Privacy Policy

Who this policy covers

Nebubee provides a website and a workspace for managing construction business activities. In this policy, “Nebubee,” “we,” and “our” refer to the service. Contact us at hello@nebubee.com about this policy or your information.

A company that uses Nebubee decides which clients, employees, subcontractors, and other contacts to include in its workspace, which records to create, and who may access or publish them. We process that company’s workspace information to provide the service under its instructions and applicable agreements. We also handle account administration, service security, website inquiries, and our own support communications.

If your employer, contractor, or another business invited you, that business may have its own privacy notice. Questions about its project records, employee time practices, or access decisions should normally go to that company first. You can also contact us for help identifying the appropriate route.

Information we handle

• Account and company information: names, email addresses, company details, profile images, roles, invitations, account status, preferences, password hashes, and login sessions.
• Business and project information: client and supplier contact details, addresses, leads, project descriptions, proposals, revisions, approvals, selections, schedules, tasks, time records, budgets, invoices, payment records, and related activity.
• Content you provide: comments, messages, daily logs, checklists, photos, receipts, plans, files, annotations, support requests, and information submitted through authorized integrations.
• Connection and device information: connected account identifiers, authorization credentials, notification subscriptions, language and display choices, and information needed for synchronization and device drafts.
• Technical and security information: service requests, timestamps, errors, audit events, and information such as IP addresses and browser details that our hosting and delivery providers may process to operate and protect their services.

You control what you enter or upload within your permissions. Please include only information needed for the work and obtain any necessary permission before adding another person’s information.

How we use information

We use information to create and administer accounts, provide the features you use, keep records available to authorized people, carry out requested imports and exports, send authorized communications and notifications, respond to support requests, resolve errors, prevent misuse, and maintain the service.

We also use appropriate account, billing, and audit information to administer customer relationships, reconcile payments, meet legal obligations, and address disputes. Where a legal basis is required, our processing depends on the circumstances: providing an agreed service, complying with law, pursuing legitimate operational and security interests, or obtaining consent for optional actions.

Nebubee does not sell personal information or use workspace content for targeted advertising. This marketing website currently adds no advertising trackers or analytics scripts.

Company access and client sharing

Workspace information is available according to company roles, project assignments, and sharing settings. Owners and administrators manage access. Other team members receive access appropriate to their permissions. Client portal users see the projects and content shared with their accounts.

When an authorized person publishes a document, sends an invitation, shares a private link, or sends a message, the intended recipient can receive the associated information. Recipients may keep their own copies. Treat private links as confidential and use the available controls to replace or disable them when needed.

Authorized support staff may access information needed to help with an issue or protect the service. Support access is subject to permissions and audit controls. The additional restrictions for information obtained through Google APIs are described below.

Google Drive

Google Drive is optional and is connected by the individual user. Nebubee requests the drive.file permission to work with specific files you select through Google Picker and files created through Nebubee. It does not request general access to read every file in your Drive through this connection.

When you import a supported photo or PDF, Nebubee reads its file information and content and saves a copy in the selected project or task. The source remains in Google Drive. When you choose to save a file to Drive, Nebubee creates an export copy in a Nebubee folder in your connected account. These are manual copy actions; later edits do not automatically update the other copy.

Imported content becomes part of the company workspace and follows its permissions and retention practices. If you later select an imported photo or note as a source for an optional AI feature, that selected content is processed as explained in the AI section. Connecting Drive alone does not request AI processing.

Dropbox and disconnecting file services

The optional Dropbox connection lets Nebubee read file and folder information, download selected files, and create export copies. The account access available depends on the authorization granted to the Dropbox app. Imports and exports create independent copies, as with Google Drive.

Cloud connections store encrypted access and refresh credentials so authorized actions can continue without signing in to the provider for every request. Disconnecting a provider in Nebubee removes its saved connection and requests revocation with the provider. If revocation cannot be completed, the app explains that you should also remove Nebubee’s access in that provider’s account settings. Google access can be reviewed in Google Account connections.

Disconnecting stops future use of that connection. It does not delete files already copied into Nebubee or exported to your cloud account. Use the relevant file controls or contact us about deletion of a retained copy.

Email connections and Google API data

Gmail is a separate optional connection from Google Drive. It requests permission to read email, send email, and identify the connected email account. Outlook and supported mail servers have their own authorization settings. Connecting Drive does not connect your mailbox.

When enabled for a project, email synchronization reads matching messages and saves project-related sender, recipient, date, subject, and plain-text content. Attachment information may be shown, but email attachment files remain with the email provider. An authorized mailbox can also send messages or company invitations where that sending purpose has been enabled. Disconnecting removes the saved connection; previously imported project history remains subject to workspace retention.

Nebubee’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use that information for the visible features you authorize. Transfers are limited to providing those features with your consent, security needs, legal requirements, or a business transfer with your prior explicit consent where required by that policy.

We do not sell Google API data, use it for advertising or credit decisions, or use it to train general-purpose AI models. Human access to Google API data is limited to your affirmative permission for specific information, necessary security or legal purposes, or other access permitted by Google’s policy.

Optional AI assistance

When an authorized user requests proposal drafting, Nebubee sends the information needed for that draft to OpenAI. This may include the entered job details, existing scope text, materials, measurements, exclusions, questions and answers, language choice, and relevant proposal introduction or terms. Project notes and photos are included only when the user selects them in the source controls. Those sources may contain personal information or content imported from a connected service.

