⚠️ DRAFT — NOT LEGAL ADVICE — NOT REVIEWED Status: Initial draft, 2026-05-15. Must be reviewed by qualified counsel before being published or relied upon.
Effective Date: [TBD — not yet in effect] Last Updated: 2026-05-15 (initial draft)
This Privacy Policy explains what personal information the EARL platform ("Service") collects, how we use it, and what rights you have over it. "We," "us," and "our" refer to MTC Mechanical / Holstein Electric, the operators of EARL.
| Data | Purpose | |
| --- | --- | |
| Email address | Login identity, account communications, audit trail | |
| Display name | Shown in the UI | |
| Role (set by your admin) | Access control | |
| Tenant ID | Determines which workspace you belong to | |
| Last login timestamp | Activity tracking | |
We use the data we collect only to:
- Operate and deliver the Service to you - Authenticate your identity and enforce access controls - Send transactional communications (billing notices, security alerts) - Maintain audit logs for security and compliance - Improve Service reliability and performance (aggregated/anonymized) - Comply with applicable law or respond to valid legal requests
We do not sell your personal data. We do not use your project content, bid data, or personal information for advertising. We do not use your data to train AI models or share it with AI providers beyond what is necessary to process your specific requests (e.g., sending a plan page to an AI model to extract quantities — processed transiently, not retained by the model provider).
We use a single first-party session cookie named `session`, set by the EARL dashboard server.
| Cookie | Purpose | Type | Duration | |
| --- | --- | --- | --- | |
| `session` | Keeps you logged in after authentication | Functional (required) | 12 hours; 2-hour inactivity timeout | |
We do not use: - Advertising cookies or trackers - Analytics cookies (Google Analytics, Mixpanel, etc.) - Cross-site tracking pixels - Third-party social media cookies
For more details, see our [Cookie Policy](COOKIE_POLICY.md).
We share data with the following third parties only as necessary to operate the Service:
| Data Type | Retention Period | |
| --- | --- | |
| Account and profile data | Retained while account is active; deleted within 30 days of account termination | |
| Project data (bids, documents, quotes) | Retained while your subscription is active | |
| Financial records (invoices, billing history) | 7 years (required for accounting and tax compliance) | |
| Audit logs | Retained indefinitely during service operation; exported and trimmed quarterly | |
| Session cookies | Expire within 12 hours of issuance | |
Your data is stored in a SQLite database on the EARL host server. We implement the following safeguards:
- TLS encryption in transit (HTTPS enforced) - Session cookies are signed and set with HttpOnly, Secure, and SameSite=Lax flags - Role-based access control — users only see their tenant's data - Audit logging of all significant access and change events - Rate limiting on authentication endpoints - Regular backups (daily, retained 90 days off-site)
For a detailed security overview, see our [Security Overview](SECURITY_OVERVIEW.md).
No system is perfectly secure. We will notify you promptly of any security incident that materially affects your data.
You have the following rights with respect to your personal data:
- Access: You can request a copy of the personal data we hold about you - Correction: You can request correction of inaccurate data - Export: You can export your project data at any time through the account settings - Deletion: You can request deletion of your account and associated data (subject to legal retention requirements for financial records) - Portability: Upon request, we will provide your data in a machine-readable format
To exercise any of these rights, contact us at [email protected] with "Privacy Request" in the subject line. We will respond within 30 days.
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will promptly delete the data.
We may update this Privacy Policy periodically. When we do, we will update the "Last Updated" date and notify active users by email at least 14 days before significant changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
For privacy questions, data requests, or concerns:
MTC Mechanical / Holstein Electric Email: [email protected] Subject line: "Privacy Request — EARL"
*⚠️ REMINDER: This document is a first draft prepared for attorney review. It is NOT legal advice and has NOT been reviewed by qualified legal counsel. Do not publish or share with customers until attorney review is complete.*