MPI Build

Effective date: October 29, 2026

Last updated: October 29, 2026

Legal business name: MPI Build, Inc.

Website: mpibuild.com

Mailing address: 2835 Sebastopol Road, Santa Rosa, CA 95407

Terms and Conditions: https://www.mpibuild.com/terms

1. About this policy

This Privacy Policy explains how MPI Build, Inc. ("MPI," "we," "us," or "our") collects, uses, discloses, keeps, and protects personal information. It applies to the MPI Build website, accounts, estimate-request services, reports, guides, templates, and related tools that link to this policy (the "Services"). These are the same Services described in our Terms and Conditions (the "Terms").

This policy covers:

visitors to our website;
customers who request a report, including homeowners and builders;
builders and other businesses that share construction documents with us;
people who use our bid-grading tool, if and when it is offered;
people who contact us; and
people who are named or shown in documents and photos that others submit to us.

"Personal information" means information that identifies, relates to, describes, or could reasonably be linked with a particular person or household. It does not include deidentified information, aggregate information, or publicly available information as those terms are defined by law.

This policy uses the same defined terms as the Terms:

Customer Material means the documents, photographs, answers, and other material you submit (Terms Section 8).
Construction Data means the estimate, bid, scope, cost, pricing, quantity, material, labor, schedule, and other construction information in anything you submit (Terms Section 9.1).
Source records means the original documents and source records you submit (Terms Section 9.2).
MPI Output means the deidentified estimates, benchmarks, datasets, and other products MPI provides or licenses to anyone other than the customer who requested the report for that property (Terms Section 9.3).

This policy does not cover:

information we receive under a separate signed engagement, such as an expert, consulting, or inspection engagement. That engagement, and any court protective order, controls that information. We still protect any personal information in it with the security measures in Section 14; or
websites and services we do not control, such as Stripe's checkout pages. Their own privacy policies apply.

If this policy and the Terms appear to conflict on a privacy matter, this policy controls for that matter. Nothing in this policy limits a right you have under the law.

2. Key points

We collect what you give us to prepare your estimate. This can include your name, contact details, property address, photos, and documents, and anything those documents contain, such as claim and policy numbers.
Stripe handles card payments on its hosted checkout. We never receive your full card number.
We use an AI service from Anthropic to classify construction line-item text. We do not send it your name, address, or contact details. Our estimating team reviews reports described as reviewed before we release them.
We use construction information to build a cost database. Before it goes into anything we sell or license, we remove names, contact details, addresses, coordinates, and claim and policy numbers. We sell and license only deidentified MPI Output.
We do not sell your personal information. We do not share it for cross-context behavioral advertising.
We keep source records to show how an estimate was produced. They can be preserved or disclosed under a subpoena or other legal process.
You can ask to access, correct, or delete your personal information, and you can make other requests described in Section 15. We honor the Global Privacy Control signal.
The Services are for adults 18 and older.

3. Notice at collection

This Section is our notice at collection under California law. It applies when we collect personal information online, by email, by phone, or in person.

What we collect. We collect these categories of personal information: identifiers; customer records; limited characteristics of protected classifications that may appear incidentally; commercial information; internet or other electronic network activity; geolocation data; audio, electronic, and visual information (photos); professional or employment information; limited inferences about a property or project; and sensitive personal information (account login credentials and precise geolocation). Section 10 lists examples of each category.

Why we collect it. We use it for the purposes in Section 5. These include providing and reviewing your estimate, processing payment, supporting your account, communicating with you, creating deidentified Construction Data, securing the Services, and meeting legal obligations.

Sale and sharing. We do not sell or share your personal information, as those terms are defined in the California Consumer Privacy Act. "Share" means disclosing personal information for cross-context behavioral advertising.

Sensitive personal information. We use and disclose sensitive personal information only for the purposes California law permits without a right to limit. Section 11 explains this.

Third parties that collect on our site. No third party controls the collection of personal information on our website. Stripe collects payment information on its own hosted checkout pages, under its own privacy policy.

How long we keep it. Section 13 explains the criteria we use to decide how long we keep each category.

Your rights. Section 15 explains your rights and how to use them.

4. Information we collect

4.1 Information you give us

Account information. Name, email address, phone number, password, account type (for example homeowner or builder), and, for builders, company name and license number.
Request and questionnaire answers. Property address, property features, square footage, construction details, project type, the role you play in the project, and similar answers. You may mark an uncertain answer as uncertain.
Insurance and claim details. We do not ask for these, but you may include them in notes or uploaded documents: insurer name, claim number, policy number, coverage amounts, loss date, adjuster names, and correspondence.
Customer Material. Documents, photos, estimates, bids, invoices, contracts, plans, permits, and other files you upload.
Communications. Messages, emails, support requests, correction requests, refund requests, and feedback you send us.
Acceptance records. The versions of the Terms and this Privacy Policy you accepted, the date, and the IP address and browser used, when you register and each time you accept an updated version. When you pay, we record that you acknowledged what to expect from the estimate.
Partner or discount information. A partner or referral code, such as a code from a partner organization like Uphelp, used to apply a discount.
Privacy requests. Information you give us to make or verify a privacy request.

