Site Punch Privacy Policy

Last updated: October 20, 2026 Effective date: October 20, 2026

This Privacy Policy explains how Shreeji Hotel Group, LLC, a North Carolina limited liability company ("Site Punch," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with Site Punch, the construction punch-list service at https://getsitepunch.com and related websites, links, and services (the "Service").

Capitalized terms not defined here (such as Customer, User, Trade Link, and Customer Data) have the meanings given in our Terms of Service.

1. Who This Policy Covers and Our Role

The Service is a business tool. Our customers are companies and other organizations ("Customers"). People who use the Service include the Customer's own staff who have accounts ("Account Users") and subcontractors or other trades who access assigned items through private Trade Links ("Trade Users").

• When we act for our Customers. For Customer Data (projects, punch-list items, photos, comments, and similar content that Users put into the Service), we process personal information on behalf of and at the direction of the Customer. The Customer decides what goes into the Service and controls that data. If you are a User and have questions or requests about Customer Data, please contact the Customer (for example, the general contractor or company that invited you). We will help the Customer respond.
• When we act for ourselves. For account, billing, website, device, and support information, we decide how the information is used, and this Policy applies directly.

2. Information We Collect

a. Account and contact information. When a Customer signs up or an Account User is invited, we collect information such as name, business email address, company name, job title or role, phone number (if provided), and login credentials (passwords are stored in hashed form).

b. Trade User information. Trade Users do not create accounts. When a Trade User opens a Trade Link, we may ask for a first name only, which is displayed with that person's updates. We also collect the device and usage information described below.

c. Project content (Customer Data). Information Users add to the Service, such as project names and addresses, punch-list items, descriptions, locations, status updates, comments, and the names of people assigned to items.

d. Photos and files. Photos and other files Users upload. Photos may show people, job sites, or property, and may contain embedded metadata (such as the date, time, device type, or GPS location) depending on the device's settings. We remove GPS location and other embedded metadata (EXIF) from photos when they are uploaded; the Service keeps only the image itself and the date and time stamp the Service adds.

e. Billing information. If a Customer buys a paid plan, our payment processor, Stripe, collects payment card and billing details. We receive limited information from Stripe, such as the billing contact, the card type and last four digits, the expiration date, and payment status. We do not store full card numbers.

f. Device, browser, and usage information. When anyone uses the Service, we and our hosting provider automatically collect technical information such as IP address, browser type and version, device type, operating system, pages and features used, referring URLs, date and time of access, and error and performance logs.

g. Cookies and similar technologies. We use cookies and similar technologies that are necessary to keep you signed in, remember preferences, secure the Service, and understand how the Service performs. We do not use third-party advertising cookies or third-party analytics tools.

h. Feedback and support. When you contact us or submit a feedback report through the Service, we collect the contents of your message and any information you choose to include. Feedback reports may include a screenshot of your screen at the time of the report, which may capture project content, photos, names, or other information that was visible. Please review the screenshot before you submit it.

i. Push notification tokens. If you use the Site Punch iPhone or Android app and allow notifications, your device gives us a push notification token. We store it with your account and company and use it only to send you Service notifications (for example, when a trade comments on or marks an item complete). We send notifications through Apple Push Notification service and Google Firebase Cloud Messaging, which receive the token and the notification text. You can turn notifications off at any time in your device settings; signing out or deleting your account removes the token from our systems.

j. Access codes and join and usage logs. A Customer's billing owner can create access codes and links for inspectors, general contractors, and subcontractors. When someone joins with an inspector code, we record which code they used and when, together with their account details (Section 2a). When someone opens or acts through a GC/subcontractor code or link, we record a random identifier stored in their browser, the first name they choose to give (if any), when they first and last used it, and how many times they opened it or took an action (such as commenting or marking an item GC Complete). The billing owner can see these logs, remove a person's access, rotate a code, or revoke it.

3. How We Use Information

We use information to:

• provide, operate, maintain, and support the Service, including generating Trade Links and sending notifications;
• create and manage accounts and verify Users;
• process payments, manage subscriptions, and send invoices and receipts;
• respond to questions, feedback reports, and support requests, and fix bugs;
• monitor, secure, and protect the Service, our Customers, and others, and prevent fraud and abuse;
• understand how the Service is used and improve it;
• send service-related messages (such as security alerts, billing notices, and changes to our terms), and, where permitted, product updates that Customers may opt out of;
• comply with law and enforce our agreements.

Automated systems and AI. The Service is operated, monitored, and maintained in part by automated systems, including artificial intelligence tools. These systems may process information (including Customer Data and feedback screenshots) to run the Service, diagnose and fix problems, and improve the Service. We do not use automated systems to make decisions that produce legal or similarly significant effects about individuals. We do not use Customer Data to train general-purpose AI models made available to third parties. Any third-party AI provider that receives this information is listed in Section 5.

