Privacy Policy

Spot.xyz Corporation, doing business as Specset ("Specset," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our website (specset.com), web application, and related services (the "Services").

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, please do not use our Services.

1.1 Information You Provide

When you use the Services or communicate with us, you may provide personal information, including:

• Account Information – Name, email address, company name, phone number, and other contact details.
• Uploaded Content – Documents and data you upload to the platform, including project specifications and submittals. These may contain sensitive or proprietary information.
• Support and Communications – Information provided when contacting customer support or participating in surveys or feedback.

1.2 Information Collected Automatically

We may collect certain information automatically when you use the Services, including:

• Device and Usage Information – IP address, browser type, operating system, referring URLs, page views, and other technical data.
• Cookies and Tracking Technologies – We use cookies, web beacons, and similar technologies to improve user experience, track usage patterns, and analyze performance.

1.3 Information from Third Parties

We may receive information from third-party services that integrate with Specset (e.g., single sign-on providers or cloud platforms).

We use your information to:

• Provide, operate, maintain, and improve the Services;
• Analyze and validate uploaded documents using AI models;
• Communicate with you about your account, service updates, and customer support;
• Send you product updates, newsletters, and information about Specset features and events by email ("marketing emails");
• Enforce our Terms of Service and comply with legal obligations;
• Understand usage trends and improve product performance and experience.

Every marketing email includes an unsubscribe link, and you can turn marketing emails off at any time in your account settings (see Section 7). Unsubscribing does not stop service messages, such as security alerts, password resets, invitations, and notices about your account or changes to the Services.

Specset uses APIs with third-party large language models (LLMs) — Google Gemini / Vertex AI, Anthropic, and OpenAI — to perform analysis of documents you upload (e.g., validating submittals against specifications). Your uploaded content may be processed by these LLMs solely for the purpose of providing the Services. We also use a third-party web-search provider (Perplexity) for search grounding, which receives the search query and not your documents. The current subprocessor list is published on our Trust Center.

We do not use your data to train third-party models. We implement reasonable measures to restrict the sharing of sensitive information and to maintain confidentiality.

For clarity on our AI model use:

• Google Gemini / Vertex AI: Google does not use your data to train models without explicit permission; data is encrypted in transit and at rest under Google Cloud's enterprise terms.
• OpenAI API: Data sent via the API is not used to train OpenAI models; logs may be retained up to 30 days for abuse monitoring per OpenAI's data usage policy.
• Anthropic (Claude): Data sent via the API is not used to train Anthropic models, under Anthropic's commercial terms.
• Perplexity: Used only for web search grounding on commercial organizations, and only for the query, not your documents.

Organizations in CUI mode use a restricted route: Perplexity and the commercial model endpoints are disabled for them, and generation, embeddings, and web grounding are served from the in-boundary deployment instead.

We do not sell your personal information. We may share information in the following limited circumstances:

• Vendors and Service Providers – With trusted third parties who help us operate and support the Services (e.g., hosting providers, email delivery, analytics tools, AI infrastructure).
• Legal Compliance – When required by law, regulation, legal process, or governmental request.
• Business Transfers – In the event of a merger, acquisition, reorganization, or asset sale, your data may be transferred to a successor entity.
• With Consent – In other cases where you expressly consent to sharing.

We retain personal and project-related data for as long as needed to provide the Services and comply with legal obligations. You may request deletion of your data by contacting us at legal@specset.com.

We take reasonable administrative, technical, and organizational measures to protect your data. These include:

• Encryption in transit and at rest;
• Role-based access controls;
• Secure document storage and access policies.

Despite these safeguards, no system can be guaranteed 100% secure, and we cannot ensure or warrant the absolute security of any information.

Depending on your jurisdiction, you may have certain rights with respect to your personal information. These may include:

• Access – The right to know what personal data we collect and how we use it;
• Correction – The right to request correction of inaccurate or incomplete information;
• Deletion – The right to request deletion of your personal data, subject to exceptions;
• Objection/Restriction – The right to object to or restrict certain processing;
• Portability – The right to request your data in a structured, commonly used format.
• Marketing Emails – You can stop marketing emails at any time with the unsubscribe link in any of them or in your account settings. We process unsubscribe requests promptly.

To exercise these rights, please contact us at legal@specset.com. We may need to verify your identity before fulfilling your request.

If you are located in the European Union, European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR provide you with specific rights in addition to those outlined above:

• Legal Basis for Processing – We process your personal data based on your consent, performance of a contract, compliance with a legal obligation, or our legitimate interests (e.g., improving our Services, preventing fraud, and telling existing customers about similar Specset products and features). Where the law requires consent for marketing emails, we send them only with your consent. You can object to marketing at any time.
• Data Transfers – When transferring personal data outside of the EU/EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

You also have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data violates applicable law.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides the following rights:

• The right to know the categories and specific pieces of personal information we have collected about you;
• The right to request deletion of your personal information;
• The right to correct inaccurate personal information;
• The right to opt out of the "sale" or "sharing" of your personal information, if applicable;
• The right to limit the use of sensitive personal information;
• The right to non-discrimination for exercising any of these rights.

We do not sell personal information as defined under the CCPA/CPRA. To submit a request, please contact us at legal@specset.com.

Specset is based in the United States, and your information may be processed in the U.S. or other jurisdictions with different data protection laws than your home country. Where required by applicable law, we will implement appropriate safeguards (e.g., Standard Contractual Clauses) to protect your personal data during international transfers.

Our Services are intended for use by professionals in the construction industry and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without verified parental consent, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top and, where required, notify you of material changes. We encourage you to review this page periodically to stay informed about how we collect and protect your information.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at legal@specset.com.