4.2 What uploaded documents and photos can contain

Customer Material can contain more than construction information. Depending on what you upload, it can include:

names, addresses, phone numbers, emails, and signatures of you and of other people, such as co-owners, tenants, builders, adjusters, and attorneys;
street addresses and map or GPS coordinates;
claim numbers, policy numbers, and insurance details;
photos of home interiors and exteriors, which may show people, personal belongings, documents, screens, vehicles, and license plates;
location data and other metadata embedded in photo files, such as the date, time, device, and GPS position where the photo was taken; and
bank, payment, or other financial details printed on contracts or invoices.

We ask you not to upload information that the project does not need. Section 4.7 lists what not to send.

4.3 Information collected automatically

When you visit the website or use the Services, we and our service providers collect:

IP address and browser user agent (which shows browser type, device type, and operating system);
pages requested and the date and time of each request;
login, session, and security events; and
technical logs and error reports.

We collect this through server logs, our own performance monitor (which runs on our servers, not a third party's), and the cookies described in Section 12.

4.4 Information from other sources

Other users. A builder, a co-owner, a representative, or another customer may submit documents that name you or show your property.
Builders. Builders who share construction documents with us under a data-sharing arrangement (Section 19).
Stripe. Payment status, a transaction identifier, the amount, any discount, refund information, and a receipt. Stripe may also give us the name, email, and billing details you enter at checkout and the card brand and last four digits. We never receive your full card number or security code.
Partner organizations. A partner organization, such as Uphelp, may refer you to us and give you a referral code. If a partner sends us your name or contact details to arrange the referral, we use them only to provide the Services to you.
Public sources. We may use public records about a property, such as assessor, parcel, and permit records.
Service providers and public services. Our AI provider generates classifications of construction line items for us. The U.S. Census Bureau's public geocoding service converts a property address into map coordinates. If it cannot match the address, we use an approximate location from our own ZIP code and city table, without sending the address anywhere.

4.5 Payment information

Stripe processes payments through its hosted checkout. You enter card details on Stripe's page, not ours. MPI does not receive or store full card numbers. Stripe's use of your information is governed by Stripe's privacy policy, at https://stripe.com/privacy. Do not send card details to MPI by email or in an upload.

4.6 Sensitive personal information

We collect two kinds of sensitive personal information as part of the Services:

Account login credentials. Your account login and password. We store passwords in hashed form.
Precise geolocation. Coordinates of a property, and GPS data embedded in photo files. These can locate a property, and so a household, to within 1,850 feet, which is the legal test for precise geolocation.

Uploaded documents and photos may also contain other sensitive personal information that we do not ask for. Examples are a financial account number on a contract, a government ID number, the contents of messages you forward to us, or health information visible in a photo. We do not use this information to infer characteristics about anyone. Section 11 explains how we treat it.

4.7 Information we ask you not to send

Please do not send us:

full payment card numbers or security codes;
Social Security numbers, driver's license numbers, or passport numbers;
bank login details or full bank account numbers, unless the project requires them;
medical records or other health information;
information about children;
photos that show people, IDs, documents, or screens that the project does not need; or
personal information unrelated to the project (Terms Section 5).

If you have to upload a document that contains this kind of information, cover or redact it first when you can. If we receive it anyway, we handle it under this policy, and we may delete or redact it if we do not need it.

5. How we use personal information

We use personal information for these purposes. Section 10 maps each category to these numbers.

Provide the Services. Process your request, prepare and deliver your report, provide a bid grade, operate your account, and send information to recipients you choose.
Payments, refunds, and corrections. Confirm payment through Stripe, apply discounts, issue refunds, and handle correction requests under Terms Section 7.
Review and quality. Have our estimating team review inputs and reports, check calculations, and find and fix errors.
Communicate with you. Send confirmations, status updates, requests for missing information, receipts, and service and legal notices, and answer your questions.
Build the deidentified cost database. Extract Construction Data, deidentify it, and use it to build, verify, and improve the cost database, to prepare estimates and reports for MPI's customers, and to create MPI Output. Section 7 explains this.
Security and integrity. Protect accounts, detect and prevent fraud, misuse, and security incidents, verify identity, and debug and repair errors.
Improve the Services. Understand how the Services are used and improve features. We use aggregated or deidentified information for this where we reasonably can. We may use Customer Material to improve MPI's own estimating tools, including automated tools. We do not sell or license your photos or documents to anyone for training AI models.
Builder introductions. Introduce you to a builder when you ask for or agree to an introduction (Section 19).
Marketing to you. Send you news and offers about MPI's own services by email, as Section 21 allows. We do not use your information for cross-context behavioral advertising.
Legal and records. Keep supporting records, document how an estimate was produced, keep acceptance and consent records, meet tax, accounting, and other legal obligations, respond to legal process, and establish, exercise, or defend legal rights (Section 9).
Business transfers. Evaluate or complete a merger, acquisition, financing, reorganization, or sale of assets (Section 23).
Other purposes with notice. Any other purpose we describe to you when we collect the information, or that you agree to.

