Privacy Policy

1. Introduction

This Privacy Policy describes how Sandspit ("Sandspit," "we," "us," or "our") collects, uses, and protects information when you use the Sandspit add-in for Microsoft Excel and its connection to Procore (the "Service"), and when you visit sandspit.app (the "Website").

By using the Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Information You Provide

We may collect information you voluntarily provide, including:

• Name, email address, and company name
• Authentication tokens issued when you sign in with Procore
• Feedback, messages, or support requests

2.2 Project and Workflow Data

When you connect Sandspit to Procore, we may process:

• Project metadata
• Budgets, forecasts, change events, Direct Costs, commitments, and other Procore records you work with through the Service
• Line items, cost codes, budget codes, vendors, dates, descriptions, custom fields, and workflow status values associated with those records
• User names, roles, permissions, assignments, and approval or response history associated with those records
• Files you upload for import or extraction, such as spreadsheets, PDFs, images, invoices, T&M tickets, quotes, and change-order documents
• Workbook data you send from Excel to Sandspit to validate or sync

This data is referred to as Customer Data.

2.3 Automatically Collected Information

We may collect limited technical information such as:

• IP address
• Browser type and device information
• Log data related to feature usage and performance

This information is used solely to operate and improve the Service.

2.4 Website Visitors

When you visit the Website, we record page views and basic device information through first-party analytics that Sandspit operates. If you enter your email address in a form on the Website, we record it along with any name and company you provide, including before you submit the form, so we can follow up.

3. How We Use Information

We use collected information to:

• Provide and operate the Service
• Read Procore data into your workbooks, validate your changes, and write approved changes back to Procore
• Process uploaded files for import, extraction, validation, and review workflows
• Improve product performance and usability
• Respond to support requests
• Monitor security and prevent abuse

We do not use Customer Data for advertising or resale.

4. Procore, Microsoft Excel & Third-Party Integrations

Sandspit connects Procore to Microsoft Excel. Procore data you pull into a workbook is stored wherever you keep that workbook, such as your computer, OneDrive, or SharePoint, and is governed by your agreement with Microsoft.

You acknowledge that:

• Data access is governed by permissions you grant
• Third-party services operate under their own privacy policies
• Sandspit is not responsible for third-party data practices

Sandspit does not access data beyond what is required to provide the Service.

AI processing. When you upload documents for supported import or extraction workflows (such as subcontractor estimates, T&M invoices, receipts, quotes, images, spreadsheets, or change-order documents), the document content is sent to Anthropic's API for processing. To match the document to your project, Sandspit may also send related Procore reference data, such as budget codes, vendors, and commitment line items. Anthropic does not use API inputs or outputs to train its models, and Sandspit does not train any model on Customer Data. Procore data is not sent to Anthropic outside workflows where you upload a document for extraction.

5. Data Ownership

• You retain ownership of all Customer Data
• Sandspit acts as a data processor, not a data owner
• We use Customer Data only to provide the Service

We do not claim ownership of your project or construction data.

6. Data Sharing

We do not sell personal or project data.

We may share information only:

• With service providers who help operate the Service (e.g., hosting, monitoring)
• When required by law or legal process
• To protect the rights, safety, or security of Sandspit or users

All vendors are required to maintain appropriate confidentiality and security controls.

7. Third-Party Service Providers

Sandspit uses trusted third-party service providers to operate, maintain, and improve the Service. These providers process data solely on our behalf and in accordance with this Privacy Policy.

Our current service providers include:

• Anthropic – AI-assisted document extraction for supported import workflows, including change-event and cost-document intake
• Attio – customer relationship management for sign-up and account contacts
• Axiom – application performance monitoring and logging
• Cloudflare – CDN, DNS, web security, transactional email, and temporary storage of uploaded files
• Fly.io – application hosting and infrastructure
• Google BigQuery – product analytics data warehouse
• Neon – primary application database and data storage
• Sentry – error tracking and monitoring
• Slack – internal notifications to the Sandspit team about sign-ups and account activity

8. Data Security

Sandspit implements reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, loss, or misuse.

However, no system can be guaranteed 100% secure.

9. Data Retention

• We retain Customer Data while your account is active
• Files you upload for import are deleted 24 hours after the import finishes, or after 7 days if the import is never finished
• Document content sent to and returned from AI extraction is deleted after 7 days
• Operational logs are kept for no more than 90 days
• Upon account termination, data may be deleted after a reasonable retention period
• Archived copies may persist temporarily for operational or legal reasons

10. Cookies & Analytics

Sandspit may use cookies or similar technologies to:

• Maintain user sessions
• Understand feature usage
• Improve product performance
• Understand how visitors use the Website

The Website does not use third-party advertising pixels. Sandspit does not use Customer Data from the Service for advertising.

11. Your Rights & Choices

Depending on your location, you may have rights to:

• Access or correct your personal information
• Request deletion of your data
• Object to certain processing activities

Requests can be made by contacting us at the email below.

12. Children's Privacy

Sandspit is not intended for use by children under 13. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by updating the "Last Updated" date.

Continued use of the Service constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

[email protected]

Sandspit
1301 N Broadway STE 33343
Los Angeles, CA 90012
United States