Privacy Policy

Material Invoice Tracker

Effective Date: 10/17/26
Last Updated: 10/17/26

This Privacy Policy explains how Tijorn, a [STATE] limited liability company ("Company," "we," "us," or "our"), collects, uses, discloses, retains, and protects information in connection with Material Invoice Tracker, our web-based application available at https://matinvo.com and any successor or related domain, installable web app, and related services (together, the "Service").

This Privacy Policy is part of, and is incorporated into, our Terms of Use (the "Terms"). Capitalized terms that are used but not defined in this Privacy Policy have the meanings given in the Terms. Our Disclaimer and Limitation of Liability Notice and Legal Notices also apply to your use of the Service.

1. Who We Are and Who This Policy Covers

1.1 Business-to-business service. The Service is a business tool for construction companies, contractors, and their office staff and field crews. It lets a business capture material invoices and material requests, read them automatically, match line items to materials, track backorders and deliveries, and keep running totals by job, vendor, and material. The Service is not designed for, marketed to, or intended for personal, family, or household use.

1.2 Customers and Authorized Users. In this Privacy Policy, "Customer" means the business (for example, a contracting company) for which a Company Account is created, and "Authorized User" means an individual whom a Customer (or we, at the Customer's request) gives a login to the Service, such as an owner, administrator, office user, general foreman, foreman, or field user. "Company Account" means the workspace in the Service that holds a Customer's information.

1.3 Our two roles. We handle information in two different roles:

• As a service provider to our Customers. Most information in the Service, including invoices, material requests, job information, vendor information, and the files that Authorized Users upload, is submitted by or for a Customer and belongs to that Customer ("Customer Data"). We process Customer Data on the Customer's behalf and according to its instructions, as described in the Terms. The Customer decides what information to put into the Service and who may access it. If you are an Authorized User and have questions about how your employer or the business that invited you uses the Service, please contact that business first.
• As a business in our own right. We also collect a limited amount of information for our own purposes, such as account and login information, billing contacts, information needed to secure the Service, and communications that people send to us. This Privacy Policy describes both.

1.4 What this Policy does not cover. This Privacy Policy does not cover the privacy practices of our Customers, or of third-party services that a Customer chooses to connect to the Service (such as Google Drive), which are governed by their own terms and privacy policies.

2. Information We Collect

We collect the categories of information described below. We collect only what we need to provide, secure, support, and bill for the Service.

2.1 Company Account information. When we set up a Company Account (the Service does not currently offer public self sign-up), we collect the Customer's business name, business mailing address, a contact name, business telephone numbers (for example, main company, direct office, and mobile numbers), the number of user seats purchased, and account settings.

2.2 Authorized User account information. For each Authorized User, we collect or receive:

• name (display name and, if provided, first and last name);
• business email address, which is used as the login username;
• telephone number, if provided;
• password, which we store only in a salted, one-way hashed form (we do not store passwords in readable form);
• role (for example, Admin, Office, General Foreman, Foreman, or Field), permissions, and the jobs to which the user is assigned; and
• account status information, such as whether the account is locked or must change a temporary password.

Authorized User accounts are usually created by a Customer's administrator, who provides the user's name and email address and an initial temporary password. When an account is created or an invitation is re-sent, the Service may email the user sign-in instructions and a temporary password, which the user must change after first sign-in.

2.3 Customer Data. Authorized Users submit information to the Service in the course of their work, including:

• Uploaded Documents: photos, scans, and PDF files of vendor invoices, material requests, pick tickets, and similar documents;
• Document details: vendor names, invoice numbers, dates, purchase order (PO) and material request (MR) numbers, reference numbers, line-item descriptions, sizes, quantities, units, unit prices, totals, and backorder quantities, whether extracted automatically or entered by hand;
• Job information: job names and numbers, jobsite addresses, job status, and names of sub-contractors associated with a job;
• Business records: vendor lists, material catalogs and categories, material name mappings ("aliases"), backorders, delivery-match results, notes, and reasons entered by users; and
• Activity history: records of who created, edited, linked, resolved, or deleted items and when (for example, quantity edits, PO/MR number edits, and invoice-to-MR link history).