We use personal information only in ways that are reasonably necessary and proportionate to these purposes. We will not use it for a materially different purpose without giving you notice and, where the law requires, getting your consent.

6. AI-assisted processing and human review

What we use. The Services use automated calculations and AI-assisted classification. We use Anthropic's Claude models to classify construction line items (for example, assigning a construction-category code to a line such as "R&R 5/8 inch drywall") and to infer building materials from line-item text.

What we send. We limit what we send to the AI provider to line-item description text and units, construction-category codes and MPI's own fixed vocabularies, and aggregate statistics that are not linked to any customer. We do not send the AI provider names, addresses, or contact information; a customer's prices, quantities, or totals together with anything that identifies whose estimate it is; questionnaire free-text answers; photos; or whole uploaded documents. Before line items from an uploaded estimate, bid, or invoice reach the AI provider, we remove names, addresses, claim numbers, and labels specific to that estimate, such as room or group names. We keep an internal log of each AI request and decision so we can audit what was sent.

Limits on providers. Our contracts with these providers limit their use of your information to providing services to MPI.

Human review. MPI's estimating team reviews each report described as reviewed before we release it. AI-assisted processing and human review can both produce errors. Review your report and tell us about any inaccurate input or omission (Terms Section 4).

No solely automated decisions with legal effects. We do not make any decision based solely on automated processing that produces legal or similarly significant effects about you. Our estimates describe the cost of building or rebuilding a property. They do not decide your insurance coverage, a claim payment, credit, housing, employment, or any other right. We do not use automated processing to profile you.

Bid grades. A bid grade is an automated comparison of a bid to comparable projects. A person may not review a bid grade before you see it, unless we tell you it was reviewed. A bid grade is about the price of a bid. It is not a decision about you or about the builder.

No facial recognition. We do not use photos to identify people. We do not collect biometric information, such as face geometry, from photos.

7. Cost database, deidentification, and MPI Output

MPI is built on construction cost data. This Section matches Terms Section 9.

How Construction Data is used. Under the license in Terms Section 9.1, we extract Construction Data from what you submit. We use it to build, verify, and improve our cost database, to prepare estimates and reports for MPI's customers, and to create, sell, and license MPI Output. You agree to this license when you accept the Terms.

Inside our systems. The cost database stays linked to source records, including each project's location. We use that link to select comparable projects near a property and to document how each estimate was produced. Only authorized MPI personnel and service providers acting for MPI can see the identifying details.

What deidentification removes. MPI Output does not include names, contact information, street addresses, coordinates, claim or policy numbers, or original source documents. It does not report location more precisely than ZIP code.

Our safeguards. We take reasonable measures so that MPI Output cannot reasonably be used to identify a particular person or household. In particular:

we release location-level figures only when they aggregate at least 3 comparable projects;
we suppress or generalize rare or distinctive features that could single out one property; and
we review small ZIP codes and disaster areas for reidentification risk before we release figures for them.

Our public commitment. MPI publicly commits to maintain and use deidentified Construction Data and MPI Output in deidentified form. We will not attempt to reidentify it, except to test whether our deidentification process is working. This is our commitment under California Civil Code section 1798.140(m) and similar laws.

Recipients' obligations. Every person or business that receives MPI Output agrees not to reidentify or attempt to reidentify a person or household from it, not to combine it with other information for that purpose, and to require the same of anyone it further discloses the output to. We include these obligations in every agreement under which we license or disclose deidentified data. Recipients may include insurers, law firms, builders, government agencies, and other businesses.

Deidentified data is not personal information. Deidentified Construction Data and MPI Output are not personal information. Construction Data that is still linked to your source records is personal information. When you ask us to delete, we delete that Construction Data or deidentify it by removing its link to identifying details. A deletion request does not require us to remove deidentified Construction Data already in the cost database (Terms Section 9.2). The license in Terms Section 9.1 survives closure of your account.

Your own report. The report we deliver to you identifies your property, including its address. That report, and any copy shared at your direction, is not MPI Output. Figures in your report drawn from other people's Construction Data are deidentified in the same way as MPI Output.

Source records stay identifiable. Source records are personal information. They are not deidentified. They are handled as described in Sections 8, 9, and 13.

8. How we disclose personal information

We disclose personal information only as described here.

Service providers and contractors. We use businesses that process personal information for us under written contracts. They help with hosting and storage, databases, AI-assisted processing (Anthropic, Section 6), email delivery, and professional services. In this policy, "contractors" is the California law term for these businesses. It does not mean builders. Our contracts limit them to processing personal information for the purposes we specify, require them to protect it, prohibit them from selling or sharing it, and require them to meet the other duties California and other laws require. Stripe. Stripe processes payments for us. Stripe may also use information for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy.

Address geocoding. To convert a property address into map coordinates, we send the street, city, state, and ZIP code to the U.S. Census Bureau's public geocoding service. We do not send names or other information about you with the address.

People you direct us to. If you ask us to send a report or information to someone, such as your insurer, lender, builder, attorney, or adviser, we send it. Confirm the recipient and the scope. A recipient may keep or forward a copy. Copies outside MPI's systems may not be retrievable (Terms Section 11).

