keep, such as billing and tax records.

Security and technical logs are kept for a limited period, then deleted. Uploads that were never posted are removed automatically after about a day.

We protect information with measures suited to its sensitivity, including encryption in transit, access controls that keep each company's data separate at the database level, limited access for our staff, and audit records of changes. No system is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable form, withdraw consent, and object to or restrict some uses. You can update much of your information yourself in your account settings.

To make a request, write to us through our contact page. We may need to confirm your identity first, and we'll respond within the time the law requires. If the information belongs to a builder's workspace, we may refer you to them.

Canada. You can complain to the Office of the Privacy Commissioner of Canada, or to the provincial regulator where one applies, such as the Commission d'accès à l'information du Québec.

EEA and UK. You can complain to your local data-protection authority.

United States. Residents of California and other states with privacy laws can ask to know, correct and delete their personal information. We don't sell or share personal information as those laws define it, and we won't treat you differently for using your rights. An authorized agent may make a request for you.

Sora Build is a business tool and isn't meant for anyone under 16. We don't knowingly collect personal information from children. If you think a child has given us information, contact us and we'll delete it.

We'll update this policy as the Service changes. If a change is significant, we'll tell account owners by email or in the Service before it takes effect. The effective date at the top shows when it last changed.

Our privacy officer is responsible for our compliance with this policy. To reach them, or with any question about privacy, write to us through our contact page.