Uploaded Documents may contain information about people other than the Authorized User, such as names, signatures, phone numbers, or addresses of vendor representatives, delivery drivers, or job contacts that appear on the paperwork. Customers are responsible for making sure they have the right to upload this information.

2.4 Information from connected services. If a Customer chooses to use our Google Drive material-request sync, the Customer shares a Google Drive folder with a service account that we control. We then obtain read-only access (using Google's read-only Drive and Sheets permissions) to the spreadsheets in that shared folder, and we import the material-request information they contain into the Customer's Company Account. We do not write, change, or delete anything in the Customer's Google Drive, and we do not access any Google Drive content that has not been shared with our service account. We do not ask Authorized Users to sign in to the Service with their personal Google accounts.

2.5 Billing information. When paid subscriptions are enabled, we (or our payment processor) will collect billing contact names, billing email and mailing addresses, subscription and seat details, and payment history. Payment card details are collected and stored by our payment processor (currently expected to be Stripe, Inc.), not by us. We receive only limited information from the processor, such as the card brand, the last four digits, the expiration date, and whether a payment succeeded.

2.6 Security, device, and usage information. When you use the Service, we and our hosting provider automatically collect certain technical information, including:

• Session information: when you sign in, we create a session and place a session cookie in your browser (see Section 7);
• Sign-in and password-reset protection data: to protect accounts against password-guessing and abuse, we record failed sign-in and password-reset attempts associated with an email address and with the Internet Protocol (IP) address from which the attempt was made, and we may temporarily lock out further attempts; and
• Server and request logs: our hosting provider records standard log information such as IP address, browser type and version, device and operating-system information, the pages or endpoints requested, referring URLs, date and time stamps, and error information. We use these logs to operate, troubleshoot, and secure the Service.

2.7 Communications. If you email us, contact us for support, or otherwise communicate with us, we collect the content of your message, your contact details, and any attachments. We also keep records of transactional emails that the Service sends (such as invitations and password-reset messages), including delivery status.

2.8 Information we do not intentionally collect. We do not ask for, and the Service is not designed to collect, Social Security numbers, driver's license numbers, health information, precise geolocation, biometric information, or similar sensitive information. Please do not upload documents containing such information unless it is necessary for your business purposes and you are permitted to do so. As of the Effective Date, the Service does not use third-party advertising, analytics, or tracking tools.

3. How We Use Information

We use information for the following business purposes:

• To provide the Service, including creating and managing Company Accounts and Authorized User accounts, authenticating users, storing and displaying Uploaded Documents, extracting and organizing document information, matching invoices to material requests, tracking backorders, calculating totals, generating exports, and syncing material requests from connected Google Drive folders;
• To process documents with artificial intelligence, as described in Section 4;
• To communicate with you, including sending invitations, temporary passwords, password-reset links, service and security notices, billing notices, and responses to your requests;
• To provide support, including troubleshooting problems, helping a Customer set up its Company Account, and, when needed, accessing a Company Account as described in Section 5.4;
• To secure the Service, including detecting, preventing, and responding to fraud, abuse, unauthorized access, security incidents, and violations of our Terms;
• To bill for the Service, including processing payments, managing subscriptions and seats, and keeping financial records;
• To maintain and improve the Service, including monitoring performance, fixing errors, and developing new features, using information in a manner consistent with our role as a service provider and, where practical, in aggregated or de-identified form;
• To comply with law and protect rights, including responding to lawful requests, enforcing our agreements, and protecting the rights, property, and safety of our Customers, users, us, and others; and
• For other purposes that we describe to you at the time we collect the information, or with your consent.

We do not sell personal information, and we do not use or disclose personal information for cross-context behavioral advertising. We do not use Customer Data to market to the people whose information appears in it.