Builders, at your direction. We introduce you to a builder only when you ask for or agree to the introduction. We then give the builder your contact details and the project information you approve. Section 19 explains this.

MPI's estimating personnel. Authorized MPI personnel and contractors who work on estimates can access source records. Access is limited to those who need it.

Legal process and protection of rights. We disclose information when Section 9 allows.

Professional advisers and insurers. We may disclose information to our lawyers, accountants, auditors, and insurers, under duties of confidentiality, when needed for their advice or services.

Business transfers. We may disclose information as part of a business transfer (Section 23).

Deidentified MPI Output. We sell and license only deidentified MPI Output. It is not personal information.

No sale. No sharing. MPI does not sell personal information. MPI does not share personal information for cross-context behavioral advertising. We have not done either in the past 12 months. We have no actual knowledge that we have sold or shared the personal information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing.

9. Legal process, litigation, and expert work

Your report and source records can matter in an insurance dispute, appraisal, mediation, arbitration, or lawsuit about your property. This Section explains how we handle that.

Why we keep source records. We keep source records to process the submission, document how an estimate was produced, and meet legal obligations (Terms Section 9.2).

Legal process. We may preserve and disclose source records and other information when required by subpoena, court order, or other legal process, or to protect our legal rights. A party to a dispute, including an insurer or another party adverse to you, may serve a subpoena for records about your property or your estimate.

Notice to you. When we receive legal process for your records, we will try to notify you before we produce them, if the law allows and it is reasonably practical. This gives you a chance to seek protection from the court. We are not required to object to legal process for you. Some legal process forbids notice, and we will follow it.

Limited disclosure. When we disclose information under legal process, we disclose what the process reasonably requires. Where it is reasonably available, we may ask for a protective order, confidentiality treatment, or redaction.

Litigation holds. If we reasonably anticipate a claim, investigation, or lawsuit, or receive a preservation request or order, we may suspend deletion of related records. This can delay a deletion request until the hold ends. We delete the records when the hold ends and no other basis to keep them applies.

Expert and consulting work. MPI and its personnel, including our CEO, may serve as expert witnesses or consultants under separate signed engagements. In that work, we may rely on deidentified Construction Data and MPI Output. We do not use your identifiable source records in a matter for another party unless you agree or legal process requires it. We do not add information we receive under an expert or consulting engagement to the cost database unless the engagement permits it. A court or legal process may require us to produce the data behind an opinion, which can include comparable-project data and source records. If that happens, we will seek a protective order, confidentiality treatment, or redaction where reasonably available.

Protecting rights and safety. We may use and disclose information when we reasonably believe it is necessary to enforce the Terms, establish or defend a legal claim, investigate fraud or misuse, or protect the rights, property, or safety of MPI, our users, or others.

Government requests. We disclose information to a government agency only when the law requires it, when you ask us to, or when it is needed to prevent imminent harm to a person.

10. Categories of personal information (California disclosure)

The table below describes the personal information we have collected since we began offering the Services, within the 12 months before the Last updated date, and the information we expect to continue to collect. It uses the categories in California Civil Code section 1798.140(v). Purpose numbers refer to Section 5. For how long we keep each category, see Section 13.

For every category: we have not sold or shared it, and we have disclosed it for a business purpose only to the recipients listed.

A. Identifiers

Examples: Name, postal and property address, email, phone, account ID, IP address, browser user agent, Stripe transaction ID, claim and policy numbers
Sources: You; other users and builders who submit documents; Stripe; partner organizations; your device
Purposes (Section 5): 1–6, 8–11
Recipients for a business purpose: Service providers and contractors; Stripe; people you direct us to; builders at your direction; legal process recipients; professional advisers; acquirers

B. Customer records (Civ. Code 1798.80(e))

Examples: Name, signature, address, phone, insurance policy number, billing details from Stripe, financial details printed on uploaded contracts or invoices
Sources: You; other users and builders; Stripe
Purposes (Section 5): 1–6, 10, 11
Recipients for a business purpose: Same as A

C. Protected classification characteristics

Examples: Confirmation that you are 18 or older. Characteristics such as age, sex, race, or disability may appear incidentally in photos or documents. We do not ask for or use them.
Sources: You; other users
Purposes (Section 5): 1, 6, 10
Recipients for a business purpose: Service providers and contractors; legal process recipients

D. Commercial information

Examples: Reports ordered, price, discount, partner code, refunds, corrections; property and project details; Construction Data in estimates, bids, invoices, and contracts; insurance claim details
Sources: You; other users and builders; Stripe; partner organizations
Purposes (Section 5): 1–6, 8, 10, 11
Recipients for a business purpose: Same as A

E. Biometric information

Examples: Not collected. We do not extract face or other biometric data from photos.
Sources: Not applicable
Purposes (Section 5): Not applicable
Recipients for a business purpose: Not applicable

F. Internet or network activity

Examples: Pages requested, browser and device data, session and security logs
Sources: Your device
Purposes (Section 5): 6, 7, 10
Recipients for a business purpose: Service providers (hosting); legal process recipients

