Privacy Policy

1. Information we collect

Account and profile information

• All users: your name, email address, password (stored only in hashed form by our authentication provider), account type (property owner or contractor), and optionally a phone number, profile photo, cover photo, city, state and ZIP code.
• Contractors: company name, bio, specialties, years of experience, service area, license number, license expiration date, and a license image or other documents you submit for verification.
• Contractor payout details (website): if you are a contractor and enter payout information, we collect your legal name, bank name, account and routing numbers, account type, and tax ID (SSN or EIN). We use these only to pay you and to meet our tax obligations. Only you and authorized MGbit administrators can access them.

Project and marketplace information

• Projects you post: title, description, type of work, budget, timeline, property address, and photos.
• Quotes (bids) contractors submit, accepted offers, payment milestones, proof-of-work submissions, approvals, revision requests and disputes.
• Reviews, support requests and other content you submit.

Messages

We store the messages and attachments (such as photos) you exchange with other users in MGbit chats. On the website, messages are automatically screened when you send them, to detect attempts to share phone numbers, email addresses or links for taking the transaction off the platform. We may review messages to investigate a dispute, a report or a suspected violation of our Terms.

Photos and room scans

If you allow camera or photo-library access, you can add photos to your profile, projects, chats and room scans. Room scan uses your device’s regular camera, guided by its motion sensors, to capture several photos of a room. It does not use LiDAR or 3D mapping. The photos are uploaded and analyzed by our AI feature (see Section 2) to estimate dimensions, materials, condition and cost. The result is saved with your project. We do not access your camera, photos or motion sensors unless you use these features, and the app does not access your microphone.

Payment information

Payments are processed by Stripe on Stripe’s secure Checkout page. We never receive or store your full card number or security code. We store payment amounts, dates, statuses, milestone records and Stripe transaction identifiers. Stripe’s handling of your data is governed by the Stripe Privacy Policy.

Location information

See Section 3.

Device, push and technical information

• If you enable push notifications in the app, we store a push subscription identifier, your platform (iOS or Android), your notification permission status, the app version and your notification preferences.
• Our hosting, database and email providers automatically keep standard server logs, such as IP address, browser or device type, request times and errors. We use these to operate, secure and debug the Services.
• The website and app store your login session and a few settings (such as your last known city) on your device so you stay signed in.
• We do not use advertising identifiers, cross-site tracking cookies, or third-party analytics or crash-reporting services.

2. AI features (Anthropic Claude)

MGbit offers optional AI features powered by Claude, a model provided by Anthropic, PBC. We call Anthropic from our servers; your device never connects to Anthropic directly.

• AI Assistant (mobile app): a chat assistant that answers questions about MGbit and can, with your confirmation, take actions on your account, such as creating or updating a project, updating your profile, finding contractors or reviewing quotes. Before first use, you are shown a disclosure and asked to consent. You can withdraw consent at any time in Settings → AI Assistant & privacy.
• Room scan and photo analysis (app and website): photos you capture or attach for analysis are sent to Anthropic to generate the room assessment and cost estimate.

What is sent to Anthropic

Your messages to the assistant, and the account information needed to answer them. This can include your name, email, phone number and city/state, your projects, quotes and notifications, contractor search results, the screen you opened the assistant from, saved assistant memories, and any photos you attach or scan. We do not send your password or payment card details to Anthropic. Anthropic processes this data to provide the service to us. Under its commercial terms, Anthropic does not use it to train its models. See Anthropic’s Privacy Policy.

Conversation history and memory

• We store your assistant conversations (your messages, the assistant’s replies, and a log of any actions it took) so you can continue a conversation later and so we can audit account changes the assistant made.
• The assistant can save short memory notes about your preferences (for example, your preferred style or budget range) to personalize future answers. You can view and delete individual memories in the app. We automatically block card- or password-like text from being saved as a memory.
• You can delete a conversation at any time. This also deletes its messages and action log. Deleting your account deletes all of your assistant conversations, memories, consent records and room scans (see Section 9).

AI output can be inaccurate. Room dimensions, condition findings and cost estimates are for information only and are not a professional inspection, appraisal or quote.

3. Location data

• With your permission, the app uses your device’s location only while you are using it (foreground only; never in the background), at approximately neighborhood-level accuracy. The website may ask for your browser’s location when you fill in an address.
• We use location to show nearby projects and contractors, measure distance, set a contractor’s service area, keep results within your country, and fill in your city.
• We convert your coordinates into a city, region, postal code and country. The app uses your device’s built-in geocoding service (Apple on iOS, Google on Android). The website uses the OpenStreetMap Nominatim service.
• We save your latest coordinates, city, region, country and search radius to your profile. Your region and country are also used to target relevant push notifications. Our push provider’s own location collection is disabled.
• Location is optional. You can deny or revoke permission in your device settings at any time and enter a city or ZIP code manually instead.
• A project’s full street address is shown only to the property owner and the contractor hired for that project. Other contractors see only the city, state and ZIP code.

