Privacy.

What this covers

This policy explains how Great Breads Clothing, LLC, doing business as Great Breads Studio ("we", "the studio") handles information on this website and on the systems we build and host for our clients under the AsBuilt name, including the AsBuilt app for iPhone. It covers four situations that are different enough to be separated.

The first is you, reading this site or asking us for the Read. The second is a person who signs in to AsBuilt to work for their own company, on the web or in the iPhone app. The third is a subcontractor, architect, owner or employee who reaches a page we host because one of our clients, a general contractor running a system we built, sent them a link. The fourth is a subcontractor who keeps a free As-Built Record of the purchase orders they signed. The second, third and fourth cases each have their own section below.

If you contact us

When you request the Read, we collect what the form asks for: your name, company, email, phone, website, headcount, annual volume, what you run on today, and anything you choose to tell us. We use it to decide whether we can help, to reply, and to schedule the engagement. It goes into our own client record, which runs on the same database our systems run on.

We do not buy lists, we do not add you to a newsletter you did not ask for, and we do not sell or rent what you tell us to anyone. To reply well, we may look up public information about your company through the research providers named below.

If you sign in to AsBuilt for your company

You sign in with a code we send to your email or phone, and, where your company requires it, a code from an authenticator app. We keep your name, email address, phone number and role so the system knows who you are and who did what. What you and your colleagues enter, upload or send through AsBuilt (jobs, purchase orders, messages, photos, documents) is your company's record. Your company is the party responsible for it, and we process it on its behalf and on its instructions.

If your company records a call or a meeting in AsBuilt, the recording is kept in your company's record and the audio is sent to OpenAI to be turned into a transcript, which is kept with it.

When you open an export or a generated PDF inside the iPhone app, a copy of the file is kept in your company's private document storage and opened in Safari from a link that stops working after 15 minutes.

The AsBuilt app for iPhone

The app opens the same AsBuilt system you use on runorrery.com, so everything in the section above applies to it. The app adds three things.

Notifications. If you allow notifications, Apple gives the app a device token. We store that token with your account, together with the app's version and when the phone was last seen, so an alert meant for you can reach your phone. Alerts are delivered through Apple Push Notification service, which receives the token and the text of the alert. Signing out of the app asks our server to forget the phone.

Face ID. The app uses Face ID, or your iPhone passcode, only to unlock itself. The check happens on your iPhone, and iOS tells the app only whether it succeeded. Your face data never leaves your phone and is never sent to us.

Camera, microphone and photos. The app asks iOS for permission before it uses any of them, and uses them only when you choose a feature that needs them, such as a site photo or a recorded meeting. What you capture is stored in your company's record.

The app contains no advertising and does not track you across other companies' apps or websites.

If a client of ours sent you a link

Purchase orders to sign, submittals to review, punch lists, bid invitations, field capture: these pages carry the contractor's name, run on the contractor's domain, and hold the contractor's records. The contractor is the party responsible for that data. We process it on their behalf and on their instructions, the way a printer or a mail carrier does, and we do not use it for anything else.

What is recorded on those pages, who opened what, when a document was signed, what was uploaded, is recorded because the contractor's system of record needs it. Questions about that data go to the contractor first. If you cannot reach them, write to us and we will route it.

One exception, and only where the contractor has switched it on: a subcontractor who signs may keep a free As-Built Record of their own purchase orders with that contractor, described in the next section.

If you keep an As-Built Record

The As-Built Record is a free page on runorrery.com for a subcontractor that signs purchase orders on AsBuilt. It is offered only by a contractor that has switched it on, and only after you sign. You sign in with a code sent to your email. We keep your email address, the company name you choose to show, and, if you save them, your broker's email address and whether you want renewal reminders.

The record is built from the purchase orders sent to your email address by contractors that switched it on: purchase order numbers, trades, dates, signatures and their fingerprints, and the insurance dates on file. Dollar amounts are shown only to you.

Some things happen only when you act. An insurance certificate you send is filed against your open purchase orders with each of those contractors, who can then see it. An email to your broker goes only when you press the button, from you through AsBuilt, with you copied. It carries a private link to a page that lists the clients who named that broker, with each one's insurance expiry and the contractors their certificate goes to, where the broker can upload your renewed certificate for you; it is filed the same way as your own, and you are told. A broker sees you there only while you keep them as your broker. A purchase order you send your own crew sends their name, email address and the document to them, and the signed copy to both of you. A share link shows what you signed and when, with no dollar amounts and no contractor names, to anyone who has the link, until you stop sharing.

We record the steps taken on the record (signing in, sending insurance, sharing, a share link being opened) so we can see whether it works. A PDF someone checks against a shared record is fingerprinted on their own device and is never uploaded. The record is a record of paper, never a rating, and it says nothing about any contractor.

Collected automatically

Server logs (address, browser, page, time) kept for security and for finding faults. Product analytics on this marketing site through Vercel Analytics, which does not use cookies and does not track you across sites. Our own product surfaces use PostHog for usage analytics. The pages a client's subcontractors and architects use carry no session recording and no identifying analytics properties, by design.

Who else touches it

The providers that run the service, each under contract and each doing one job: Supabase (database, file storage, server functions), Vercel (web hosting and site analytics), Stripe (payments. We never see or store card numbers), Anthropic (the model that reads documents when a client asks the system to, for example a drawing set checked for conflicts), OpenAI (turning call and meeting audio into transcripts, and turning document text into a search index), Resend (email delivery), Twilio (SMS and telephony), PostHog (product analytics), Apple (Apple Push Notification service, which delivers alerts to the iPhone app), CloudConvert (converting a document from one file format to another when someone asks the system to), Perplexity and Apollo (looking up public information about a company or person who has written to us), Google and Microsoft (the mail and calendar accounts a client connects), Procore (the project data a client connects), and Cloudflare (the bot check on our public booking and sample-company pages, and storage for our nightly off-site backup of the database and stored files).

When a client connects one of its own accounts to its system, for example a Gmail or Microsoft 365 mailbox or Procore, we exchange data with that service on the client's instructions. We may also disclose information when the law requires it or to protect the safety and rights of our users.

Cookies

Signing in does not use a cookie. Your sign-in is kept in your browser's local storage, or in the iPhone app's own storage, on your device. Our product analytics (PostHog) keeps a first-party cookie and a local storage entry holding a random identifier, so that visits can be counted; it is not used for advertising. Vercel Analytics on this marketing site uses no cookies. No advertising cookies, no third-party tracking pixels. Where a link from one of our clients carries a token in its address, we remove it from the address bar the moment the page opens so it is not written into browser history or analytics.

Your rights

Depending on where you are, including under the GDPR in the EEA and the UK, and the CCPA in California, you can ask to see, correct, export or delete personal information we hold about you, and object to certain uses. Write to studio@greatbreadsny.com. We do not sell personal information and we will not treat you differently for asking.

How long we keep it

An inquiry stays while we are in conversation and for as long as our own records need it. A client's system holds its records for the life of the engagement and under the terms of the engagement agreement. A client can download every record at any time. When a client leaves, we delete its records on request, except the decision ledger and financial records, which our retention policy keeps for six years.

Children

This site and the systems we host are for businesses. They are not directed at anyone under 18.

Changes

If this policy changes we post the new version here with a new date, and for a material change we tell active clients directly.

Contact

Privacy questions: studio@greatbreadsny.com.