G. Geolocation data

Examples: Property coordinates; GPS data in photo files (sensitive)
Sources: You; other users and builders; the U.S. Census Bureau geocoding service; our own ZIP code and city table
Purposes (Section 5): 1, 3, 5 (to select comparable projects; never shown in MPI Output), 6, 10
Recipients for a business purpose: Service providers and contractors; the U.S. Census Bureau geocoding service (address only); people you direct us to; legal process recipients

H. Audio, electronic, visual, or similar information

Examples: Photos and videos of the property, including interiors, which may show people, belongings, and documents
Sources: You; other users and builders
Purposes (Section 5): 1, 3, 5 (construction information only), 6, 10
Recipients for a business purpose: Service providers and contractors; people you direct us to; legal process recipients

I. Professional or employment information

Examples: Builder company, role, license number; names and roles of adjusters, attorneys, and other professionals in documents
Sources: You; builders; other users; public license records
Purposes (Section 5): 1, 3–6, 8–10
Recipients for a business purpose: Same as A

J. Education information

Examples: Not collected
Sources: Not applicable
Purposes (Section 5): Not applicable
Recipients for a business purpose: Not applicable

K. Inferences

Examples: Limited to the property and project, such as an estimated cost, a document classification, or a bid grade. We do not create profiles about your preferences or characteristics.
Sources: Created by MPI from other categories
Purposes (Section 5): 1, 3, 5, 10
Recipients for a business purpose: Service providers and contractors; people you direct us to; legal process recipients

L. Sensitive personal information

Examples: Account login and password; precise geolocation. Incidentally, items you upload, such as a financial account number or health information visible in a photo.
Sources: You; other users and builders; your device
Purposes (Section 5): Only the permitted purposes in Section 11
Recipients for a business purpose: Service providers and contractors; legal process recipients; people you direct us to

11. Sensitive personal information

We use and disclose sensitive personal information only as reasonably necessary and proportionate for purposes that California law allows without offering a right to limit. These are listed in California Code of Regulations, title 11, section 7027(m). They include performing the Services you request, keeping the Services secure, preventing fraud and illegal activity, ensuring physical safety, short-term transient use, maintaining the quality of the Services, and other purposes that regulation allows.

In practice:

Login credentials are used only to let you sign in and to secure your account.
Precise geolocation is used to prepare and review the report you requested, to keep source records, and for security and legal purposes. A property's coordinates also stay linked to its Construction Data inside our systems, where we use them to find comparable projects near another property. We never show or disclose them in anything another customer or recipient sees. There, location is generalized to ZIP code or broader. We do not use precise geolocation to track you.
Other sensitive personal information that appears in uploads is not used to infer characteristics about anyone. We keep it only as part of the source record, and may redact it.

Because we use sensitive personal information only for these purposes, we do not offer a "Limit the Use of My Sensitive Personal Information" link. California law does not require one in this case. If we ever use sensitive personal information for another purpose, we will update this policy first and give you the right to limit that use.

Where the law of your state requires your consent before we process sensitive data, we ask for it before we process that data.

12. Cookies, analytics, Do Not Track, and Global Privacy Control

What we use. We use cookies and similar technologies that are needed to run the site, keep you signed in, and protect forms and the Services. The sign-in cookie lasts until you sign out or we end the session. We do not use third-party analytics. Our own performance monitor runs on our servers and records which pages were requested, how long they took, and any errors. Stripe may set cookies on its checkout pages for payment and fraud prevention.

No advertising cookies. We do not use advertising cookies, advertising pixels, or social media tracking pixels. We do not use session-replay tools that record your keystrokes or screen activity. We do not allow third parties to collect personal information about your online activities over time and across different websites through our site.

Your choices. You can block or delete cookies in your browser settings. If you block necessary cookies, parts of the site, such as login, may not work.

Do Not Track. Some browsers send a "Do Not Track" signal. There is no common industry standard for it. Our site does not change its behavior in response to a Do Not Track signal. We do honor Global Privacy Control, as explained below. Because we do not use cross-site tracking, our practices are the same either way.

Global Privacy Control. Global Privacy Control ("GPC") is a browser setting that tells websites you want to opt out of the sale and sharing of your personal information. We treat a GPC signal as a valid request to opt out of sale and sharing for that browser. We do not sell or share personal information, so a GPC signal does not change how the site works. You do not need to take any other step.

13. How long we keep personal information

We keep each category of personal information only as long as reasonably necessary for the purposes in Section 5. That includes as long as needed to provide the Services and reports, maintain your account, document how an estimate was produced, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When we no longer need it, we delete it or deidentify it. If a legal hold, subpoena, or preservation request applies (Section 9), we keep the affected records until the hold ends, even if a deletion request or the end of the retention period arrives first. Deidentified Construction Data and MPI Output are not personal information, and we may keep them indefinitely. Deleted information may remain in backups until the backups roll off on a regular cycle. We do not restore it to active use except to recover from an incident, and we then reapply the deletion.

Source records. We keep source records, and the reports produced from them, for 7 years after report delivery, unless a legal hold or the law requires us to keep them longer. We then delete or deidentify them.

