Privacy Policy
Effective October 23, 2026.
CivilDesign AI is a software-as-a-service platform for civil engineering and public-works teams, operated by Gueridon LLC of Glendale, California ("we", "us" or "our"). This Privacy Policy describes how we process personal information collected through civildesign.ai and its tools (the "Service"). California residents: see the state privacy rights notice at the end, which is also our notice at collection.
Personal information we collect
Information you provide to us.
- Account data: your name, email address, organization name, role, a scrypt-hashed password (we never store the password itself), and, if you turn on multi-factor authentication, its secret and recovery codes.
- Content and input data: documents and data you upload or enter into the tools (for example specifications, plan submittals, project addresses and coordinates, bid and rate information, letters and survey questions) and the outputs generated from them.
- Billing data: for the self-serve Consultant plan, Stripe collects your payment details. We receive only Stripe's customer and subscription identifiers and subscription status, never your card number. City and County plans are invoiced.
- Communications data: what you send us by email.
Information about people who are not account holders. Our customers can publish a Civic Survey or an embedded Permit Counter assistant. When members of the public use them, we process their answers or questions, an email address if they choose to give one, and, for surveys, a one-way hash of their IP address used to limit duplicate responses. We process this information on behalf of the customer that published the survey or assistant; that customer's own privacy policy also applies.
Automatic data collection.
- Device and security data: IP address, browser information, request times and pages requested, recorded in our server logs; IP addresses linked to failed sign-ins and blocked sign-ups, recorded in an audit log; and sign-in and session records.
- Usage data: for AI features, the number of AI tokens used, the model and the cost, per organization and tool. We do not log the text of AI prompts or responses for this purpose.
Cookies and similar technologies
We use one essential cookie, cdai_session (HttpOnly, Secure,
lasting up to 30 days), to keep you signed in and protect forms. We use no
analytics, advertising or third-party cookies and run no third-party trackers.
We therefore have no cookie banner.
AI processing
Tools with AI drafting features, including the Redline Plan Checker, Permit Counter, City Letter Writer, Spec Writer, LID Composer, Change Order Review, Submittal Review, Construction Manager and Civic Survey insights, send the content you submit to Anthropic's API to generate a draft. Under Anthropic's commercial terms, Anthropic does not use that content to train its models. Other features run entirely on our servers. We do not use your content to train AI models. Outputs are informational drafts for review by a qualified professional; see our Terms of Service.
How we use your personal information
- Service delivery: create and run your account, sign you in, run the tools you use and produce the outputs you request, and provide support.
- Billing: process subscriptions through Stripe and invoice City and County plans.
- Service-related email: verification and sign-in codes. We do not send marketing email.
- Security and compliance: prevent abuse and fraud, keep an audit trail, meter AI usage against plan limits, comply with law and legal process, and enforce our Terms.
- Improving the Service: fix problems and decide what to build, using aggregate usage information.
How we share your personal information
- Service providers: DigitalOcean (hosting, United States), Stripe (payments), Anthropic (AI drafting) and Zoho (transactional email).
- Public data services, when you use the tools that need them: addresses you enter in the hydrology map go to the U.S. Census Bureau geocoder; map coordinates go to California county parcel services; base-map tiles are fetched from Esri by our server, so Esri does not receive your IP address.
- Your organization: owners and members of your organization can see the organization's projects, uploads and outputs.
- Professional advisors and authorities, where needed for the purposes above or required by law.
- Business transferees, in connection with a merger, sale or similar transaction.
We do not sell personal information or share it for cross-context behavioral advertising.
Retention
We keep account data and content for as long as your organization's account is active. We delete an organization's data, including its files, outputs, members and logs, on account closure or on a verified written request. Sign-ups that are never verified are deleted automatically after 48 hours. Server logs are kept for up to 90 days, and backups roll off within 14 days, so deleted data can remain in backups until then. We may keep information longer where the law requires.
Your choices
- Access and update: you can change your password when signed in; email us to correct other account details. Organization owners can remove members.
- Export or delete: email support@civildesign.ai to receive a copy of your data or to close your account and delete your organization's data.
- Do Not Track: we do not track you across sites, so there is nothing for the signal to switch off.
Security
We use encryption in transit, hashed passwords and API keys, access controls, audit logging and multi-factor authentication. See our Security page. No system is completely secure, and we cannot guarantee the security of your information.
Data location
We store data in the United States. Anthropic, Stripe and Zoho may process data in other countries under their own terms.
Children
The Service is a professional tool and is not intended for anyone under 18. We do not knowingly collect personal information from children.
Changes
We may update this policy. We will revise the effective date above, and for material changes we will notify account owners by email or in the Service.
Contact
Gueridon LLC · Glendale, California · support@civildesign.ai
State privacy rights notice
This section applies to residents of U.S. states whose privacy laws apply to us and grant these rights, including California. Not every right is available in every state, and rights are not absolute.
- Know and access the personal information we collected about you, its sources, our purposes, and who we disclose it to.
- Correct inaccurate information and delete information we collected from you.
- Appeal our decision on a request.
- Opt-outs: we do not sell personal information, share it for targeted advertising, or use it for automated decisions with legal or similarly significant effects.
- Sensitive personal information: account passwords are sensitive under California law; we use them only to sign you in, and we do not use sensitive information to infer characteristics about you.
- Nondiscrimination: we will not discriminate against you for exercising these rights.
To make a request, email support@civildesign.ai from the address on your account. We verify requests by confirming you control that address. You may use an authorized agent; we may ask for proof of authority. If your information came from a survey or Permit Counter published by one of our customers, we will refer your request to that customer and help them answer it.
Information practices in the past 12 months.
| Information | CCPA category | Purposes | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Account data | Identifiers; professional information; sensitive (password, hashed) | Service delivery, security | Service providers | No |
| Content and input data | Any category you include, e.g. addresses and geolocation of project sites | Service delivery, AI drafting | Service providers; public data services; your organization | No |
| Billing data | Commercial information | Billing | Stripe | No |
| Device, security and usage data | Identifiers (IP address); internet activity | Security, metering, operations | Service providers | No |
| Survey and Permit Counter data | Identifiers (optional email, hashed IP); any information included | On behalf of the publishing customer | Service providers; the publishing customer | No |
California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.
Adapted from a privacy policy template published by General Legal, PC under CC0 1.0. General Legal has not reviewed this policy and it is not legal advice.