Privacy Policy

Last updated: November 3, 2026

This Privacy Policy explains how LapseHawk ("LapseHawk", "we" or "us") collects, uses and shares information when businesses and their users use the LapseHawk website, web application and mobile application (the "Service"). It is part of our Terms of Service.

1. Information we collect

Account information: company name, address and phone, user names, email addresses, roles, phone numbers you add, and password hashes (we never store passwords in readable form).

Customer Data: documents and files you upload, email or connect (such as certificates of insurance, W-9s, licenses, permits, inspection reports, invoices, bills, pay applications and lien waivers), and the information extracted from them, including vendor, subcontractor and customer names and contact details, policy numbers, dates and amounts. You control what you upload.

Connected accounts: if you connect services such as Microsoft Outlook/OneDrive, Google Gmail/Drive, QuickBooks or WhatsApp, we receive the access tokens and the messages, attachments or files those connections make available, within the permissions you grant. Section 4 explains exactly how we handle data from Google accounts.

Billing information: plan, payment status, card brand and last four digits, received from our payment processor. We do not receive or store full card numbers.

Usage and device information: log data such as IP address, browser and device type, pages and actions, dates and times, error reports, and, if you turn them on, push-notification subscription tokens.

Communications: messages you send us through the contact form, feedback or email.

2. How we use information

We use information to: provide, operate and secure the Service; read and organize your documents and show compliance results, reminders, schedules, binders and pay applications; send emails, reminders and notifications that you initiate or enable; process payments; provide support; detect and prevent fraud, abuse and security incidents; comply with law; and improve the Service using aggregated or de-identified information. We do not use Customer Data to build advertising profiles.

3. AI processing

To read documents and generate suggestions such as extracted fields and project schedules, the Service sends the relevant document or text to third-party AI providers (for example, Anthropic or Google, depending on configuration) under their business terms. Documents are sent to the AI service only to be read; they are not sold, and we do not permit AI providers to use your documents to train their models where their business terms allow that choice.

4. Google user data

This section explains how LapseHawk accesses, uses, stores, shares and deletes information it receives from Google APIs when you connect a Google account ("Google user data"). Connecting Google is optional, and LapseHawk works without it.

What we access and why. LapseHawk asks only for the Google permissions below, and uses each one only for the feature it powers:

Gmail, read-only (gmail.readonly): when you sync your Gmail connection (by tapping "Sync now", or automatically if you turn on auto-sync), LapseHawk looks for emails that have attachments and arrived since the last sync (the first sync looks back 30 days), and imports their PDF and image attachments, such as bills, invoices, certificates of insurance (COIs) and permits, into your LapseHawk documents so they can be read and filed. LapseHawk never sends, deletes, moves, labels or changes your email, and it does not save the text of your emails; it keeps the imported attachment and a reference to the email it came from.
Google Drive, read-only (drive.readonly): LapseHawk opens only the one Drive folder you name in Connections (by default "LapseHawk") and imports the PDF and image files in it that were added or changed since the last sync. It never changes, shares or deletes anything in your Drive.
Google Calendar events (calendar.events): if you turn on "Add LapseHawk dates to my Google calendar", LapseHawk creates, updates and removes events in your primary Google Calendar for your LapseHawk deadlines, such as insurance and permit expirations, inspections, pay-app and binder days, schedule milestones and state inspection dates. These events are marked as LapseHawk events, and LapseHawk only changes or removes events it created. While "Show my Google events on the LapseHawk calendar" is on (you can switch it off in Connections), LapseHawk reads the events in your primary calendar from about one month back to six months ahead (title, date and time, location and link) to show them on your LapseHawk calendar.
Your Google email address (openid, email): to show which Google account is connected.

Where it is stored and who can see it. Imported documents, the information read from them, the cached copy of your calendar events and the access tokens for your Google connection are stored in your LapseHawk account with our cloud provider, Cloudflare (D1 database and R2 file storage). Data is encrypted in transit (HTTPS) and at rest. Google user data is visible only to the users of your own LapseHawk company account, the same way as any other document in it. Other companies never see it, and the access tokens are never shown in the app.

AI processing. To read an imported document, for example to pull the vendor, dates, amounts and policy limits from a COI, LapseHawk sends that document to the AI provider selected for the Service, Google (Gemini API) or Anthropic (Claude API), or to the provider of the AI key your company admin adds in Settings. It is sent only to extract those fields, under the provider's paid commercial API terms, which do not allow the provider to use it to train its models. Your email text and calendar events are not sent to AI providers.

What we never do. We do not sell Google user data. We do not use or transfer it for advertising, including retargeting, personalized or interest-based ads, and we do not transfer it to advertising platforms, data brokers or information resellers. We do not use it to determine credit-worthiness or for lending. We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models, and we do not allow our AI providers to do so. We transfer Google user data only to provide the features described above (to the hosting and AI service providers named in this section), for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger, acquisition or sale of assets, and then only after obtaining your explicit prior consent.

Human access. No person at LapseHawk reads your Google user data unless (a) you first give us permission to view specific messages, files or events, for example in a support request; (b) it is necessary for security purposes, such as investigating a bug or abuse; or (c) it is necessary to comply with applicable law.

Limited Use. LapseHawk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect Google at any time in LapseHawk under Connections → Disconnect. This stops all access, deletes the stored Google tokens and the cached copy of your calendar events, and removes the events LapseHawk added to your Google Calendar. Turning off "Add LapseHawk dates to my Google calendar" also removes those events. You can also revoke LapseHawk's access in your Google Account at myaccount.google.com/permissions. If you revoke access there first, LapseHawk can no longer remove the events it added, and you can delete them in Google Calendar.

