Last updated: August 2026
Who this covers
ACE Platformsprovides software to contracting businesses. Those businesses are our customers. Their own customers — homeowners — have data stored in the platform by the contractor, who controls it. We process it on the contractor’s behalf.
What we collect
- Account details for users of the platform: name, email, role.
- Business records the contractor enters: jobs, customers, estimates, documents, photos, schedules and financial records.
- Usage and diagnostic information needed to operate and support the service.
- Location data on mobile, when a user logs a canvassing visit — captured only at the moment of that action.
What we do with it
We use it to provide the service, support it, bill for it, and keep it secure. We do not sell personal data, and we do not use customer business records to train models for anyone else.
Connecting your Google account (Gmail)
A user of ACE Platforms may optionally connect their own Gmail account so that email to their customers is sent from their real address, and replies arrive in their own inbox rather than being trapped in our software. Connecting is entirely optional and the platform works without it.
What we ask for. We request exactly three permissions and no others:
gmail.send— permission to send mail on your behalf.openidandemail— so we can show you which address you connected.
What we do not ask for. We do not request permission to read, search, download, modify or delete anything in your mailbox. We cannot see your inbox, your sent mail, your contacts or your attachments. The only thing we can do with this permission is send a message that you compose in ACE Platforms.
How the connection is stored. Google issues a token representing your permission. We encrypt it (AES-256-GCM) before storing it, and it is never exposed to a browser or shared with anyone.
Limited Use. ACE Platforms’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not use Google user data to train generalised or artificial intelligence models, we do not sell it, we do not transfer it except as needed to provide this feature or where required by law, and we do not use it for advertising.
Withdrawing permission. You can disconnect the mailbox inside ACE Platforms at any time, which deletes the stored token. You can also revoke access directly from your Google Account at myaccount.google.com/permissions. Either action stops us sending on your behalf immediately.
AI features, and how your data is protected
ACE Platformsuses AI to read measurement reports and plans, suggest quantities, assess job photographs, draft messages for a rep to review, and comment on a contractor’s own financial numbers.
Which AI provider we use. One: Anthropic(the Claude models), on a paid commercial API plan, called directly from our servers. We do not route AI requests through an aggregator, gateway, model hub or reseller, and there are no downstream or upstream models beyond Anthropic’s own. The models in use are Claude Opus 4.8, Claude Sonnet 5 and Claude Haiku 4.5. We do not operate any self-hosted or offline model.
Google user data is never sent to an AI provider. This is a property of how the integration is built, not only a policy: the Gmail permission we request is gmail.send, which cannot read a mailbox, so no Gmail message, attachment, contact or other Google Workspace content exists in our systems to send anywhere. The only Google user data we hold is the address you connected and the encrypted permission token. Neither is transmitted to Anthropic or to any other AI service, and neither is used to develop, train, fine-tune or improve any AI or machine learning model, by us or by anyone else.
No training on your data.Under Anthropic’s commercial terms, data sent through their API is not used to train their models. We do not train, fine-tune or build models on customer data of any kind — not your business records, not your customers’ personal data, and not information received from Google APIs.
How sensitive data is protected.
- Encrypted in transit and at rest. All traffic uses TLS. The database and file storage are encrypted at rest.
- Third-party credentials are separately encrypted. OAuth tokens for a connected Gmail, Outlook or QuickBooks account are encrypted with AES-256-GCM under a key held only in our server environment, never stored in plaintext and never sent to a browser.
- Tenant isolation is enforced by the database. Every record carries the company it belongs to, and row-level security in PostgreSQL restricts access to that company — not application code that could be bypassed.
- Least data to the AI. Requests carry only what the feature needs. The financial advisor is sent aggregates and per-job margins and never customer names or addresses; the customer-facing estimate flow is sent selling prices and never internal cost or margin.
- Access is controlled and audited.Roles and permissions govern what each user of a contractor’s account can reach. Administrative access by our staff requires a recorded reason, is time-limited, and every write is logged.
- Payment card details never reach us. Card data is handled by Stripe; we do not store card numbers.
Who else touches it
We use service providers to run the platform — hosting, database, payments, email delivery and AI features. Each receives only what is needed to perform its function. They are named individually in section 5 of the Terms of service, which is kept as the single list so the two documents cannot drift apart.
One is worth calling out here because it involves location. The mobile app shows a map of the addresses a rep is canvassing, and rendering that map means sending those locations to the map provider — Google on Android devices, Apple on iPhones and iPads, Mapbox on the web. That is the same location data described above.
Retention and deletion
Records are retained while the account is active. A contractor may request export or deletion of their data; contact us and we will work through it with you.
Contact
Questions about this policy: hello@aceplatforms.com