← Back to DC Operations

Privacy Policy

DC Operations by DC AI, a trade name of Design Concepts LLC · Last updated September 14, 2026

1. Overview

This Privacy Policy explains how Design Concepts LLC, doing business as DC AI (“DC AI,” “we,” “us”), the company behind DC Operations, collects, uses, and protects information when you use our construction project-management platform (the “Service”). It applies to the account holders and users of workspaces on DC Operations.

2. Controller and Processor Roles

For the business data you enter into your workspace - such as your customers, jobs, estimates, and employees - you are the data controller and DC AI acts as a data processor on your behalf, processing that data only to provide the Service. For your own account and how you use DC Operations, we act as the controller.

Because you are the controller of your employees' data, telling your workers what the Service records about them is your responsibility, not ours. This matters most for the time clock: it records GPS coordinates at clock-in and clock-out, and can require a photo at clock-in. Several states regulate employee location tracking and workplace photography, and some require notice or written consent before you may collect it. Check what your state requires and tell your crew before you turn those features on.

3. Information We Collect

  • Account information: your name, email, phone, and company name. Your password is stored only as a one-way hash, so nobody, including us, can read it. If you turn on two-step sign-in, its secret key is stored encrypted.
  • Workspace data you enter: jobs, estimates, invoices, customers, subcontractors, time entries, documents, photos, and messages.
  • Payment information: processed by Stripe. We do not store full card numbers on our servers.
  • Usage and technical data: log data, device and browser information, and IP address, used to operate and secure the Service.
  • Location data from time tracking: when a worker clocks in or out, the Service records the GPS coordinates of that action, if their device permits it. This is recorded per clock-in and per clock-out; it is not continuous tracking, and the Service does not follow a worker's location between those moments.
  • Clock-in photos: a workspace may require a photo at clock-in to confirm who is clocking in. Where enabled, that photo is stored with the time entry. We do not run facial recognition or any other biometric analysis on it.
  • Information about your customers and subcontractors: the contact details you add, and, when one of them approves an estimate or change order or submits a document through a link you sent, their typed name, the time, and the internet (IP) address it came from. That is recorded so the approval has a record behind it.
  • AI feature usage: when an AI feature is used we record which workspace and user ran it, which feature, and the size and cost of the request. We keep this to measure and bill the cost of providing those features. It records that a feature ran, not the content of what was analyzed.

4. How We Use Information

  • To provide, maintain, and improve the Service
  • To authenticate users and keep each workspace’s data isolated and secure
  • To process subscriptions and payments
  • To send transactional messages (for example, invites, password resets, and billing notices)
  • To provide support and respond to your requests
  • To comply with legal obligations

We do not sell your personal information or your workspace data.

5. Multi-Tenant Isolation

DC Operations is a multi-tenant service. Each customer’s workspace is logically isolated so that one customer cannot access another customer’s data. Access is scoped to your organization on every request.

6. Service Providers (Sub-processors)

We use trusted third parties to run the Service. Each processes data only as needed to provide their function:

  • Supabase - database hosting
  • Vercel - application hosting
  • Stripe - subscription billing and payment processing
  • Resend - transactional email delivery
  • Cloudflare R2 - file and document storage
  • Upstash - rate limiting, to block password-guessing and abuse. It holds short-lived counters keyed to IP addresses, which expire within minutes.
  • Anthropic - AI-assisted features (when used). Where you use plan-set estimating, receipt scanning, or the in-app assistant, the file or question involved is sent to Anthropic to produce the result and is returned to you. Under Anthropic's commercial API terms this content is not used to train their models.
  • Intuit QuickBooks - optional accounting sync (only if you connect it)

7. Where Data Is Stored

Our primary database is hosted in the United States (Amazon Web Services, US West). Our service providers may process data in other locations as needed to provide their part of the Service.

8. QuickBooks Integration

If you choose to connect QuickBooks Online, DC Operations sends the customers and invoices you create to your QuickBooks company, and reads invoice payment status back from it. If you choose to, it can also copy customers or estimates from QuickBooks into your workspace. The connection keys are stored encrypted. This data is used only for that synchronization and is handled in accordance with Intuit’s terms. You can disconnect at any time from Admin Tools, which stops syncing and deletes the stored keys.

9. Data Security

We protect data with safeguards including: encrypted connections (HTTPS, enforced by the browser); each company’s data isolated from every other company on every request, with database-level access controls as a second layer; passwords stored only as hashes; optional two-step sign-in; rate limiting against password guessing; and daily backups. No method of transmission or storage is completely secure, but we work to protect your information using reasonable safeguards.

If a security incident affects your data, we will notify affected account owners without undue delay and as required by law, with what we know about what happened and what we are doing about it, so that you can meet any obligations you have to your own customers and workers.

10. Data Retention

We retain workspace data for as long as your account is active. When a subscription ends or a trial lapses, you can still sign in and download your records for at least 60 days; after that we may delete or anonymize the workspace data, unless a longer period is required by law. Routine backups are kept for about 30 days and then overwritten. Job photos and documents you delete are kept for 30 days so they can be restored, then permanently removed.

We keep our own billing and service-usage records after an account closes, because we need them for accounting and tax purposes. These records show which company used which paid features and what they cost us to provide; they do not identify individual users, and the link to a specific person is removed when the account is closed.

11. Your Rights

Depending on where you are located, you may have rights to access, correct, export, or delete your personal information. Workspace administrators can manage most data directly in the app, and an account owner can download all of the company’s records at any time. For other requests, contact us and we will respond as required by applicable law.

If your information is in a workspace that belongs to a contractor you work with (for example, you are their customer or employee), that contractor controls it, and we will direct your request to them where the law allows.

California residents: we do not sell your personal information, and we do not share it for cross-context behavioral advertising. You may ask what personal information we hold about you and ask us to delete or correct it, and we will not treat you differently for making a request.

12. Cookies

We use only what the Service needs to work: a cookie that keeps you signed in, and a small amount of storage in your browser for preferences, such as whether you have seen the welcome tour. We do not use advertising cookies or third-party analytics trackers.

13. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice. Continued use of the Service after changes take effect constitutes acceptance.

15. Contact

Questions about privacy? Contact us at support@dcoperations.com.