Selected photos are prepared for the request with reduced image size and removed image metadata. AI suggestions remain subject to user review before insertion or publication. Nebubee does not automatically send a proposal or set its prices because a draft was generated.

Where support AI is enabled, authorized staff may request a summary or draft reply using the ticket’s subject, description, status, category, and recent customer-visible replies. Separate contact fields, private staff notes, and diagnostics are excluded from that AI request. Information written into the conversation itself may still identify you.

Nebubee sends these API requests with response storage disabled. This setting does not guarantee that the provider retains no information. OpenAI describes separate safety monitoring, temporary processing, and retention exceptions in its API data controls. Its API policy states that submitted data is not used for model training by default. We do not use Google API content to train general-purpose models or authorize that use.

Proposal suggestions are saved in Nebubee to make retries reliable. Older suggestion content is cleared after 30 days when a new generation triggers cleanup; usage records and content you insert into a proposal can remain longer. Support records and backups follow the retention considerations below.

Location, photos, and notifications

Where a company enables a jobsite boundary, a clock-in action may request a foreground location sample with your device’s permission. Nebubee checks that sample against the jobsite and keeps the result, approximate distance, accuracy, and any exception explanation with the time record. It does not retain the worker’s raw coordinates from that sample or continuously track the worker in the background. The configured jobsite boundary itself includes a location.

Camera and file controls use the photos or files you choose to provide. Device notification permission is optional. If enabled, we store the device’s push subscription and preferences and send notifications through the browser’s push service, such as Google, Apple, or Mozilla. Notification previews may be visible on your device’s lock screen according to its settings.

You can change device permissions in your browser or operating system and manage available notification choices in Nebubee. Disabling a permission can limit the feature that needs it.

Service providers and payments

Service providers process information needed to host and deliver Nebubee, store and recover files, send communications, protect the service, and support the optional features you use. Depending on configuration, these include application hosting, private cloud storage, email and push providers, OpenAI for AI assistance, and authorized accounting or payment services. A connected provider also handles information under its own terms and privacy policy.

When Stripe payments are enabled for an eligible company, Stripe supplies the card or bank entry interface and handles payment credentials and business verification. Nebubee receives information needed to relate the transaction to the invoice, such as payment identifiers, amounts, status, and refund or dispute activity. Do not send payment card numbers or bank login credentials in a Nebubee message or support request.

Information may also be disclosed when reasonably necessary to comply with law, respond to a valid legal request, protect people or the service, or complete a business transaction subject to appropriate protections. The specific Google API restrictions above continue to apply to Google API information.

Cookies and information on your device

The application uses necessary cookies to maintain login sessions and browser storage for preferences and supported device drafts. If you choose offline features, downloaded task information and queued work may remain on that device until synchronized or removed. People who can access the device may be able to access locally retained information.

You can clear cookies and site storage in your browser. This may sign you out or remove unsynchronized drafts, so save or synchronize work first. The marketing website’s demo form prepares a message in your email app. Nothing is submitted by the website itself; the information reaches us when you send the email.

Retention and deletion

We retain information according to its purpose, the company’s service relationship and instructions, applicable agreements, and requirements for security, recovery, accounting, dispute resolution, and law. A project record may need to remain available after a team member leaves or a project is completed.

Archiving a record, disabling an account, disconnecting an integration, or removing an item from an active view does not necessarily permanently erase its underlying content. Copies may remain in project histories, published documents, audit records, recovery storage, or a recipient’s account. Removal from active use and removal from retained copies can occur at different times. Backups and retained files are not all automatically erased by an in-app delete action.

To request access, correction, export, or deletion, contact your company administrator or hello@nebubee.com. We will assess the request, confirm the appropriate authority, and explain any retention requirements or limitations that apply. A provider’s own copy is also subject to that provider’s controls.

Security and processing locations

Nebubee uses measures such as authenticated access, company and project permissions, password hashing, protected file routes, encrypted connection credentials, and audit records. No service can guarantee absolute security. Keep your login details private, use a protected device, and contact us if you believe access has been misused.

Our hosting and connected providers may process information in countries other than the one where you live. Availability of a feature does not promise that all information stays in a particular country. Contact us before sharing information that is subject to a specific residency requirement so we can discuss the applicable service arrangements.

Your choices and requests

Depending on applicable law and the circumstances, you may have rights to access, correct, delete, or receive a copy of your personal information; restrict or object to certain processing; withdraw consent; or raise a concern with a data protection authority. These rights can be subject to exceptions, including records another company must retain.

Email hello@nebubee.com with your request and the company or workspace involved. We may ask for information to verify your identity or authority, but will not ask you to send your password. Where the company controls the relevant records, we may refer the request to its administrator or help that company respond. We handle requests under applicable requirements without penalizing you for exercising a protected right.

You can also disconnect optional integrations, adjust notifications, and change browser permissions. Withdrawing permission affects future optional processing and may prevent the associated feature from working; it does not automatically undo prior authorized actions.

Children, changes, and contact

Nebubee is designed for business use and is not directed to children. If you believe a child’s information has been provided inappropriately, contact us so we can review it.

We may update this policy as the service or its practices change. We will show the updated date and provide additional notice or request consent when required. We will obtain any required new consent before using connected Google information for a materially different purpose.

For privacy questions, email hello@nebubee.com.