Privacy Policy

1. Scope and our role

This Policy applies to MaterialDock’s websites, application, support, and related services. It does not govern a Customer’s own privacy practices or a third-party website linked from MaterialDock.

For account, website, billing, security, and direct business-contact information, Lens Analytics LLC generally determines why and how information is processed. For client, project, employee, supplier, document, and other content submitted by a contracting company, MaterialDock generally processes that information to provide the service on the company’s instructions. The company is responsible for its relationship with the individuals represented in that content and for providing required notices and permissions.

2. Information we collect

Depending on how the service is used, we may collect:

• Account and identity information: name, email address, verified-email status, account identifiers, roles, company membership, authentication and recovery state, and communication preferences.
• Private invitation information: recipient email, numbered invitation, hashed code, issuance reason, redemption deadline and status, operator identity and event history, and the account and initial company to which a permanent complimentary grant is attached. Codes are not public profile data. Ordinary operator issuance reveals the code once for private sharing; the initial-account invitation email carries its code through encrypted queueing and the email-delivery provider. Recipient email and free-access evidence are personal information even when no payment details are collected.
• Authentication and security information: password credentials, session and verification tokens, multi-factor authentication secrets and recovery codes, recent-reauthentication state, failed-attempt and lockout state, IP address, browser or device information, and security-event history. Secret values are restricted and are not displayed as ordinary account content.
• Company information: business name, contact details, logo, addresses, license details, settings, pricing defaults, and subscription status.
• Client and project information: client and contact details, service and billing addresses, project descriptions, rooms, assignments, notes, dates, and status history.
• Product and supplier information: manufacturer, model number, product details, category, supplier, private aliases and notes, costs, markups, quantities, and project selections. Community contribution is disabled; company pricing, supplier relationships, private labels and notes, project relationships and uploaded user images are not shared catalog information.
• Purchase and financial records: receipt and invoice metadata, line items, prices, taxes, fees, discounts, returns, refunds, quote and change-order details, reports, and partial payment-method labels. Customers are instructed not to submit full payment-card or banking credentials.
• Uploaded content: receipts, invoices, spreadsheets, product images, replacement files, supporting documents, and information contained in them. Customers must remove prohibited sensitive information before uploading it; file-type validation and malware screening do not guarantee its detection or removal from submitted files.
• Audit and workflow information: approvals, rejections, confirmations, revisions, exports, security changes, access events, and other actions needed to preserve company history and enforce permissions.
• Billing information: Stripe customer, subscription, price, invoice, and payment-status identifiers. Payment credentials for MaterialDock subscriptions are submitted to Stripe rather than collected through MaterialDock's subscription-billing forms. Customers must not include full card numbers or security codes in uploaded files or other business content. This billing description is not a guarantee that prohibited information cannot appear in content a Customer submits.
• Technical information: IP address, browser and device information, request identifiers, timestamps, session and security events, diagnostic outcomes, and limited usage information needed to operate and secure the service.
• Communications: support requests, privacy or security reports, and other messages sent to us.

3. Sources of information

We receive information directly from users; from the company that creates or invites a user; from files and records users upload; automatically from browsers and application use; and from service providers such as Stripe for billing status. We may also use manufacturer or supplier information that a Customer submits or that is obtained from an authorized manufacturer, supplier, or other source. Before source-verified catalog information is introduced, MaterialDock must record the source and its authority to use that information.

MaterialDock does not obtain information merely because a user searches for a product in another company’s private catalog. Company-private records do not cross company boundaries.

4. How we use information

We use information to:

• create, authenticate, secure, and recover accounts;
• create and administer company workspaces;
• issue, secure, redeem, and account for private invitations and permanent complimentary access;
• provide product, project, purchase, document, quote, report, export, and audit workflows;
• match products against the company's private catalog and available shared product information;
• process subscriptions and enforce trial, grace, cancellation, and retention states;
• deliver verification, security, billing, retention, export, and operational messages;
• prevent fraud, malware, abuse, unauthorized access, and cross-company data exposure;
• troubleshoot, maintain, measure, and improve service reliability and usability;
• respond to support, privacy, and security requests; and
• comply with law, enforce agreements, and protect users, MaterialDock, and others.