4. Artificial Intelligence (AI) Processing

4.1 What happens to an uploaded document. When an Authorized User uploads an invoice or material request for automatic reading, the Service sends the document image or PDF, together with instructions and the Customer's list of material categories, through the Vercel AI Gateway (operated by Vercel Inc.) to a third-party large language model provider. As of the Effective Date, the model used is a Google Gemini model provided by Google LLC. The model returns structured information (such as vendor, invoice number, date, PO and MR numbers, totals, and line items, with a confidence score for each line), which the Service then stores in the Customer's Company Account. We may change the AI model or provider from time to time; if we do so in a way that materially changes this Section, we will update this Privacy Policy.

4.2 Use of data by AI providers. We use AI providers solely to perform document extraction for the Customer. Based on the terms these providers published as of the Effective Date:

• Vercel states that the AI Gateway does not use prompts or responses for model training and does not retain them after a request is completed, except as described in its own terms; and
• Google states that, for its paid Gemini API services, it does not use prompts (including files such as images and documents) or responses to improve its products, but that it logs prompts and responses for a limited period (currently up to 55 days) solely to detect and prevent violations of its prohibited-use policy and to meet legal requirements.

These providers' practices are governed by their own terms and policies, which they may change, and we do not control them. We encourage Customers to review the providers' current terms.

4.3 Our own use. The Service learns how a Customer's vendors describe materials by saving material mappings ("aliases") inside that Customer's Company Account. Those mappings are used only for that Customer's Company Account. We do not use one Customer's Customer Data to train AI models that are offered to other Customers.

4.4 Accuracy. AI-generated results can be wrong or incomplete. The Service shows the original document beside the extracted information so that users can check it. Please read our Disclaimer and Limitation of Liability Notice and Section 6 of our Terms of Use for important information about relying on AI output.

5. How We Disclose Information

We disclose information only as described below.

5.1 Within the Customer's Company Account. Information submitted to a Company Account is visible to that Customer's Authorized Users according to the roles, permissions, and job assignments the Customer's administrators set. Customer administrators can view, edit, export, and delete Company Account information.

5.2 Service providers (sub-processors). We use the following categories of service providers to operate the Service. They are permitted to use information only to provide services to us and are bound by contractual obligations regarding confidentiality and data protection.

We may add or replace service providers from time to time. We will update this list when we make a material change, and Customers may contact us at support@tijorn.com to request our current list.

5.3 Professional advisers. We may disclose information to our lawyers, accountants, auditors, and insurers, under duties of confidentiality, when reasonably necessary for their services to us.

5.4 Access by our personnel. Our authorized personnel may access a Company Account and its information when needed to set up or configure the account, provide support that a Customer requests, investigate a problem or security issue, process billing, enforce our Terms, or comply with law. Access is limited to what is reasonably necessary for those purposes.

5.5 Legal requirements and protection. We may disclose information if we believe in good faith that doing so is required by law, regulation, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of our Customers, users, us, or others, or to detect, prevent, or address fraud, security, or technical issues. Where legally permitted and reasonable, we will notify the affected Customer before disclosing Customer Data in response to legal process so that the Customer may seek protection.

5.6 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, or in a bankruptcy or similar proceeding, information may be transferred as part of that transaction, subject to commitments at least as protective as those in this Privacy Policy.

5.7 With consent or at direction. We may disclose information to other parties when a Customer or user directs us to do so or consents to the disclosure.

5.8 Aggregated or de-identified information. We may create and use aggregated or de-identified information that cannot reasonably be used to identify any Customer or individual (for example, the total number of documents processed across the Service). We will maintain and use such information only in de-identified form and will not attempt to re-identify it, except as permitted by law.

6. Data Retention and Deletion

6.1 General rule. We keep information for as long as needed to provide the Service, to fulfill the purposes described in this Privacy Policy, and to meet our legal, tax, accounting, and security obligations.