Deleting your data. Documents already imported from Gmail or Drive stay in your account after you disconnect, so your records stay complete. You can delete any of them in LapseHawk at any time. When an account admin deletes the account (Settings → Data → Delete account), LapseHawk deletes the account's documents and files, including those imported from Google, the information read from them, its connections and stored Google tokens, and its cached calendar events. Backup copies are overwritten on a rolling basis, as described in Section 8. To ask us to delete Google user data, or with any question about it, email lapsehawk@gmail.com.

QuickBooks Online (Intuit)

Connecting QuickBooks is optional. When you connect it, LapseHawk uses Intuit's secure sign-in (OAuth) and only the accounting access you approve. We never see your Intuit password.

What we read: your company name, your vendor list, your chart of accounts, and the bills LapseHawk sent (to avoid duplicates and show when they're paid).

What we write: bills and their PDF copies, plus a vendor record if one doesn't exist yet. Only when you tap Send to QuickBooks, or for the projects or vendors you turn auto-send on for. We never change or delete anything else in your books.

We don't sell QuickBooks data, use it for ads or share it with anyone outside your company account. It's stored encrypted in our cloud provider, the same as your documents.

Disconnect any time in Connections. We revoke our access with Intuit immediately and delete the stored connection. To have all your data deleted, email lapsehawk@gmail.com.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only: (a) with service providers ("subprocessors") that host and run the Service for us, including cloud hosting and storage (Cloudflare), AI document reading (Anthropic, Google), payment processing (Stripe), text message delivery (Twilio), and email delivery (our transactional email provider, such as Resend); (b) with the third-party services you choose to connect; (c) with the recipients of messages you send through the Service; (d) when required by law, subpoena or court order, or to protect rights, safety and security; and (e) in connection with a merger, acquisition or sale of assets, subject to this Policy.

5A. Text messaging (SMS)

When a LapseHawk customer (a property manager or contractor) turns on texting, LapseHawk sends text messages on that customer's behalf from LapseHawk's own phone number. Examples: pre-inspection visit requests, scheduling links and reminders, and inspection or access notices to the customer's tenants and contacts. When enabled, it also sends sign-in codes and account alerts to LapseHawk users. To do this we process the mobile number, the recipient's name and unit, the message, delivery status, replies, and opt-in and opt-out records.

We do not sell, rent or share mobile phone numbers, SMS opt-in data or consent with third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile information is shared only to deliver and manage the messages: with our text-message provider (Twilio) and wireless carriers, and with the LapseHawk customer the message is sent for. For example, a tenant's reply is shown to their property manager and, when that integration is enabled, saved in the property manager's own property-management software. This applies notwithstanding anything else in this Policy, including Section 5.

Reply STOP to any message to stop receiving texts, or HELP for help. You can also email lapsehawk@gmail.com. Message and data rates may apply. We keep message and opt-out records while the customer's account is active and as long as needed to honor opt-outs and show consent. See the SMS Terms (Terms of Service, Section 10A) and lapsehawk.com/sms.

6. Support access

Your documents are private to your company. Other companies never see them, and LapseHawk only accesses an account when needed to provide support or keep the service running. Access is limited to authorized LapseHawk administrators and is recorded in the account's audit log where applicable. For data received from Google, the stricter rules in Section 4 apply.

7. Cookies and similar technologies

We use a small number of essential cookies and browser storage to keep you signed in, remember preferences (such as calendar view) and run the app offline. We do not use third-party advertising cookies. You can clear cookies and site data in your browser, but the Service may not work without essential cookies.

8. Retention

We keep Customer Data and account information for as long as your account is active. After an account is closed or deleted, we delete Customer Data within a reasonable period (generally within 30 days, subject to any export window described in the Terms), except copies in backups, which are overwritten on a rolling basis, and information we must keep for legal, tax, accounting or security reasons.

9. Security

We use industry-standard measures to protect information, including encryption in transit (HTTPS), hashed passwords, access controls, and audit logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and tell us promptly about any suspected unauthorized access.

10. Your choices and rights

Account admins can view, correct, export (Settings → Data) and delete account information and Customer Data. Users can update their own profile and password. You can disconnect connected services and turn off email and push notifications at any time. To make any other request, email lapsehawk@gmail.com. We will verify requests and respond within the time required by law.

If we process personal information on behalf of a business customer (for example, contact details of that customer's vendors), we act as a service provider/processor and will refer requests to that customer and assist it in responding.

11. California and other U.S. state privacy rights

Residents of California and certain other states may have the right to: know the categories and specific pieces of personal information we collect, use and disclose; request deletion; request correction; obtain a portable copy; and opt out of the sale or sharing of personal information and of certain profiling. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, as amended (CCPA), and we do not knowingly collect information from children under 16. We will not discriminate against you for exercising your rights. You may use an authorized agent, subject to verification. In the last 12 months we collected the categories of information described in Section 1 (identifiers, commercial information, internet activity, professional information and the contents of documents you provide) for the purposes in Section 2 and disclosed them to the categories of recipients in Section 5. To exercise these rights, email lapsehawk@gmail.com.

12. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children under 16.

13. International users

We operate in the United States, and information may be processed in the United States and other countries where our service providers operate.

14. Changes to this Policy

We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes, notify account owners by email or in the Service.

15. Contact

LapseHawk · lapsehawk@gmail.com · Contact form