We do not use Customer documents, contacts, prices, or private project content for advertising. We do not sell personal information or use it for cross- context behavioral advertising.

The initial launch uses email only for account, security, billing, retention, export, support, and other service communications. MaterialDock does not send marketing email at initial launch.

5. Document extraction and automated processing

Production AI extraction is currently disabled. Account creation, accepting an invitation and uploading a file do not submit it to OpenAI for extraction. MaterialDock does not use Customer Content to train a MaterialDock model.

Before enabling optional extraction, we will disclose the provider, information sent and applicable processing and retention controls before use. Extraction would require an authorized user's request and produce a draft for mandatory review, not automatically create confirmed purchases or project records.

6. How we disclose information

We may disclose information:

• to authorized users within the Customer’s company and according to company permissions;
• to hosting, storage, database, email, billing, security, support, and document-processing providers listed in the subprocessor register;
• at Customer direction, such as when generating or downloading a report or export;
• to professional advisers under appropriate confidentiality obligations;
• in connection with a merger, financing, acquisition, reorganization, or sale of relevant assets, subject to applicable notice requirements; or
• when reasonably necessary to comply with law, lawful process, or a valid government request; enforce agreements; investigate abuse; or protect rights, safety, and security.

Service providers may use information only to perform contracted services or as otherwise permitted by applicable law and their agreements with us.

Shared product catalog

Community contribution and automatic promotion are disabled. Policy acknowledgement does not opt a company into sharing its records. Before enabling contribution, we will disclose eligible fields and provide a separate Owner opt-in and withdrawal process. Private prices, supplier relationships, contacts, project records, notes and uploaded images are not shared catalog content.

7. Service providers and subprocessors

MaterialDock uses Railway for application hosting, workers, PostgreSQL and primary private files; Cloudflare R2 for independent private file backups and operational-log archives; Resend for service email; and Better Stack for external monitoring, sanitized error reports, backup heartbeat and incident notifications. Cloudflare also provides domain and related services according to the enabled configuration. Stripe supports subscriptions and payment management for paid companies. OpenAI is selected for optional extraction but that feature is disabled.

The service-provider register explains each provider's purpose and information involved. Providers may process their own account, security and billing records under their applicable privacy notices. A provider's public documentation is not a guarantee that every product, region or optional setting is enabled for MaterialDock.

8. Cookies and similar technologies

MaterialDock uses cookies or comparable browser storage that are necessary for authentication, session security, multi-factor recovery, short-lived workflow state, preferences, and core service operation. For example, browser session storage temporarily remembers the email address used for a pending verification flow. We do not currently use advertising cookies or a product-analytics service. Authentication-library telemetry is disabled.

If MaterialDock introduces optional analytics or other non-essential tracking, we will update the Cookie Notice and provide consent or opt-out controls where required. Stripe-hosted pages may use technologies governed by Stripe’s own privacy disclosures.

Online tracking and browser signals

MaterialDock does not itself collect activity across unrelated websites for advertising and has no product-analytics or advertising integration. Its application does not change necessary authentication, security, or operational processing in response to a browser's Do Not Track signal. Do Not Track is different from legally recognized opt-out preference signals such as Global Privacy Control; this statement does not waive an applicable opt-out duty.

Hosting, security, and payment providers may collect technical information to operate their services. Stripe-hosted pages are separate provider services. MaterialDock's absence of advertising code is not a promise that provider services collect no technical information. Applicable provider notices and the service-provider register describe their separate processing.

9. Data retention

While a subscription or other authorized access is active, MaterialDock retains company records, source documents, immutable versions, and audit history as needed to provide the service and preserve authorized business history.

After paid or trial access ends, a company ordinarily enters a 90-day read-only retention period. The Owner may request full-company exports during that window. Export download authorizations expire after no more than 72 hours and never extend beyond the company retention deadline.

A permanent complimentary company has no payment-related access expiry and does not enter this paid-access retention window simply because it pays no subscription fees. Invitation expiry is not a company-data deletion deadline.

Reaching the retention deadline currently stops new export generation and download authorization. MaterialDock does not yet promise or perform automatic permanent deletion. Company information remains read-only until a reviewed deletion process is implemented. This interim behavior is described publicly so Customers can make an informed decision before uploading data.