14. Security and data breaches

Our safeguards. We maintain reasonable security procedures and practices appropriate to the nature of the information, as California Civil Code section 1798.81.5 requires. These include:

encryption of data in transit (TLS);
encryption of stored files and databases;
hashed passwords;
access limited to authorized personnel who need it;
written contracts that require service providers to protect information;
records of each sign-in, including the IP address and browser used;
limits on repeated sign-in and password-reset attempts;
training for personnel on handling personal information; and
deletion or deidentification of information we no longer need.

No system is perfectly secure. We cannot guarantee the security of information sent over the internet.

If a breach happens. If a security breach involves your personal information, we will notify you as California Civil Code section 1798.82 and other applicable laws require. We will notify you in the most expedient time possible, without unreasonable delay, and within any deadline the law sets. We will also notify regulators where the law requires. The notice will explain what happened, what information was involved, what we are doing, and what you can do.

What you can do.

Use a strong password that you do not use anywhere else. Do not share your login.
Use the secure upload in your account, not ordinary email, to send sensitive documents.
Redact information the project does not need before you upload (Section 4.7).
Never send card details to MPI. MPI will never ask for your password or full card number by email, text, or phone.
Watch for emails that pretend to be from MPI. Contact us at admin@mpibuild.com if a message looks suspicious.
Tell us promptly at admin@mpibuild.com if you suspect unauthorized access to your account (Terms Section 2).

15. Your privacy rights

15.1 Who can use these rights

California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). Residents of many other states have similar rights under their own laws.

Some of these laws apply only to businesses that meet size or volume thresholds. MPI may not meet those thresholds today. We still give every user, wherever they live, the rights described in this Section 15, on the terms described here. This is a choice we make about how we treat people. It is not an admission that any particular law applies to MPI, and it does not expand the remedies available under any law. Where a law does apply, you have every right that law gives you, and nothing in this policy limits those rights.

15.2 Your rights

Subject to the verification and exceptions described below, you can ask us to:

Know and access. Tell you the categories of personal information we collected about you, the categories of sources, our business or commercial purposes, the categories of recipients, and the specific pieces of personal information we hold about you. You can ask for a copy in a portable, readily usable format. Our response covers the 12 months before your request. If you ask, it also covers earlier information collected on or after January 1, 2022, unless that is impossible or would involve disproportionate effort.
Delete. Delete personal information we collected from you or about you. This includes source records, subject to the exceptions below.
Correct. Correct inaccurate personal information. If a record was created by someone else, such as an insurer's estimate or a builder's invoice, we may not be able to change that record. We can add a note that you dispute it, or keep your correction with it.
Opt out of sale and sharing. We do not sell or share personal information. You may still submit an opt-out request, and we will record it.
Limit use of sensitive personal information. We use sensitive personal information only for permitted purposes (Section 11). You may still contact us about it.
Opt out of targeted advertising and profiling. We do not engage in targeted advertising or in profiling that produces legal or similarly significant effects.
Get a list of third parties. Where your state law provides it, you can ask for a list of the specific third parties to which we disclosed personal information.
Not be discriminated against. We will not deny you Services, charge you a different price, give you a different quality of service, or retaliate against you for using a privacy right.

15.3 Exceptions

We may keep or decline to provide information where the law allows. Common reasons include:

completing the transaction or report you requested;
security, fraud prevention, and debugging;
complying with a legal obligation, including record-keeping and tax rules;
a legal hold, subpoena, or other legal process (Section 9);
establishing, exercising, or defending legal claims;
protecting another person's rights, including their privacy; and
information that is deidentified, such as deidentified Construction Data and MPI Output. A deletion request does not require us to remove deidentified Construction Data already in the cost database.

If we deny all or part of a request, we will tell you why, unless the law forbids it. We will not give you specific pieces of information when disclosing them would create a substantial, articulable, and unreasonable risk to the security of the information, the account, or our systems. We will never disclose a Social Security number, government ID number, financial account number, health insurance or medical ID number, account password, or security questions and answers in response to an access request. We will tell you if we hold that type of information.

15.4 How to make a request

You can make a request by:

emailing admin@mpibuild.com with "Privacy Request" in the subject line;
writing to MPI Build, Inc., Attn: Privacy, 2835 Sebastopol Road, Santa Rosa, CA 95407.

Tell us what you are asking for and which state you live in. You do not need an account to make a request. You may make an access request at least twice in any 12-month period, free of charge. We may decline or charge a reasonable fee for requests that are manifestly unfounded or excessive, and we will explain why.

15.5 How we verify requests

We must verify your identity before we give you information, delete it, or correct it. We do not need to verify a request to opt out, but we may deny one we believe is fraudulent.

If you have an account, we may ask you to sign in, or to confirm your request from the email address on the account.
If you do not have an account, we will ask you to give at least two pieces of information that match what we hold, such as your name, the property address, and a claim or report reference.
For specific pieces of information, or for deleting sensitive records, we ask for at least three matching pieces of information, and may ask for a signed statement, under penalty of perjury, that you are the person the information is about.

We use the information you give us for verification only to verify you and to record the request. If we cannot verify you, we will tell you and explain why. We may then treat a request to delete as a request to opt out.

