Privacy Policy

Effective date: October 1, 2026

Construction Partner, Inc. (“Construction Partner,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Construction Partner cloud-based software platform and related services (the “Service”), our customer portal, this website, and other interactions you may have with us.

1. Scope and our role

1.1 Who this policy covers

This Privacy Policy applies to:

• Visitors to our website at constructionpartner.com;
• Subscribers (“Customers”) who purchase or evaluate the Service for their organizations;
• Authorized Users, meaning the employees, contractors, or agents of our Customers who access the Service; and
• Individuals whose information our Customers process in the Service, such as our Customers’ employees, vendors, customers, and subcontractors.

The Service is designed for businesses. We do not offer the Service to individuals for personal, family, or household purposes.

1.2 Controller and processor

Construction Partner plays two different roles depending on the data.

Controller. When we collect information directly from you, for example when you create an account, contact support, request a demo, pay an invoice, or browse this website, we act as the controller of that information.

Processor. When our Customers enter, upload, or connect data into the Service, such as employee personal information, payroll records, vendor records, accounting transactions, or bank feed transactions, we act as a processor or service provider on the Customer’s behalf. The Customer is the controller of that data, and the Customer’s own privacy notice, not this Privacy Policy, governs how that data is collected and used. Individuals who want to exercise rights over that data should contact the Customer directly. We will help our Customers respond to such requests as required by law and the applicable subscription agreement.

2. Information we collect

2.1 Information you provide

• Account and contact information: legal entity name, business address, business email, phone number, taxpayer identification information where required, and administrator name and contact details.
• Authorized User information: name, business email, phone number, role, and password (stored as a salted hash).
• Billing information: payment method type and the last four digits of a bank account or card. Full bank account, routing, and card numbers are submitted to and stored by our payment processor, Stripe, and are not kept by us.
• Support and communications: information you give us when you contact support, request a demo, email our help desk, attend training, or answer a survey.
• Customer Data: see Section 2.4.

2.2 Information collected automatically

• Device and usage data: IP address, browser type and version, operating system, referring URLs, pages and features used, dates and times of access, and other diagnostic data.
• AI feature data: the prompts you submit to AI features, the responses generated, and usage metadata such as the model used, usage volume, and timestamps. We use it to operate, secure, and troubleshoot those features and to measure usage.
• Cookies and similar technologies: see Section 5.
• Log files: server logs that record technical information about your use of the Service, used for security, troubleshooting, and analytics.

2.3 Information from connected bank and credit card accounts

We use Stripe, Inc. (“Stripe”) Financial Connections to let Customers securely link their bank and credit card accounts to the Service. Stripe collects the login credentials you enter during the connection process; Construction Partner never receives or stores your online banking username or password. Stripe’s handling of your information is described in the Stripe Privacy Policy.

• ACH payments in the customer portal. When a Customer links a bank account to pay us by ACH, Stripe returns account verification and status information, and the last four digits of the account, to the Service.
• Bank feeds. When a Customer links an account for bank feeds, Stripe returns transaction information, such as transaction date, amount, description, and status, along with the institution name, account name, account type, and the last four digits of the account. We use this information only to import transactions into the Customer’s accounting records for categorization and bank reconciliation. Bank feed access is read-only: it cannot move money or make changes to the account.

Information from bank feeds is Customer Data (see Section 2.4). It is visible only to the Customer’s Authorized Users, is not sold, and is not used for advertising, credit decisions, or training any AI model. A Customer can disconnect a linked account at any time in the Service. Disconnecting ends our access to that account through Stripe and stops further data retrieval. Transactions already imported remain part of the Customer’s accounting records unless the Customer deletes them, and are otherwise retained and deleted as described in Section 7.

2.4 Customer Data we process for Customers

When our Customers use the Service, they submit data that may include personal information about their employees, vendors, customers, and other individuals (“Customer Data”). This may include:

• Names, addresses, Social Security numbers (for payroll), dates of birth, and other employee information;
• Wage, hour, deduction, and tax withholding information;
• Bank information for direct deposit, where used;
• Bank and credit card transactions imported through bank feeds;
• Vendor and customer contact information; and
• Other accounting, job cost, and operational records.

We process Customer Data only on behalf of and under the instructions of the Customer, except as required by law. We do not use Customer Data for our own purposes, including marketing or training general-purpose AI models, without the Customer’s express authorization.

3. How we use information

• Provide the Service: authenticate users, host and process Customer Data, import bank and credit card transactions through bank feeds, deliver features, and run the customer portal.
• Support and communications: answer requests, provide training and onboarding, and send service notices about billing, security, outages, and changes to our terms.
• Billing and payments: process subscription fees, ACH authorizations, invoices, and taxes.
• Security and fraud prevention: watch for unauthorized access, abuse, or security incidents, investigate suspected violations of our terms, and protect the rights and safety of Construction Partner and others.
• Service improvement: review aggregated and de-identified usage to improve reliability, performance, and features. We do not use identifiable Customer Data for general product analytics without the Customer’s authorization.
• Marketing: with consent or as permitted by law, send business contacts information about new features, releases, regulatory updates, and events. You can opt out at any time.
• Legal compliance: comply with applicable laws and respond to lawful requests from public authorities.

4. How we share information

We do not sell personal information. We share information only as described below.

4.1 Service providers (subprocessors)

We build and run our main tools ourselves. We share information only with a limited number of providers that process it on our behalf and are bound by confidentiality and data protection obligations. Which providers are involved depends on the product you use.

