This Privacy Policy describes how Mezano Construction Management LLC ("Company", "we", "us", or "our") collects, uses, and discloses information about users of the Mezano Construction Management Platform ("Platform"), accessible at mezanocm.com. By using the Platform, you agree to the practices described in this Policy.

Information We Collect

Information You Provide

• Account registration data: name, email address, company name, job title, phone number
• Billing information: processed securely via Stripe — we do not store full card numbers
• Project data: project names, descriptions, locations, timelines, contract values
• Employee data: names, contact details, payroll information, GPS clock-in/out records
• Contract and document data: signed contracts, lien documents, W-9/tax forms, estimates
• Communications: support requests, feedback, and messages sent to us

Information Collected Automatically

• Device and browser information (IP address, browser type, operating system)
• Usage data: pages visited, features used, session duration, click patterns
• GPS/location data: when employees use the time clock feature (with consent)
• Cookies and similar tracking technologies (see Cookies and Tracking section)

Mobile App & Location Data

The Mezano field application collects additional information from workers on a job site. This section describes exactly what is collected, when, and why.

Precise Location

When a worker clocks in, the app records precise GPS coordinates to confirm they are at the assigned job site. While the worker remains clocked in, the app checks location periodically using an Android foreground service to determine whether they have left the site, so the timesheet can be closed accurately.

• Location is collected only between clock-in and clock-out
• A persistent notification is shown the entire time the service is active
• The service stops immediately when the worker clocks out
• We do not collect location when a worker is off the clock
• We do not request background location outside an active shift

Camera and Photographs

The app captures a photograph at clock-in and clock-out to verify the punch is genuine and to prevent time-clock fraud. Workers may also upload job site photographs, receipts, and documents. Photographs are stored with the associated timesheet and are visible only to administrators and managers at the worker's own company.

Notifications

The app sends notifications about clock-in status, site departure warnings, and schedule changes. Device push tokens are stored to deliver these. The persistent notification shown during an active shift cannot be dismissed while the worker is clocked in; it disappears on clock-out.

Worker Rights

A worker's account is created by their employer, who controls their employment records. Location permission may be denied or revoked at any time in device settings, in which case the app cannot verify job-site presence and clock-in will not function. To request deletion of a personal account, see our Account & Data Deletion page.

How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Platform and its features
• Process payments and manage subscriptions via Stripe
• Send transactional emails (invoices, contract notifications, payroll summaries) via Resend
• Send transactional text messages (appointment confirmations, reminders, and technician arrival updates) via Twilio, only to customers who have agreed to receive them
• Generate reports, payroll calculations, and compliance documents
• Enforce compliance with Arizona contractor regulations and licensing requirements
• Respond to customer support inquiries
• Monitor and analyze usage patterns to improve user experience
• Comply with applicable laws and legal obligations
• Detect, prevent, and address fraud or security issues

How We Share Your Information

We do not sell your personal information. We may share information with the following service providers:

• Stripe Inc. — payment processing and subscription billing
• Resend — transactional email delivery
• Twilio Inc. — SMS/text message delivery
• Microsoft Azure — cloud infrastructure, database hosting (Canada Central region)
• Azure OpenAI / Azure Speech Services — AI assistant features
• Azure Document Intelligence — document and receipt processing
• Anthropic PBC — Claude API for AI Agent features

We may also disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect rights, property, or safety. In the event of a merger or acquisition, your data may be transferred and we will notify you before it becomes subject to a different privacy policy.

SMS/Text Messaging

If you provide your mobile number to a contractor that uses the Platform and agree to receive text messages, we send transactional messages about your scheduled service visits (booking confirmations, appointment reminders, and technician arrival updates) on that contractor’s behalf. Messages are delivered through Twilio Inc. Message frequency varies by appointment. Message and data rates may apply. You can opt out at any time by replying STOP, and reply HELP for help. Consent to receive text messages is not a condition of purchase of any goods or services. Mobile phone numbers and SMS consent information are not shared with or sold to third parties or affiliates for marketing or promotional purposes.

Data Retention

We retain personal data for as long as your account is active or as needed to provide services. After account termination, we retain data for a minimum of 7 years to comply with construction industry legal requirements, tax obligations, and Arizona lien law statutes. You may request deletion of non-essential data by contacting us at info@mezanocm.com.

Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• Azure SQL database with encryption at rest
• Multi-tenant data isolation enforced by CompanyId at the database level
• Role-based access controls and permission management
• Regular security audits and monitoring

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Cookies and Tracking

The Platform uses cookies for session management, user preferences, and analytics. You can manage your cookie preferences at any time using the Cookie Settings panel or through your browser settings.

Your Rights

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data (subject to legal retention requirements)
• Portability — Request your data in a machine-readable format
• Objection — Object to certain types of processing
• Withdrawal of Consent — Where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at info@mezanocm.com. We will respond within 30 days.

GDPR — European Economic Area Users

If you are located in the EEA, UK, or Switzerland, additional rights and protections apply. See our full GDPR Data Processing Notice.

Children's Privacy

The Platform is intended for business use only and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will take steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users via email and by posting a notice on the Platform at least 14 days before material changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

Contact Us