15.6 Authorized agents

You may use an authorized agent to make a request for you. We will ask the agent for proof that you gave them signed permission. We may also ask you to verify your own identity directly with us, or to confirm directly with us that you gave the agent permission. These steps do not apply if the agent holds a valid power of attorney under California Probate Code sections 4121 to 4130 or a similar law. A parent or guardian may make a request for a minor.

15.7 When we respond

We confirm receipt of a request to know, delete, or correct within 10 business days, and explain how we will process it.
We respond within 45 calendar days after we receive the request. If we need more time, we may take up to 45 more days. We will tell you within the first 45 days that we need more time and why.
We act on a request to opt out as soon as feasibly possible, and no later than 15 business days after we receive it.
When we delete or correct information, we also tell our service providers and contractors to do the same, where the law requires.

15.8 Appeals

If we decline your request, you may appeal. Reply to our decision, or email admin@mpibuild.com with "Privacy Appeal" in the subject line, within 60 days after our decision. A person who did not make the first decision will review your appeal. We will tell you the result in writing, and explain it, within 45 days after we receive the appeal, or within any shorter period your state law requires. If we deny your appeal, you may contact the Attorney General of your state. California residents may also contact the California Privacy Protection Agency at cppa.ca.gov.

15.9 No financial incentive

We do not offer a financial incentive, price difference, or different level of service in exchange for your personal information. The price for a report does not depend on whether you share personal information with us, beyond what we need to prepare the report. Partner pricing, such as a discount for clients referred by a partner organization, is based on the referral relationship. It does not depend on giving us extra personal information.

16. More California information

Shine the Light (Civil Code section 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes. California residents may ask about this once a year by emailing admin@mpibuild.com with "Shine the Light" in the subject line, or by writing to us. We will respond within 30 days.

California Online Privacy Protection Act. This policy describes the categories of personal information we collect online (Sections 4 and 10), the categories of third parties we share it with (Section 8), how you can review and correct it (Section 15), how we respond to Do Not Track signals (Section 12), whether third parties collect information about your online activities over time and across sites (Section 12), how we tell you about changes (Section 27), and its effective date (top of this policy).

Data broker status. MPI is not a data broker under California Civil Code section 1798.99.80. A data broker sells the personal information of consumers with whom it has no direct relationship. MPI does not sell personal information. MPI sells and licenses only deidentified MPI Output, which is not personal information.

Minors. The Services are for adults 18 and older. If you are a California resident under 18 and you posted content on the Services, you may ask us to remove it by emailing admin@mpibuild.com. Removal may not ensure complete or comprehensive removal of the content, for example if someone else copied or reposted it. Section 22 explains more.

California Privacy Protection Agency. You may learn more about your California privacy rights at cppa.ca.gov.

17. Other U.S. state privacy laws

General rights. Many states give their residents privacy rights. These include Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and more states are adding laws. Depending on your state, you may have the right to confirm whether we process your personal information, access it, get a portable copy, correct it, delete it, and opt out of sale, targeted advertising, and certain profiling. In some states, you can also ask for a list of specific third parties, or question the result of certain profiling. Section 15 explains how to use these rights. We extend them to residents of every state.

Sensitive data. Some states treat precise geolocation and other information as sensitive data. Section 11 explains how we handle it.

Nevada. We do not sell covered information as defined in Nevada Revised Statutes chapter 603A. Nevada residents may still send an opt-out request to admin@mpibuild.com.

Washington My Health Data Act. We do not intend to collect "consumer health data" as defined in the Washington My Health Data Act (RCW 19.373) or similar laws in other states. Do not upload medical records or health information. If a photo incidentally shows medical equipment or medicine, we do not analyze it for health information. If an accessibility feature, such as a ramp, grab bar, or widened doorway, is part of the construction scope, we record it only as a construction feature to estimate cost. We do not use it to infer anyone's health. If we receive health information we did not ask for, we may delete or redact it.

18. People in uploaded documents and photos

Documents and photos that users submit often contain information about other people. Examples are co-owners, family members, tenants, neighbors, builders, adjusters, attorneys, and people visible in photos.

Uploaders' responsibilities. If you upload Customer Material, you must have the right to provide it, including permission from the property owner and any other party where it is required (Terms Section 5). Avoid photographing people, children, IDs, documents, and screens that the project does not need. Crop or redact them when you can. Do not upload personal information unrelated to the project.

How we handle it. We use information about other people only for the purposes in Section 5. We do not use photos to identify people. We do not contact people named in documents for marketing. We never include their names, contact information, addresses, coordinates, or claim or policy numbers in MPI Output. Their information in source records is protected, kept, and deleted on the same terms as other source records.

If you are named or shown in something we received. You have the same rights as a user under Section 15. Contact admin@mpibuild.com with "Privacy Request" in the subject line. Tell us what you think we have, such as the property address. We will verify your identity as described in Section 15.5. We may need to tell the person who submitted the material, or ask them to help us find it. Where we can, we will delete or redact your information from source records, subject to the exceptions in Section 15.3, including legal holds and our need to document how an estimate was produced.