This website

• Hosting and bot protection: Cloudflare hosts this website and checks form submissions for bots (Cloudflare Turnstile).
• Form delivery: Postmark delivers the contact and demo request forms you submit to our team.
• Analytics: PostHog helps us understand how this website is used.

The Service

• Cloud hosting and email delivery: Amazon Web Services, in the United States, hosts the Service and its data and sends Service emails.
• Bank feeds: Stripe, Inc. connects bank and credit card accounts and imports their transactions through Stripe Financial Connections.
• Product analytics and error monitoring: PostHog helps us understand how the Service is used, and Flare helps us detect and diagnose errors. To tie an issue to the affected account, they may receive your name, business email, role, and organization. Error reports are set up to leave out sensitive data, such as payroll, Social Security numbers, and bank information.

Customer portal

• Payments: Stripe, Inc. handles card and ACH payments and bank account verification.

Support

• Support email: Postmark receives the messages you send to our support address and delivers them to our help desk.

Optional integrations in the Service

Some features let you choose between doing a task yourself and using an integrated provider. A provider receives data only when you choose the integrated option:

• Maps and address lookup: enter an address manually, or show a map or search for an address with Google Maps.
• AI features: for example, enter an AP invoice manually, or scan a PDF of it with AI. AI features use large language models from Anthropic and Google (Gemini), which process the data sent to those features on our behalf, under agreements that prohibit using that data to train their models.

A current list of subprocessors is available on request.

4.2 With Customers

If you are an Authorized User, the Customer that gave you access (usually your employer) can see your account information and activity in its account.

4.3 Business transfers

If Construction Partner is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

4.4 Legal requirements

We may disclose information when we believe in good faith that the law, legal process, or a government request requires it, or that it is necessary to protect the rights, property, or safety of Construction Partner, our Customers, or others.

4.5 With your consent

We may share information for other purposes with your consent or at your direction.

4.6 AI features

AI features in the Service are optional, and each one has a manual alternative. When you choose to use an AI feature, the content you submit, and the Customer Data needed to respond, is processed by the AI model providers described in Section 4.1 on our behalf. They are bound by confidentiality and data protection obligations and may not use your data to train their models. We do not use Customer Data to train any AI model without the Customer’s express authorization.

5. Cookies and similar technologies

We use cookies and similar technologies on this website and in the Service to run the site, remember preferences, keep you signed in, measure usage, and improve our products:

• Strictly necessary: required for sign-in and core functions. These cannot be turned off.
• Functional: remember preferences such as sidebar theme, table layouts, and the company you last worked in.
• Analytics: help us understand overall usage so we can improve performance and features.

We do not use cookies for cross-context behavioral advertising. You can control cookies through your browser settings. We do not currently respond to “Do Not Track” signals, but we honor opt-out preference signals such as Global Privacy Control where the law requires it.

6. Security

We maintain administrative, technical, and physical safeguards designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include encryption in transit and at rest, role-based access controls, audit logging, periodic security testing, and employee training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data retention

We keep information as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Customer Data is kept for the length of the subscription and the export period described in the subscription agreement, after which it may be deleted under our retention practices. Information about prospects, former Customers, and website visitors is kept as long as reasonably needed for the purpose it was collected for.

Prompts submitted to AI features and the responses generated are kept for 90 days, then deleted. Usage metadata, such as the model used, usage volume, and timestamps, may be kept longer to measure usage.

When a Customer disconnects a bank or credit card account, we disconnect the account through Stripe and stop retrieving data from it. Transactions already imported are kept as part of the Customer’s accounting records under the retention terms above.

8. Where data is processed

Construction Partner is based in California, and the Service is hosted in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country.

9. Your privacy choices and rights

9.1 General choices

• You can update account and contact information in your account settings or by contacting us.
• You can opt out of marketing emails with the unsubscribe link in those emails. Service emails, such as billing notices and security alerts, are required to operate the Service.
• You can control cookies through your browser settings.

9.2 California residents

This section applies to personal information about California residents that we collect as a controller, such as the business contact details of Customer administrators, Authorized Users, and prospects, and website usage data. It does not apply to Customer Data we process on a Customer’s behalf; requests about that information should go to the Customer.

Information we collect. In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3, and disclosed them for business purposes to the service providers described in Section 4.1:

We use sensitive personal information only to provide and secure the Service, and not to infer characteristics about anyone.

Your rights. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), you have:

• the right to know what personal information we have collected about you and how we use and disclose it;
• the right to access and get a copy of that information;
• the right to correct inaccurate personal information;
• the right to delete personal information, subject to legal exceptions; and
• the right not to be discriminated against for exercising these rights.

Construction Partner does not sell personal information and does not share personal information for cross-context behavioral advertising.

To submit a request, contact us by email or phone using the details in Section 12. We may need to verify your identity before completing some requests. You may name an authorized agent to make a request for you.

9.3 Residents of other U.S. states

Residents of other U.S. states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana, may have similar rights under their state’s laws. We honor those rights as the law requires.

10. Children’s privacy

The Service is built for businesses and is not directed to children under 13, or under 16 where a higher age applies. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Customers and Authorized Users by email or in the Service and update the effective date above. Continuing to use the Service after an updated policy takes effect means you accept the changes.

12. Contact us

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

Construction Partner, Inc.
1380 Lead Hill Blvd., Suite 106, Roseville, CA 95661
Privacy: privacy@constructionpartner.com
Support: support@constructionpartner.com
Phone: 800-395-7474