6.2 Customer Data. We keep Customer Data for as long as the Customer's Company Account is active, unless the Customer deletes it sooner. Customer administrators can delete jobs (which deletes the job's invoices, material requests, related records, and stored files), vendors, materials, categories, backorders, and other records within the Service. After a Company Account is closed or a subscription ends, the Customer may request an export of its Customer Data for thirty (30) days, as described in the Terms. After that period, we will delete or de-identify the Customer Data within a commercially reasonable time, generally within ninety (90) days, except where we are required by law to keep it or where it remains in backups, which are deleted in the ordinary course of our and our providers' backup cycles.

6.3 Authorized User accounts. When a Customer removes an Authorized User from its Company Account, the user's access to that Company Account ends immediately. Records of the user's past activity in that Company Account (for example, who uploaded or edited a document) remain part of the Customer's Customer Data. A user's basic login record may be retained so that the same person can be added to a Company Account again; we will delete it on request if the person is no longer a member of any Company Account.

6.4 Security and session records. Session records expire after thirty (30) days or when you sign out. Password-reset links expire after one (1) hour. Failed sign-in and password-reset attempt records are kept only as long as needed to enforce our security limits and investigate abuse. Server logs are retained according to our hosting provider's standard log-retention periods.

6.5 Billing and business records. We keep billing, tax, and transaction records for as long as required by applicable law (generally up to seven (7) years).

6.6 AI providers. Information sent to AI providers is retained by those providers only as described in Section 4.2 and their own terms.

7. Cookies and Similar Technologies; Do Not Track

7.1 Cookies we use. The Service uses one essential first-party cookie (named "mit_session") to keep you signed in and to identify which Company Account you are working in. It is set only after you sign in, is marked "HttpOnly" and "Secure," and expires after thirty (30) days or when you sign out. Because this cookie is strictly necessary for the Service to work, it cannot be turned off within the Service. If you block it in your browser, you will not be able to sign in. The Service does not set any other cookies.

7.2 No advertising or analytics cookies. As of the Effective Date, we do not use advertising cookies, third-party analytics, social-media pixels, or similar tracking technologies, and we do not allow third parties to collect personal information about your online activities over time and across different websites when you use the Service. If this changes, we will update this Privacy Policy before the change takes effect.

7.3 Do Not Track and Global Privacy Control. Some browsers send a "Do Not Track" (DNT) signal. Because there is no common industry standard for interpreting DNT signals, the Service does not change its behavior in response to them. Because we do not track users across third-party websites or sell or share personal information for cross-context behavioral advertising, there is no such activity for a DNT signal to stop. If your browser sends a Global Privacy Control (GPC) signal, we will treat it as a request to opt out of the sale or sharing of personal information associated with that browser, even though we do not engage in such sale or sharing.

8. Data Security

8.1 Our safeguards. We use reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction, appropriate to the nature of the information. These include, for example: encryption of data in transit using HTTPS/TLS; salted, one-way hashing of passwords; secure, HttpOnly session cookies; private (non-public) storage of Uploaded Documents, which are served only to signed-in users of the Company Account that owns them; separation of each Customer's data by Company Account; role-based permissions; temporary lockouts after repeated failed sign-in or password-reset attempts; and the use of reputable hosting and infrastructure providers.

8.2 No guarantee. No method of transmission over the internet or method of electronic storage is completely secure. While we work to protect information, we cannot guarantee its absolute security. You are responsible for keeping your password confidential, using a strong and unique password, changing any temporary password promptly, and signing out of shared devices. Customers are responsible for promptly removing access for people who should no longer have it.

8.3 Security incidents. If we learn of a security breach that affects personal information, we will notify affected Customers without unreasonable delay, and we will notify affected individuals and government authorities where and as required by applicable law, including California Civil Code section 1798.82. Where Customer Data is involved, we will cooperate with the Customer so that it can meet any notification obligations it may have.