19. Builders and business contacts

Builder accounts and business contacts. We collect information about builders and about people who act for businesses, such as insurers, law firms, lenders, and partner organizations. This includes name, company, role, contact details, license number, and communications. We use it to provide the Services, manage the business relationship, communicate, and meet legal obligations. Business contacts have the rights in Section 15.

Builder data-sharing arrangement. A builder MPI introduces may provide construction data to MPI, such as build documents, estimates, invoices, and contracts, in exchange for client referrals. MPI does not pay referral fees and does not receive them. MPI discloses this relationship when it makes an introduction. Data a builder provides is handled as described in Terms Section 9 and Section 7 of this policy.

Builders' responsibilities. A builder must have the right to share the documents it provides, including any permission or notice its own clients require. Builder documents often name the builder's clients. We use those names and addresses only in source records, never in MPI Output. The Construction Data license in Terms Section 9.1 covers a builder's uploads and continues after the account closes.

Introductions to builders. When we introduce a customer to a builder, we share the customer's contact details and project information only after the customer asks for or agrees to the introduction. We do not provide customer lists to builders. We do not disclose personal information to builders as part of the data-sharing arrangement except at the customer's direction.

Separate agreements. A separate written contributor or data agreement signed by MPI controls the contribution, use, and retention of the material it covers (Terms Section 9.7).

20. Bid-grading tool

When we offer it, our bid-grading tool lets a person submit a bid, with or without an account, and receive a grade that compares the bid to comparable projects. To use it, you must be 18 or older and accept the Terms, which include the Construction Data license (Terms Section 9.1).

A bid may name the builder who prepared it and the property owner. We handle that information as Customer Material and source records under this policy. We extract and deidentify the Construction Data in the bid for the cost database. A bid grade is about the price of a bid. It is not a rating of a builder or a person, and we do not publish grades. Only submit a bid you have the right to share (Terms Section 5).

21. Email and other communications

Service messages. We send transactional and relationship messages, such as a welcome email, password resets, a thank-you when you pay, notices when your report is shared or updated, replies to your messages, requests for missing information, and legal notices. Stripe sends your payment receipt. You cannot opt out of these while you have an active request or account, because they are part of the Services.

Marketing email. We may send marketing email about MPI's own services to customers and to people who ask to hear from us. Every marketing email identifies MPI, includes our postal address, and has an unsubscribe link. You can also unsubscribe by emailing admin@mpibuild.com. We honor unsubscribe requests within 10 business days. We do not sell or rent our email list. We keep your email address on a suppression list after you unsubscribe, only to make sure you stay unsubscribed.

Text messages. We do not send marketing text messages.

22. Children

The Services are not directed to children. You must be 18 or older to create an account, buy a report, or submit information. We do not knowingly collect personal information from anyone under 18, other than incidental information that appears in documents or photos that an adult submits. We do not knowingly sell or share the personal information of anyone under 16.

If we learn that a person under 18 has created an account or submitted information, we will close the account and delete the information, except as the law requires us to keep it. If you believe a child has given us personal information, contact admin@mpibuild.com. If a photo you submitted shows a child, you may ask us to delete or redact it.

23. Business transfers

If MPI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its business or assets, personal information may be disclosed or transferred as part of that transaction. We will require the recipient to protect the information consistent with this policy. If the recipient later wants to use or disclose personal information in a way that is materially inconsistent with this policy, it must give you prior notice, as the law requires.

24. Where we store information

MPI is based in the United States. We store personal information in the United States. The Services are intended for people and properties in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

25. Your choices

Do not submit what is not needed. Many questionnaire items are optional. Redact unneeded information before you upload.
Choose recipients. You decide who receives your report (Section 8).
Builder introductions. You decide whether to be introduced to a builder.
Marketing. Unsubscribe at any time (Section 21).
Cookies. Manage cookies in your browser (Section 12). Turn on GPC in your browser if you wish.
Account. Update your account information at any time. You may request account closure at admin@mpibuild.com. Closing an account does not erase every record, and it does not affect copies shared outside MPI (Terms Section 13).
Privacy rights. Use the rights in Section 15.

If you do not agree to the Construction Data license in Terms Section 9.1, do not submit information to MPI. We cannot prepare an estimate without it.

26. Other websites and services

The Services may link to websites and services we do not control, such as Stripe's checkout, partner organizations, and builders' websites. This policy does not apply to them. Read their privacy policies before you give them information.

27. Changes to this policy

We may update this policy. The updated policy will show a new Last updated date at the top. If we make a material change, we will give reasonable notice before it takes effect, through the website, by email, or by an account notice. We will get your consent where the law requires it, for example before using personal information we already hold for a materially different purpose. We will not apply a materially less protective change to information collected before the change without your consent. We review this policy at least once every 12 months. Earlier versions remain available at addresses of the form https://www.mpibuild.com/privacy/YYYYMMDD, and you may ask us for a copy.

28. Accessibility

We want this policy to be easy for everyone to read. If you need this policy in another format, such as large print or read aloud, contact admin@mpibuild.com and we will provide it.

29. Contact us

For privacy questions, requests, and complaints, contact:

MPI Build, Inc.

Attn: Privacy

2835 Sebastopol Road, Santa Rosa, CA 95407

Email: admin@mpibuild.com