Last updated October 19, 2026
1. Who is responsible for your data
The controller of personal data processed through the service is the administrator of the submittal.io service. You can reach the administrator about any privacy matter at [email protected]. Where a customer organization uses the service to manage its own projects, that organization decides which people it invites and which documents it uploads, and for that project content we act on the organization's behalf and follow its instructions.
2. Who this policy covers
This policy covers visitors to submittal.io, people who try the one-time demo, account holders, internal members of a workspace and external reviewers and subcontractors who join a paid project at no cost. It does not cover websites of other companies that you reach through links on our pages.
3. Data you give us
- Account data, such as your name, work email address, the company name you enter, your role and your password, which we store only as a salted hash
- Workspace and project data, such as project names, spec books, drawings, product data, shop drawings, review comments, stamps (Approved, Approved as noted, Revise and resubmit, Rejected, For record only), due dates and transmittals
- Billing data, such as the plan you choose, billing period, billing name and address and tax details if you enter them; full card numbers go directly to our payment provider and are never stored on our servers
- Messages you send to [email protected] and the content of support requests made inside your account
4. Data collected automatically
- Technical data needed to run and protect the service, such as IP address, browser type, device type, request time and error logs
- Security records, such as sign-in times, one-time code requests and, on Business and Enterprise plans, the audit log of actions in a workspace
- Aggregate usage statistics measured without cookies and without identifying you across websites
5. Data from other people
A colleague may invite you to a workspace or add you as a reviewer or subcontractor on a package, which gives us your name and email address. Documents uploaded to a project may contain names and contact details of people working on that project, for example on a shop drawing title block or a product data cover sheet.
6. Why we use personal data
- To create and run your account, send sign-in codes and deliver the features of your plan, including the spec to submittal log builder, package review and reminders
- To process payments, issue invoices, renew subscriptions and keep accounting records
- To answer support requests and send service messages, such as review reminders, ball in court notices and billing notices
- To keep the service secure, detect abuse, investigate incidents and enforce our terms of service
- To improve the service using aggregate statistics that do not identify individual users
- To meet legal obligations, such as tax and accounting rules
7. Legal bases under GDPR and UK GDPR
Where GDPR or UK GDPR applies, we rely on performance of a contract for running your account and projects, on legal obligation for billing and tax records, and on legitimate interests for security, fraud prevention, aggregate statistics and service messages that relate to your projects. Where we rely on legitimate interests you can object at any time, as described below.
8. AI processing of spec text
When you upload a spec book, the text of its sections is processed by AI to find Part 1 Submittals articles and build register rows. Spec text sent for AI processing is not used to train models. We send only the text needed to read the sections, and the results stay in your project.
9. No sale of personal data
We do not sell personal data, we do not share it for cross-context behavioral advertising and we do not use it to build advertising profiles.
10. Categories of recipients
We share personal data only with service providers that help us run the service, under contracts that limit their use of the data to the services they provide to us.
- A hosting provider in the US that stores the service and its databases
- A payment provider that processes subscription payments and card data
- An email delivery provider that sends sign-in codes, reminders and service messages
- An AI text processing provider that reads spec section text to build register rows
- Professional advisers, such as accountants and lawyers, where needed
- Public authorities, when the law requires us to disclose data
Within a project, data you upload is visible to the members, reviewers and subcontractors the workspace owner invites, according to their roles.
11. International transfers
Data may be processed in the United States and in other countries where our service providers operate. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred, we use safeguards recognized by law, such as standard contractual clauses. Enterprise plans can keep project data in US data residency.
12. Cookies and similar technology
We use only cookies that are strictly necessary for the service to work: a session cookie that keeps you signed in, a security token that protects forms against cross-site request forgery and a preference cookie that remembers settings you choose. These cookies do not track you across other websites, which is why the site shows no cookie banner. Our analytics run without cookies and measure pages and events in aggregate. We do not use advertising pixels.
13. How long we keep data
- Account data is kept while your account exists and deleted after the account is closed, except where we must keep it longer by law
- Project content is kept while the workspace exists; archived projects stay readable and exportable until the workspace owner deletes them or closes the workspace, and Enterprise plans can set custom retention
- Billing and invoice records are kept for the period required by tax and accounting law
- Security logs are kept for a limited period needed to investigate incidents
- Support messages are kept while needed to handle the request and for a reasonable period after
14. Deletion on request
You can ask us to delete your account and personal data at any time by writing to [email protected]. We confirm your identity, offer an export of the submittal log to Excel, CSV or PDF before deletion if you want one, and then delete the data, except records we must keep by law. If you were invited to a project owned by another organization, we may refer content requests to that organization, because it controls the project record.
15. How we protect data
Data is encrypted in transit and at rest. Access inside a workspace follows roles, Business and Enterprise plans add SSO and an audit log, and our staff access production data only when needed to run or support the service. More detail is in our security overview. No method of storage or transmission is completely secure, and we will notify affected users and authorities of a breach where the law requires it.
16. Rights in the EEA and the UK
If GDPR or UK GDPR applies to you, you have the right to access your personal data, to correct it, to have it deleted, to restrict or object to processing, to receive your data in a portable format and to withdraw any consent you gave. You also have the right to complain to your local data protection authority, although we ask that you contact us first so we can try to fix the problem.
17. Rights in California
If you are a California resident, you have the right to know what personal information we collect, use and disclose, to access it, to request its deletion, to correct inaccurate information and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in California law. We will not discriminate against you for using any of these rights. You can use them yourself or through an authorized agent.
18. How to use your rights
Send your request to [email protected] from the email address linked to your account, or explain how we can verify you. We answer within the period the law sets, usually within one month, and we tell you if we need more time. Requests are handled at no cost unless they are clearly unfounded or excessive.
19. Children
The service is built for construction professionals and is not directed to children. We do not knowingly collect data from anyone under 16. If you believe a child gave us personal data, write to us and we will delete it.
20. Changes to this policy
We may update this policy when the service or the law changes. We change the date at the top of the page, and for significant changes we notify account holders by email before the change takes effect.
21. Contact
Questions about this policy go to [email protected]. For billing questions see our refund policy, and for general help see the contact page.