9. Your Choices and Rights

9.1 Account information. Authorized Users can view and update certain account information (such as their password) in the Service. A Customer's administrators can update names, roles, permissions, and job assignments, lock or remove users, and export or delete Customer Data.

9.2 Requests about Customer Data. Because we process Customer Data on behalf of our Customers, if you want to access, correct, or delete personal information that is part of Customer Data (for example, your name on an uploaded document or your activity history in a Company Account), please contact the relevant Customer (typically your employer or the business that invited you). If you contact us directly, we will, where appropriate, forward your request to the Customer and assist the Customer in responding.

9.3 Privacy rights under California law. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies only to for-profit businesses that meet certain thresholds, such as annual gross revenue above an inflation-adjusted amount (US$26,625,000 as of the Effective Date). Based on our current size, we do not believe the CCPA currently applies to us. We nevertheless want to be transparent and to respect the privacy of the people who use the Service. Subject to applicable law and to Section 9.2, California residents (and, to the extent we are able, other individuals) may ask us to:

• Know and access the categories and specific pieces of personal information we have collected about them, the sources of that information, the purposes for which we use it, and the categories of third parties to which we disclose it;
• Delete personal information we have collected from them, subject to legal exceptions (for example, information we must keep to complete a transaction, secure the Service, or comply with law);
• Correct inaccurate personal information we maintain about them; and
• Obtain a copy of their personal information in a portable format, where technically feasible.

We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of; we also honor GPC signals as described in Section 7.3. We use account login credentials (which California law treats as sensitive personal information) only to provide and secure the Service. We will not discriminate against anyone for exercising privacy rights.

9.4 Submitting a request. To make a request, email us at support@tijorn.com with the subject line "Privacy Request." We will need to verify your identity before fulfilling certain requests, generally by confirming information associated with your account, such as your email address. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide your signed permission and may ask you to verify your identity directly. We aim to respond within forty-five (45) days. If we need more time, we will tell you why. If we deny a request, we will explain the reason.

9.5 California "Shine the Light." California Civil Code section 1798.83 allows California residents to request information about the personal information a business has disclosed to third parties for those third parties' own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

9.6 Email communications. The emails the Service sends (such as invitations, password resets, security notices, and billing notices) are transactional and are necessary for the Service. We do not currently send marketing emails. If we do so in the future, we will include a way to unsubscribe.

10. Children's Privacy

The Service is a business tool intended for use only by adults acting on behalf of a business. It is not directed to children, and we do not knowingly collect personal information from children under the age of 13, as described in the Children's Online Privacy Protection Act (COPPA), or from anyone under 18. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child has provided personal information to the Service, please contact us at support@tijorn.com.

11. Where Information Is Processed

We are based in the United States, and the Service is intended for businesses in the United States. Information is processed and stored in the United States by us and our service providers, and some service providers (including AI providers) may process or temporarily cache information in other countries where they or their affiliates operate. If you use the Service from outside the United States, you understand that your information will be transferred to, processed in, and stored in the United States and other countries whose data protection laws may differ from those in your country.

12. Third-Party Websites and Services

The Service may link to or integrate with third-party websites and services, such as Google Drive. We are not responsible for the privacy practices of those third parties, and their collection and use of information is governed by their own privacy policies. When a Customer connects a third-party service, the Customer is responsible for its use of that service.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and change the "Last Updated" date above. If we make material changes, we will give Customers reasonable advance notice, such as by email to the Customer's administrators or by a notice in the Service, before the changes take effect. Changes will apply to information collected after the updated Privacy Policy takes effect, unless the law allows otherwise or you consent. If you continue to use the Service after the updated Privacy Policy takes effect, the updated version will apply to you.

14. How to Review and Request Changes to Your Information

Authorized Users may review and change certain account information by signing in to the Service. A Customer's administrators may review and change Company Account and Authorized User information. Anyone may also request access to or correction of their information by contacting us as described in Section 15.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Tijorn LLC
Attn: Privacy
[BUSINESS ADDRESS]
Email: support@tijorn.com