Privacy Policy

Last updated: October 7, 2026

Who this policy covers

ReadMyBlueprint is operated by ReadMyBlueprint LLC, a Minnesota limited liability company. For anything in this policy, you can reach us at support@readmyblueprint.com.

What we collect

• Account information: your email address and a securely hashed password (we never store your actual password — see "How we protect your data" below).
• Your uploaded plan sets: the PDF files you upload, the vector geometry we extract from them, your calibration settings, and the takeoff items and material mappings you create.
• Billing information: your subscription plan, subscription status, and any purchased upload credits. We do not collect or store your card number, expiration date, or CVC — those go directly to our payment processor, Stripe. We only keep a reference ID Stripe gives us so we know which Stripe customer you are.
• Basic technical data: IP address and timestamps on login attempts, kept briefly to prevent abuse (see "Security" below).

Analytics and advertising measurement. To understand how people find and use ReadMyBlueprint, we use:

• Cloudflare Web Analytics on this marketing site — cookie-free, aggregate page-view counts.
• Google Analytics 4 on this site and in the web app — page views and a few product events (for example: sign-up, upload started, purchase). It uses cookies and a pseudonymous browser identifier.
• Google Ads conversion measurement — if you arrive from one of our Google ads, the ad-click identifier and campaign tags in the link are stored in your browser and passed to the web app, so we can tell which ad led to a sign-up or purchase.
• PostHog on this site and in the web app — product analytics and session replay, so we can see where people get stuck. Replays mask everything typed into form fields; we don't record passwords or card details. It uses cookies/local storage and a pseudonymous identifier.

None of these tools receive your plan files, and we don't sell this data or use it to build advertising profiles about you. Our legal basis for analytics is our legitimate interest in improving the product and measuring which marketing works, or your consent where the law requires it.

Why we collect it, and our legal basis

Everything above is collected because it's directly necessary to provide the service you signed up for: authenticating you, running your takeoff, remembering your material library between sessions, and billing you correctly for the plan you chose. If you're covered by the GDPR, our legal basis for each category is:

• Account, plan, and billing data: necessary to perform our contract with you (running the account and subscription you signed up for).
• Login IP/timestamp data: our legitimate interest in keeping accounts secure from brute-force attacks, balanced against your privacy — it's kept only briefly and used for nothing else.
• Billing records kept past account deletion: our legal obligation to retain tax/accounting records under applicable law.

Who we share it with

We don't sell your data, ever. A few outside companies process data on our behalf, strictly to run the service:

• Stripe — processes all payments and stores your card details directly; we never see or touch them.
• Render — hosts our backend application and database.
• Vercel — hosts the web app you use in your browser.
• Cloudflare — provides DNS, and runs cookie-free aggregate traffic analytics on our marketing site.
• Google — Google Analytics 4 and Google Ads conversion measurement (see "Analytics and advertising measurement" above).
• PostHog — product analytics and session replay on our site and web app, hosted in the United States.
• Sentry — receives error reports when something breaks in the app, so we can fix it. We configure it not to send personal data such as your email or request contents.
• Resend — sends transactional email on our behalf (account confirmation, password resets, and similar service emails). It sees your email address and the content of those messages, nothing else.

These providers are based in the United States. Where your data crosses from the EU/EEA to the US, it's covered by those providers' own Standard Contractual Clauses and data-processing agreements.

How long we keep it

We keep your account and uploaded plan sets for as long as your account is active. If you delete your account, we delete your uploaded files and takeoff data within 30 days, except where we're required to keep billing records longer for tax/accounting law.

How we protect your data

• Passwords are hashed with PBKDF2-SHA256 before storage — we can't see your actual password, and neither can anyone who gained access to our database.
• All traffic to and from the app is encrypted (HTTPS).
• Every document, takeoff item, and material mapping is scoped to your account — another customer's session cannot see or reach yours, even by guessing an ID.
• Login attempts are rate-limited to slow down password-guessing attacks.

If a data breach ever puts your personal data at meaningful risk, we'll notify the relevant authority within the legally required timeframe and tell you directly, without undue delay.

Your rights

If you're in the EU/EEA/UK (or anywhere with similar data protection law), you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Correct inaccurate data.
• Ask us to delete your data (subject to the retention note above).
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email support@readmyblueprint.com. We'll respond within 30 days.

Children

ReadMyBlueprint is a professional tool for construction estimators and is not directed at anyone under 18.

Changes to this policy

If we make a material change to how we handle your data, we'll email account holders before it takes effect, and update the date at the top of this page.

Contact

Questions about this policy: support@readmyblueprint.com.