4. How We Share Information

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising (as those terms are defined in California law). We share information only as follows:

• Within the Customer's account. Information Users enter is visible to other authorized Users of the same Customer account and, for assigned items, to Trade Users who have the relevant Trade Link. Anyone who has a Trade Link may be able to see the information available through it.
• With service providers (subprocessors). We use the vendors listed in Section 5 to host and operate the Service. They may use the information only to provide services to us, under written obligations of confidentiality and security.
• For legal reasons. We may disclose information if we believe in good faith it is necessary to comply with law, legal process, or a valid government request; to enforce our Terms; or to protect the rights, property, or safety of Site Punch, our Customers, or others.
• In a business transaction. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy's protections.
• With consent. We may share information for other purposes with the Customer's direction or the relevant person's consent.

5. Subprocessors

We may update this list from time to time. We will post changes to this list at least 30 days before a new subprocessor begins processing Customer Data.

6. Where Information Is Stored

We store and process information in the United States. The Service is not currently designed for or marketed to customers outside the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

7. Data Retention

We keep information only as long as reasonably needed for the purposes described in this Policy:

• Customer Data is kept while the Customer's account is active. When Users delete content, it may be soft deleted (hidden but recoverable) until the Customer's data is deleted under the Terms, and can be restored on request until then. After an account ends, Customer Data is available for export for 30 days and then deleted from active systems as described in the Terms.
• Backups are made daily and are kept for up to 5 days, after which they are overwritten or deleted. Deleted information may remain in backups until they expire.
• Account and billing records are kept for as long as the account is active and afterward as needed for tax, accounting, legal, and dispute-resolution purposes (billing records for 7 years).
• Logs and device information are kept for up to 30 days, unless needed longer to investigate security issues.
• Push notification tokens are kept until you sign out on that device, delete your account, or the token stops working.
• Access-code join and usage logs are kept while the code exists and the Customer's account is active, and are deleted with the account.
• Feedback reports and screenshots are kept for 12 months or until the issue is resolved, whichever is longer.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit (HTTPS), access controls, and daily backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Customers are responsible for sharing Trade Links only with intended recipients, and all Users are responsible for protecting their devices and credentials. If you believe your account or a Trade Link has been compromised, contact us right away at support@getsitepunch.com.

9. Your Choices and Rights

a. Account Users. You can review and update your account information in the Service. Customers can export and delete Customer Data using the Service's features or by contacting us. You can opt out of non-essential product emails using the unsubscribe link; we will still send service-related messages.

Deleting your account. You can delete your account at any time in the app (Account → Delete account) or by emailing support@getsitepunch.com with the subject "Delete my account" (instructions at https://getsitepunch.com/delete-account). If you are the Customer's only billing owner, deleting your account permanently deletes the Customer's account and all of its Customer Data, including projects, photos, comments, access codes and logs, team logins, and device tokens, and cancels any subscription. Otherwise only your own login, sessions, and device tokens are deleted, and Customer Data stays with the Customer. Deletion happens immediately in the live system; copies in our backups are overwritten within the retention period in Section 7, and payment records held by Stripe are kept as required by law.

b. Requests about Customer Data. If your personal information is included in Customer Data (for example, your name on a punch-list item or your image in a photo), please send your request to the Customer that controls that account. If you contact us directly, we may forward your request to the Customer and will support the Customer in responding.

c. U.S. state privacy rights (including California). Depending on where you live, laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and similar laws in other states may give you the right to:

• know what personal information we collect, use, and disclose, and to access a copy;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale of personal information, "sharing" for cross-context behavioral advertising, targeted advertising, and certain profiling (we do not do these things);
• limit the use of sensitive personal information (we do not use sensitive personal information for purposes that would require this); and
• not be discriminated against for exercising these rights.

To make a request, email support@getsitepunch.com with the subject line "Privacy Request." We will verify your request by matching information you provide with information we hold, and we may ask for more information to do so. You may use an authorized agent, who must provide proof of authority. If we deny your request, you may appeal by replying to our decision with "Appeal" in the subject line, and we will respond within the time required by law. Where we process the information as a service provider for a Customer, we will refer your request to that Customer as described above.

d. Categories under California law. In the past 12 months we have collected the following categories of personal information, for the business purposes described in Section 3, and disclosed them to the service providers described in Section 5: identifiers (such as name, email, and IP address); commercial information (such as subscription and billing history); internet or other electronic network activity (such as usage and device data); professional or employment-related information (such as company and job role); audio, electronic, visual, or similar information (such as photos and screenshots); and approximate location derived from IP address or photo metadata. We have not sold or shared (for cross-context behavioral advertising) any of these categories.

We honor these rights as a voluntary commitment even where a state law does not require it.

e. Do Not Track and Global Privacy Control. Because we do not sell or share personal information for advertising, our practices are the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

10. Children's Privacy

The Service is designed for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16, and Users must be at least 18 to create an account. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify Customers by email or through the Service before the changes take effect, and we will update the "Last updated" date above.

12. Contact Us

Shreeji Hotel Group, LLC (operating Site Punch) Attn: Privacy 6025 Blakeney Park Dr., Suite 125, Charlotte, NC 28277 Email: support@getsitepunch.com