Terms, Privacy, DPA & Security.

1. Agreement. By creating an account or using neuroBLDR (the “Service”), you agree to these Terms on behalf of yourself and any organization you represent. If you don't agree, don't use the Service.

2. The Service. neuroBLDR is construction project-management software with AI features. It helps you draft, organize, and assemble documents. It is a tool — not a licensed architect, engineer, attorney, accountant, or insurer — and does not provide professional advice. neuroBLDR is record-keeping and document-preparation software: it does not hold, move, transmit, disburse, or process funds, and it is not a bank, money transmitter, or payment processor. Any “paid,” payment, or accounts-payable status you record is a bookkeeping entry — you remain responsible for actually paying vendors and subcontractors through your own bank or accounting system. Documents the Service generates — including pay applications, lien waivers, change orders, proposals, and financial reports — are drafts and templates for your review, not legal, accounting, or tax advice; you are responsible for their accuracy and for having them reviewed by your own attorney or accountant before you rely on, send, or submit them.

3. Accounts & acceptable use. You're responsible for your account, your users, and your content, and for keeping credentials secure. Don't misuse the Service: no unlawful use, no reverse-engineering, no attempts to breach security or other tenants' data, no uploading content you don't have the right to upload.

4. AI outputs. AI features generate drafts. They can be wrong or incomplete. You are responsible for reviewing every AI output before you rely on it, send it, or submit it. We make no warranty that AI outputs are accurate, complete, or fit for any purpose.

5. Your content & IP. You own the data and documents you put into the Service. You grant us a limited license to host and process that content solely to provide the Service. We own the Service software, and feedback you give us may be used to improve it.

6. Billing. Paid plans are priced per office seat — Pro at $149 per seat / month and Ultra at $349 per seat / month; the free Starter plan and all field-crew, client, and subcontractor access carry no charge, and design-partner rates are available on request. Paid plans renew automatically until cancelled. Fees are non-refundable except where required by law. Add-on refill AI-action packs don't expire while your subscription is active — they roll over until used. Beta. Beta workspaces are free and last one month from the start of beta access; after that, the workspace moves to the free Starter plan and your data is kept. You can cancel anytime; access continues through the end of the paid period (see the Privacy Policy for what happens to your data after).

7. Disclaimers & limitation of liability. The Service is provided “as is,” without warranties of any kind to the fullest extent permitted by law. To the maximum extent permitted by law, PlazaTech LLC will not be liable for indirect, incidental, special, or consequential damages, and our total aggregate liability is limited to the amounts you paid for the Service in the 12 months before the claim.

8. Governing law & disputes. These Terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. Any dispute will be resolved by binding arbitration administered under the American Arbitration Association's Commercial Rules, seated in Montgomery County, Texas. You and PlazaTech LLC waive any right to a jury trial and to participate in a class action — disputes are brought only in an individual capacity. Either party may still bring an individual claim in small-claims court. You may opt out of arbitration by emailing us within 30 days of first accepting these Terms.

9. Changes. We may update these Terms; material changes will be posted here with a new “last updated” date. Continued use after changes means you accept them.

What we collect. Account details (name, work email, company, role), the content you upload to run your projects, and usage/diagnostic data needed to operate the Service.

How we use it. To provide and improve the Service, process payments, send transactional email, and provide support. We do not sell your personal information or use your project data to train neuroBLDR models. When you request an AI feature, we send the context needed for that request through configured model providers under their applicable data terms.

Sub-processors. We rely on a short list of vendors to run the Service under their applicable terms and our agreements:

• Vercel — hosting, serverless compute, file/blob storage, and the AI Gateway.
• Neon — managed Postgres database.
• Anthropic, Google & OpenAI — model inference, routed through the Vercel AI Gateway when an AI feature is requested.
• Google Cloud — the Blueprint PDF engine (Cloud Run) and Google sign-in.
• Upstash — Redis for sign-in codes and rate limiting.
• Stripe — subscription billing and payments.
• Resend — transactional and newsletter email.
• Sentry — error monitoring.
• PostHog — product and usage analytics.
• Intuit QuickBooks and Microsoft / Google (Gmail, Outlook) — only when you connect them, for accounting sync and email integration.

We give notice before adding a new sub-processor.

Data retention. We retain workspace data while needed to provide the Service and meet legal or security obligations. You can export project documents and core registers, request a full account export, or request workspace deletion at contact@plazatech.llc. Verified deletion requests are handled from active systems, with residual backup copies expiring under provider backup schedules. The Service does not yet provide an automated 90-day post-cancellation purge, so contact us when you want the workspace deleted.

Your rights. You can access, export, correct, or delete your data at any time. We honor applicable privacy rights, including under the CCPA (California) and the GDPR (EU/UK) — including access, portability, and deletion requests. To exercise any right, email contact@plazatech.llc.

Cookies. We use only the cookies needed to run the site and keep you signed in, plus a first-party analytics cookie for privacy-friendly product analytics. We don't run third-party advertising trackers.

This DPA applies where we process personal data on your behalf and supplements the Terms. A countersigned copy is available on request at contact@plazatech.llc.

Roles. For data you upload, you are the data controller and PlazaTech LLC is the data processor. We process personal data only on your documented instructions and to provide the Service.

Security & sub-processors. We maintain the technical and organizational measures described in the Security section and use the sub-processors listed in the Privacy Policy under their applicable terms and our agreements. We'll give notice of material new sub-processors.

Data-subject requests & breach. We'll assist you in responding to data-subject requests, and we'll notify you without undue delay after becoming aware of a personal-data breach affecting your data.

Return & deletion. On termination, use the available project and account exports or contact us for assistance. We handle verified written deletion requests from active systems, with residual backup copies expiring under provider schedules. International transfers rely on appropriate safeguards where required.

How we protect your data today:

• Workspace isolation — authenticated requests derive workspace and project access from the signed-in user, and child record IDs are revalidated at request boundaries.
• Encryption — HTTPS in transit, provider-managed encryption at rest, and AES-256-GCM for connected-service OAuth tokens before database storage.
• Time-bounded magic links — scoped per project, expiring on a schedule, revocable anytime.
• Drafts never auto-send — financial and contractual AI outputs require a human to review and send.
• Audit log — security-sensitive and core business mutations record workspace, actor, action, and target information.
• AI boundaries — neuroBLDR does not train its own models on your project data; requested AI features send only the context needed for inference.

neuroBLDR is not currently SOC 2 certified; a Type II audit is on the roadmap. Postgres RLS policies and isolation tests exist as a second layer, but production activation is independently launch-gated. For vendor due diligence, a DPA, or a security questionnaire, email contact@plazatech.llc.