The absence of automatic company deletion does not remove an individual's applicable privacy rights. A request to delete personal information is assessed separately from subscription cancellation, archival, and export-link expiry. Any retained information must have an applicable purpose or exception; an audit-history design is not a blanket exception to a legal deletion duty.

Ordinary application logs target 30-day retention, and security-oriented logs target 90 days. Company audit history is generally retained with the company record. Backups, fraud-prevention information, billing records, legal holds, and records required by law may follow different schedules.

The 30- and 90-day targets describe MaterialDock's direct operational-log archive, not every provider copy. Independent completed file backups currently have no automatic expiry schedule accepted for production. Link expiry, archival and removal from a screen do not establish erasure of source files, backups or provider records.

Retention decisions consider the purpose of processing, active customer instructions, security needs, legal obligations, disputes and applicable rights. Account, invitation, acceptance, financial and audit evidence may need to remain after an ordinary business record is archived. This is not a blanket right to retain all personal information indefinitely. Contact [email protected] about a particular record or retention request.

10. Security

MaterialDock uses administrative, technical, and organizational measures designed to protect information, including access controls, tenant-scoped authorization, encrypted transport, provider encryption at rest, malware screening, short-lived file authorization, audit history, and additional protection for sensitive secrets where appropriate.

No service can guarantee absolute security. Users must protect their credentials and promptly report suspected unauthorized access. We will provide security-incident notices when required by applicable law.

11. Customer controls and exports

Authorized users may review and correct account and business information through the service. Normal business deletion uses recoverable archival, voiding, replacement, adjustment, or revision workflows to preserve audit history.

Only the company Owner may request the full-company export. During the standard retention window, the Owner retains authenticated export access subject to the deadline and short-lived download authorization.

Normal export access also requires current company authority and recent account confirmation. If access is restricted, the Owner may contact [email protected] for review; that request does not bypass security or create an automated post-termination export or restoration service. The Terms describe retrieval during suspension, termination and a planned service shutdown. An individual's privacy request remains separate from full-company export and does not authorize disclosure of another person's or company's records.

12. Privacy rights

Depending on residence and applicable law, an individual may have rights to request access, correction, deletion, portability, or information about our processing, and to appeal a denied request. Some rights are subject to verification, exceptions, thresholds, or the Customer’s role as the primary controller of submitted business content.

MaterialDock does not currently sell personal information or process it for targeted advertising. If an individual’s request concerns content controlled by a contracting company, we may direct the request to that company or assist it as required.

Submit a request to [email protected]. We may need information to verify identity and authority. Authorized agents must provide legally sufficient proof of authority. We will not discriminate for exercising an applicable privacy right.

You do not need a MaterialDock account or a paid subscription to contact us about your personal information. Do not send a password, invitation code, multi-factor secret, or unnecessary identity document with a request. If you wish to appeal a request decision where an appeal right applies, reply to the decision or email [email protected] identifying the request and why you disagree. We respond and provide any required complaint information within the period required by applicable law. Policy acknowledgement does not waive privacy rights or consent to unrelated marketing or community contribution.

13. Children

MaterialDock is a business service intended for adults and is not directed to children under 13. Users must be at least 18 to create or administer an account. We do not knowingly collect personal information directly from children.

14. Processing locations

MaterialDock is initially offered to business customers in the United States. The production independent file-backup and direct operational-log archive buckets use Cloudflare R2's United States jurisdiction. This location statement applies to those buckets, not every MaterialDock record, provider service, subprocessor or support location.

Hosting, email, billing, monitoring and related providers may store, process or access information in other locations. Exact production processing regions and international access have not been confirmed for all services. The service- provider register identifies the confirmed location facts and current limits; U.S.-only customer eligibility is not a guarantee of exclusively U.S. processing.

15. Changes to this Policy

We may update this Policy as the service, providers, or law changes. Material changes will be communicated through the service or by email before they take effect when required. MaterialDock preserves published versions and records acceptance of current Terms and Privacy versions through its policy system.

16. Contact

MaterialDock is operated by Lens Analytics LLC doing business as MaterialDock.

• Privacy requests: [email protected]
• General support: [email protected]
• Security reports: [email protected]