Data Policy

1Why this document exists

The Privacy Policy explains what we collect and why. This document explains the mechanics: the systems that hold your data, the people who can open it, how long each type of record survives, and what we do if there is an incident. If the two documents ever conflict, the Privacy Policy controls.

2Where your data is stored

This website is built on Google Firebase. Google acts as our processor, handling data on our instructions under the Firebase Data Processing and Security Terms. Google maintains ISO 27001 certification and independent SOC 2 reporting for the underlying infrastructure.

3Who can reach your records

• You can see your own requests and messages when signed in to your account.
• Authorized XTM Construction administrators can see all requests, messages, and user records through the admin dashboard. Administrator access is granted individually and can be revoked.
• Subcontractors and suppliers receive only the specific project details they need, sent to them directly. They do not have accounts on this website and cannot browse our records.
• Google personnel do not access customer content except as permitted under the Firebase terms, for example to provide support we request or where required by law.
• Nobody else has standing access. Our accountant, insurer, or attorney receives specific records when a specific matter requires them.

Access rules are enforced in the database itself, not only in the interface. A signed in customer can only read the records tied to their own account.

4How the data is protected

• Traffic between your browser and our site is encrypted in transit using TLS.
• Data is encrypted at rest on Google Cloud infrastructure.
• Passwords are never stored in readable form. Firebase Authentication stores a salted hash, and we cannot see or recover your password.
• Database security rules restrict every read and write by account identity and by administrator status.
• Administrator accounts are limited in number and reviewed periodically.
• We do not store payment card numbers, bank account numbers, or Social Security numbers anywhere in this website's systems.

5How long we keep each type of record

When a retention period ends we delete the record or remove the details that identify you. Aggregate figures that cannot be traced back to you, such as how many kitchen remodels we completed in a year, may be kept indefinitely.

6Deleting your data

Email xtmcon@gmail.com with the subject line Delete My Data. We will confirm who you are, delete your account and the records we are free to delete, and send you a written list of anything we are keeping along with the legal or contractual reason. We complete this within 45 days, and we will tell you if we need the one permitted 45 day extension.

Deleting your account does not cancel a signed contract, erase an outstanding balance, or void a warranty. Those live in the contract, not in the website.

7If there is a security incident

• We investigate immediately, contain the issue, and determine what data was involved.
• If sensitive personal information as defined by Chapter 521 of the Texas Business and Commerce Code was compromised, we notify affected individuals without unreasonable delay and no later than 60 days after we determine the breach occurred.
• If 250 or more Texas residents are affected, we notify the Texas Attorney General no later than 30 days after that determination, including the nature of the breach, the number of Texans affected, how many we have notified, and the measures we have taken and intend to take.
• We notify affected individuals even where the law does not strictly require it, if we think you would want to know.
• Report a suspected problem to xtmcon@gmail.com with the subject line Security. We do not pursue people who report a vulnerability to us in good faith and do not access or damage other people's data.

8Data we collect at your property

Estimating and building generate records that are not created on this website: measurements, moisture readings, photographs and video of the work area, notes about concealed conditions, and inspection results. These become part of your project file and are governed by this policy and by your contract.

We photograph work areas as a matter of routine, before, during, and after. This documentation protects both of us, because it establishes the condition of the property before we started. Promotional use of project images is covered in the Terms of Service and you can opt out of it. Documentation photographs are retained regardless of a promotional opt out.

9Changes to this policy

We update this document when our systems or retention practices change. The current version and its date are always posted here.