Privacy Policy

1. Who's in charge of the data

Kudzu is used by companies ("customers") and the people they invite ("users"). The project information your company puts in Kudzu, such as daily logs, photos, warranty items, expenses, and subcontractor and homeowner contacts, belongs to your company. We handle it on your company's behalf and follow its instructions. If you have a question about that information, start with your company's Kudzu Admin.

We make our own decisions about account details, billing, and how the app and website are used. This policy covers both.

2. What we collect

You give us:

• Account details: name, email address, phone number (optional), company name, role, and your sign-in method (email with a password or a one-time sign-in link and code, Apple or Google).
• Project records: daily logs (crew, hours, work performed, deliveries, equipment, inspections, delays, safety and theft or vandalism reports, including police report numbers and responding officers when entered), weekly owner summaries, warranty items, notes and project details.
• Photos and files: jobsite photos, receipt images, and statement files (CSV or Excel) you upload.
• Contacts: subcontractors, owner contacts, and homeowner or tenant names, phone numbers and emails your company enters.
• Expense records: vendor, date, amount, sales tax, project, cost code or category, notes, and the last four digits of a card. We don't collect full card numbers from statements, and we don't need them.
• Support messages you send us.

Collected when you use Kudzu:

• Location: the Kudzu app doesn't use your phone's location today. When job weather and photo location stamps are added, the app will ask your permission first, and you can turn it off in your phone's settings. We use a project's street address, which your company enters, to find it on a map and, once that feature is added, to fetch the day's weather.
• Device and usage information: device type, operating system, app version, crash reports, and basic logs of actions (for example, "daily log filed"). These keep the app working and power the Activity feed your company sees.
• Website: standard server logs (IP address, browser, pages visited). This website uses no advertising or tracking cookies.

From others:

• Apple or Google sign-in: your name and email, if you choose that sign-in.
• App stores and our payment providers: when paid plans launch, whether a subscription is active. We never see your full card number. Kudzu is free during its pilot.
• Accounting software: if your company connects QuickBooks Online (when that feature is available), we receive lists such as projects, items and vendors to match them to Kudzu.

3. How we use it

• To run Kudzu: store your records, build daily reports and PDFs, email them to the people your company chooses, and show your team's Activity feed.
• To find a project's street address on a map, and, when those features are added, to fetch the day's weather from the National Weather Service and to read the vendor, date and total from receipt images.
• When paid plans launch, to manage subscriptions, free trials and billing.
• To send account emails: invites, password resets, receipts and important notices. We don't send marketing email unless you ask for it.
• To support you, fix problems, keep Kudzu secure, and prevent misuse.
• To meet legal obligations.

We don't sell your data or use it to train AI models. If AI features are added, data sent to AI providers to power them isn't used to train their models.

We may remove names, contact details and anything else that identifies your company or people from usage data, and use that de-identified data to improve Kudzu. We don't sell it, and we don't try to re-identify it.

4. Who can see it inside your company

Your company's Admin decides who's in the company and which projects each person is on. People see the projects they're assigned to; Admins see everything in the company. Notes marked "Internal only" stay off emailed reports and owner summaries. Weekly owner summaries go only to the contacts your PM picks, and only when the PM sends them.

5. Who we share it with

We don't sell or rent personal information, and we don't share it for advertising. We share it only:

• With service providers that help us run Kudzu, under contracts that limit them to that work:
  • Supabase: database, sign-in and file storage (United States)
  • Cloudflare: this website, the web app, domain and email routing
  • Resend: email delivery
  • Expo: app builds and updates
  • The US Census Bureau geocoder and OpenStreetMap: finding a project's street address on a map, and the map previews in the app (the address is sent; nothing about you is)
  • Apple and Google: sign-in and app stores
  • When those features are added: an AI provider to read receipts and statement files (not used to train its models), and Stripe and RevenueCat for payments and subscriptions
• With the people your company sends things to, such as daily reports, photo reports and owner summaries.
• With accounting software your company connects, if it chooses to.
• If the law requires it, or to protect people's safety or Kudzu's rights.
• If Kudzu is sold or merged, in which case this policy still applies to your information.

We'll update this list before we add a new service provider that handles personal information.

6. How we protect it

Information is encrypted in transit and at rest. Each company's records are walled off from every other company's at the database level. Access by our staff is limited to what's needed to support you. No system is perfect, and we'll tell affected customers promptly if a breach affects their information.

7. How long we keep it

We keep your company's records while its account is active. If the company closes its account, it has 90 days to export its records. After that we delete them, except what we must keep for tax or legal reasons, and backups roll off within 35 days. De-identified data, described in section 3, isn't personal information and may be kept.

8. Deleting your account

You can delete your Kudzu account any time in the app (tap your initials at the top of the screen, then Account → Delete account), or by emailing privacy@kudzupm.com from the address on your account. Deleting your account removes your sign-in and personal profile. Records you created for your company, like filed daily logs, stay with your company and show your name as their author, because they're part of its project file. An Admin who deletes the company account deletes everything.

9. Your choices and rights

• Change your profile in the app at any time.
• Turn off location, camera or notification access in your phone's settings.
• Ask us for a copy of your personal information, to correct it, or to delete it by emailing privacy@kudzupm.com. We'll answer within 45 days. If the information is part of your company's records, we may refer you to your company's Admin.
• Depending on where you live, state law may give you more rights, including the right to appeal our answer. Email us and we'll explain how. We won't treat you differently for using them.

10. Children

Kudzu is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.

11. Where it's stored

Kudzu stores information in the United States.

12. Changes

If we change this policy in a way that matters, we'll update the date above and tell Admins by email or in the app before the change takes effect.

13. Contact

privacy@kudzupm.com · CDV ECOMM, LLC, 2827 Cummings Highway, Chattanooga, TN 37419