WaiverAuditPRE-FLIGHT DRAW VERIFICATION
Main Page →

Privacy Policy

Effective Date: October 2026

At WaiverAudit, privacy and data sovereignty are fundamental engineering principles. This policy outlines our Dual-Mode privacy architecture, explaining how we protect your commercial construction draw packages, how temporary audit data is retained for retries, and how enterprise vaults segregate project records.

Dual-Mode Privacy Architecture

Tailored data governance for every operational tier

Mode A: Stateless Public, Free & 10-Pack

Temporary Processing and Retry Retention: Uploaded documents are processed in memory or temporary Cloudflare R2 storage. Submitted batch files can remain queued for up to 24 hours to support background processing and recovery. We attempt deletion after terminal completion or failure; a background worker retries expired uploads. Standalone structured results are retained for up to 24 hours so a transport retry can recover its result without another charge. Upload ownership and idempotency records remain for security and billing integrity.

Mode B: Commercial Projects & Enterprise Vault

Encrypted Ledgers & Vaulting: Project-backed audits commit structured financial ledger entries (draw #, vendor, billing period end, billed, due, retainage, disposition, SHA-256 hash) to your encrypted PostgreSQL Draw Ledger for draw tracking and AIA Division 01 exports. Enterprise teams can enable AES-256 raw document vaulting with automated 30-day lifecycle auto-purge.

Technical Architecture: Direct-to-Storage & Transient Processing

  1. 1Direct Presigned Uploads: Large multi-page draw packages (up to 50 MB) — including 30-page AIA G703 continuation sheets, invoices, primary waivers, prior unconditional releases, COIs, and secondary 2nd-tier supplier waivers — upload directly from your browser to isolated Cloudflare R2 object storage via 15-minute presigned PUT URLs, bypassing proxy servers.
  2. 2Transient AI Analysis: The audit engine streams encrypted files into Google Gemini Enterprise multimodal models over TLS 1.3 as an isolated in-memory payload without training Google's models.
  3. 3Deterministic Reconciliation: Financial entities (AIA Line 8, G703 Column G Grand Total, Change Orders, Invoice Net Due, Waiver Consideration, Prior Waivers, Sub-Tier Supplier releases, and Notary Jurats) are reconciled down to the penny via pure deterministic TypeScript rules.
  4. 4Document Cleanup: Temporary files, including supplier waivers, are deleted after audit processing where possible and retried through expiry cleanup. Enterprise documents from completed audits are retained for 30 days. Project audits retain structured draw ledger entries in PostgreSQL. Standalone retry results expire after 24 hours; billing and ownership records remain.
  5. 5Draw Ledger & Client Sandbox: Audit documents are transmitted for processing; standalone results may also be saved in your account-scoped browser IndexedDB vault. Project-backed audits retain structured results in the workspace PostgreSQL draw ledger under access controls. Owner approval requests retain project/company details, recipient, immutable reimbursement terms, decisions, withdrawal history and payment references. Approval and decision emails are sent through our email provider using secure request-specific links.

1. Information We Collect

We collect the minimum information necessary to operate the Service:

  • Account Information: Email address, name, and hashed authentication credentials.
  • Billing Information: Stripe customer ID, subscription status, and billing cycle. We never see or store raw credit card numbers — payment transactions are handled exclusively by Stripe.
  • Audit Usage Metadata: Audit counts, timestamps of verification requests, and service error diagnostics.
  • Technical Data: IP address, browser fingerprint (for device limit authorization), and security headers.

For Mode A (Public, Free Tier, and 10-Audit Pack users), we do NOT permanently store or log document contents, subcontractor bank data, or billing files. For Mode B project users, structured draw accounting fields are stored in your private encrypted Draw Ledger.

2. How We Use Your Information

We use collected information solely to:

  • Authenticate your identity and manage account subscriptions.
  • Process transactions securely through Stripe.
  • Deduct audit credits upon successful verification runs.
  • Prevent denial-of-service abuse and credential sharing.
  • Transmit customer support responses and critical security alerts.
  • Maintain compliance audit trails for enterprise organizations.

We never sell your data, share it with advertisers, or use uploaded documents for marketing.

3. Third-Party Infrastructure & Subprocessors

We partner with top-tier infrastructure providers operating under strict data protection standards:

  • Cloudflare R2 (Cloudflare, Inc.): Encrypted direct-to-storage transit layer for large pay applications up to 50 MB. Zero egress bandwidth tracking with automated lifecycle deletion. See Cloudflare Privacy Policy.
  • Google Gemini API (Google LLC): Multimodal document extraction. Processed under Google Enterprise API terms; customer data submitted through the API is not used to train foundation models. See Google AI Terms.
  • Stripe, Inc.: PCI-DSS Level 1 compliant payment processing. See Stripe Privacy Policy.
  • Supabase, Inc.: PostgreSQL user authentication, quota ledger, and tenant permissions encrypted at rest. See Supabase Privacy Policy.

4. Data Retention Schedules

Account and transaction ledgers are retained for the duration of your active account plus mandatory financial retention periods (up to 7 years) as required by tax statutes.

Document & Ledger Retention:

• Mode A (Public, Free Tier & 10-Pack): Temporary processing and retry storage; deletion attempted after completion and retried after expiry.

• Mode B (Commercial Projects): Financial ledger entries (draw #, vendor, period end, billed, due, retainage, disposition, SHA-256 audit hash) retained in PostgreSQL for active project and audit history. Raw files follow temporary processing/retry retention unless Enterprise Vault is enabled.

• Enterprise Vault: Optional 30-day automated lifecycle purge of raw PDF files in Cloudflare R2; permanent retention of SHA-256 certificate hashes and ledger records.

5. Security & Encryption Standards

All data in transit is encrypted using TLS 1.3. Cryptographic SHA-256 checksums are generated locally to verify document integrity without storing raw files. Enterprise storage repositories utilize AES-256 block-level encryption with customer tenant segregation.

6. Your Rights & Contacts

You may request access to, correction of, or permanent deletion of your personal profile at any time by contacting support@waiveraudit.com. All verified deletion requests are executed across production databases within 30 days.