4. How we use information

• To create and manage your account and authenticate you.
• To run the marketplace: publish projects, match projects with suitable contractors, deliver quotes and messages, and manage accepted projects.
• To process milestone payments, hold funds until milestones are approved, pay contractors, handle refunds and disputes, and keep financial records.
• To verify contractor licenses and help keep the platform safe, including detecting fraud, abuse and attempts to take payments off the platform.
• To provide AI features you choose to use.
• To send you notifications about your account and projects, and to respond to support requests.
• To alert MGbit staff by email about platform activity (such as new projects, quotes or payments) so we can support users.
• To comply with law, enforce our Terms, and protect the rights and safety of our users and MGbit.

We do not sell or “share” personal information for cross-context behavioral advertising, as those terms are defined under California law.

5. What other users can see

• Profile information (name, profile and cover photo, city/state, and for contractors: company name, bio, specialties, experience, license status, ratings and reviews) is visible to other signed-in users.
• Projects you post are visible to contractors who may bid on them: the description, photos, budget, room-scan results and general location. The full address is shared only with the contractor you hire.
• Messages are visible to the other participant in the conversation.
• Uploaded images (profile photos, project photos, chat attachments and scan photos) are stored as files that can be opened by anyone who has the file’s link. Their links are long and not guessable. Please don’t upload photos containing information you want to keep private, such as documents or people’s faces.

6. Service providers we share with

We share personal information only with the providers below, who process it on our behalf to run the Services, and as described in “Other disclosures.”

Other disclosures

• Other users, as described in Section 5.
• Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect rights, property or safety, or to investigate fraud.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction.

7. Notifications

• Push notifications (app): sent through OneSignal if you allow them. You can turn them off in your device settings, or manage categories and quiet hours in the app’s notification settings.
• Email: we send account emails (such as verification and password reset) and project emails (such as new quotes, messages, milestones and payments) through Resend.
• WhatsApp: if you provide a phone number, we may send project updates to it on WhatsApp through Green API. To stop them, reply or email us, or remove your phone number from your profile.
• Marketing announcements are off by default. We send them only if you turn them on in notification settings.

8. Data retention

• Account and profile data: kept while your account is active, and deleted or anonymized when you delete your account.
• AI conversations, memories and room scans: kept until you delete them or your account.
• Projects, quotes, milestones, payment records and related messages: these form the record of transactions between two parties. We keep them after account deletion for up to 7 years, for accounting, tax, dispute resolution, chargeback and legal purposes. After account deletion they are linked only to an anonymized profile.
• Contractor payout and tax details: kept for as long as tax law requires after your last payout.
• Server logs: kept for a limited period according to our providers’ standard log retention.

9. Account deletion

You can delete your MGbit account at any time.

In the mobile app

Go to Settings → Delete account and confirm. Deletion is permanent and takes effect immediately:

• Your login is deleted and you can no longer sign in.
• Your AI assistant conversations, memories, consent records and room scans are deleted.
• Your notifications, notification preferences and push subscriptions are deleted.
• Your profile is anonymized: your name is replaced with “Deleted user,” and your phone number, photos, bio, company name, license number, address and location are removed.

On the website, or by request

Email mgbit@mgbit.io from the email address on your account, with the subject “Account deletion request,” or call 855-826-4248. We will verify your identity and complete the deletion within 30 days. You can also use this process to ask us to delete data that in-app deletion does not remove automatically, such as uploaded photo files, chat messages, and your push-notification record with OneSignal. We will delete them unless we need to keep them for the reasons in Section 8.

What we keep

As explained in Section 8, we keep records of projects, quotes, milestones and payments, and the related communications, where the law requires it or where they are needed to resolve disputes or chargebacks with the other party. We also keep them where we have to meet tax and accounting obligations. These records are linked only to your anonymized profile. Stripe keeps its own payment records under its own policy.

10. Your rights and choices

• Access and correction: you can view and edit most of your information in your profile and settings. You can also ask us for a copy of your personal information.
• Deletion: see Section 9.
• AI: you can decline or withdraw AI consent, delete conversations and delete memories at any time.
• Permissions: you can turn camera, photos, location and notification access on or off in your device settings.
• California residents: under the CCPA/CPRA you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing (we do not sell or share it); to limit use of sensitive personal information (we use it only as needed to provide the Services); and not to be discriminated against for exercising these rights. You may use an authorized agent to make a request.
• Other locations: depending on where you live, you may have similar rights. We will honor applicable requests.

To make a request, contact us using the details in Section 15. We will verify your identity before acting on a request and respond within the time required by law (generally 45 days).

11. Security

We use industry-standard safeguards. These include encryption in transit (HTTPS/TLS), hashed passwords, database access rules that limit each user to their own data, and restricted administrator access to sensitive information such as payout details. Card payments are handled entirely by Stripe. No system is perfectly secure. If you believe your account has been compromised, please contact us right away.

12. Where data is processed

MGbit is based in the United States, and the Services are intended for users in the United States. Our main database and file storage are hosted by Supabase in data centers in India (Asia Pacific – Mumbai region). Some of our other providers, including Anthropic, Stripe, OneSignal, Resend and Vercel, process data in the United States. Green API processes WhatsApp messages on its own infrastructure outside the United States. By using the Services, you understand that your information will be transferred to and processed in these countries, which may have different data protection laws than where you live. We rely on our providers’ contractual and security commitments to protect it.

13. Children

The Services are intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children under 13 (or under 16 where applicable law requires). If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. If a change is material, we will notify you by email or in the Services before it takes effect.

15. Contact us

For privacy questions, data requests or account deletion: