Privacy Policy

1. Who we are

Costlark: AI Construction Cost Estimator ("the app") is developed and published on Google Play by VELOX APP LTD ("we", "us"), a company registered in England and Wales under company number 17186614, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of your account data, usage data and the other data described in this policy that relates to you as our user.

For the information about your own customers that you enter into the app, you are the controller and we act as your processor (see section 6). This policy covers the Costlark: AI Construction Cost Estimator Android app only. Our company privacy policy covers this website and emails you send us. For any privacy question, or to use your rights, email [email protected].

2. Summary

• The app shows no ads and does not use your advertising ID.
• You start with an anonymous account. Adding an email is optional and lets you restore the account on a new phone.
• Your business profile, customers, jobs, photos, estimates, quotes and invoices are stored on servers located in the European Union.
• To draft an estimate, your job photos and description are sent to Google (Gemini API), and the photos are also sent to TypeSafe to check the estimate items against them. They are used only to produce your estimate.
• Estimates are AI-assisted drafts that you must review. They are not professional advice and not a binding quote.
• The app has no third-party analytics or crash-reporting tools. We only keep the first-party usage counters described below.
• Purchases are handled by Google Play. We do not sell your data.
• You can delete your account in the app. The app is for adults aged 18 and over.

3. What we collect and why

• Account: a random device key generated when you install the app (stored on our servers only as a hash), so that your account works without a password. If you add an email address, we use it to send sign-in codes so you can restore the account on a new phone.
• Your business profile: business name, logo, address, phone number, email, tax number, licence number, labour rate and your own terms, which appear on the quotes and invoices you send.
• Your customers: the name, phone number, email, address and notes you enter for each customer.
• Jobs and documents: job descriptions, up to 3 photos per job, estimates, quotes, invoices and payment records. Location data embedded in photos (EXIF) is removed before upload.
• Support messages you send us from the app and AI problem reports you submit.
• Technical data: usage counters (for example how many estimates you have used), app version, platform, and a device integrity result from Google Play Integrity.
• Purchase data: your subscription is bought through Google Play. We receive the purchase token and subscription status from Google, and keep the token encrypted. We never see your card details.
• Quote-link visits: when your customer opens a quote link, we record the name and message they choose to type when they reply, plus a hashed form of their IP address and browser details, used only to prevent abuse.

The app asks for permission to use the camera (to photograph the job) and the microphone (only if you choose voice dictation). It does not use your location, contacts or phone storage, and it does not use the advertising ID.

4. AI processing: Google Gemini and TypeSafe

To draft an estimate, the app sends the job description and the photos you attached to our servers, and our servers send them to two service providers that process them on our behalf:

• Google (Gemini API) receives the description and the photos to draft the list of questions, the scope of work and the estimate items.
• TypeSafe (image-verification API) receives the photos to check the estimate items against them.

Photos and descriptions are sent only to these two providers and only to produce your estimate. We do not use them for anything else. Each provider handles the data under its own terms, and we do not control how long they keep it or whether they use it to improve their services. If you do not want your photos or text processed this way, do not use the estimate feature.

Prices in an estimate come from your own price list and from public price data. The result is an AI-assisted draft. The AI can make mistakes, and its output is never professional advice or a binding quote. You must review and correct every estimate before you send it to anyone.

Short-lived copies of AI answers for identical requests are kept on our servers for up to 7 days to avoid repeating the same work.

5. Voice dictation

If you tap the microphone to dictate a job description, the audio is handled by the speech recognition service built into your Android phone, not by us. We receive only the resulting text, never the audio. On some phones the system service may use Google's cloud recogniser; that processing is governed by Google's terms and your phone settings.

6. Your customers' data

The customers, addresses, notes and other details you enter about your own customers belong to your business. You are the controller of that data and are responsible for having a lawful basis to use it and for telling your customers how you use it. We act as your processor: we store it and handle it only to provide the app to you and on your instructions, and we do not use it for our own purposes.

7. Who receives data

• Google: Gemini API (AI drafting), Google Play (purchases and device integrity).
• TypeSafe: photo verification.
• Your customers, when you send them a quote link or document.
• Authorities, where the law requires it.

We do not sell your data and do not share it with anyone for their own advertising.

8. Where data is stored and international transfers

Our servers are located in the European Union. Google and TypeSafe may process data in the United States and other countries. Where data leaves the UK or the European Economic Area, it is protected by safeguards recognised by UK and EU law, such as standard contractual clauses or an adequacy decision.

9. How long we keep data

• Job photos: deleted 30 days after upload.
• Deleted projects: kept for 30 days in case you restore them, then purged.
• Quote links: expire after 60 days.
• Idempotency keys (used to avoid duplicate submissions): 24 hours.
• Sync deletion records: 90 days.
• Push notification logs: 14 days.
• Support messages and AI problem reports: kept until the matter is closed or fixed, and in any case purged after 365 days.
• Identical-request AI cache: up to 7 days. Technical diagnostic logs: short-lived, up to 48 hours.
• Everything else in your account: until you delete the account.
• Subscription records: Google keeps purchase records under its own policies. We keep anonymised subscription events (without your identity) to run and account for the service.

10. Deleting your account

You can delete your account in the app. The account is hidden at once. You then have 7 days to cancel the deletion. After that, we delete your business data, including customers, jobs, photos, estimates, quotes and invoices, and revoke your quote links. Copies held by Google and TypeSafe follow their own terms. Data kept on your phone is removed when you uninstall the app. You can also email [email protected] to ask for deletion.

11. Security

• All data is sent over encrypted connections (TLS).
• Device keys and quote-link tokens are stored only as hashes, and purchase tokens are stored encrypted.
• Each business can reach only its own data, enforced by per-company access control.

No system is perfectly secure, so please keep your phone locked and your email account protected.

12. Our legal basis (UK and EU GDPR)

We process your data to provide the app and your subscription (contract), to keep the service secure and prevent abuse (legitimate interests), to meet tax and legal duties (legal obligation).

13. Your rights

Under the UK GDPR (and the EU GDPR where it applies) you may have the right to access, correct, delete or restrict the use of your personal data, to object to it and to data portability, and to withdraw consent at any time where we rely on it. Email [email protected] to use them. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk) or your local data protection authority.

14. Children

The app is a professional tool for adults aged 18 and over. It is not directed at children, and we do not knowingly collect data from children.

15. Changes to this policy

If the app's data handling changes, we will update this page and its effective date before the new version is released.

16. Contact

VELOX APP LTD
128 City Road, London, EC1V 2NX, United Kingdom
Email: [email protected]