Privacy Policy

GCReq365 is software for commercial general contractors to collect, extract, track, review and follow up on subcontractor compliance documents. It is operated by Jisan Nuren Siam, an individual sole proprietor based in Bangladesh (“we”, “us” or “our”).

This Privacy Policy explains how we handle information through the GCReq365 website, web application, submission links, email intake and related services (the “Service”). It should be read with our Terms of Service.

Our customers are businesses (“Customers”). When a Customer uses the Service to manage its projects and subcontractors, the Customer decides which documents and information to collect and why, and we process that information to provide the Service to the Customer. If you are a subcontractor or another individual whose information appears in a Customer's workspace, please also contact that Customer about how it uses your information.

Account and profile information

Your name, email address and account identifiers. Sign-in is handled by a third-party authentication provider; GCReq365 does not store your password. We also keep preferences you set, such as your display time zone and theme.

Organization and workspace information

Your company's name, address and primary contact details; team members, their roles and invitations (including invitees' email addresses); and workspace settings, such as reminder settings and your intake email address.

Project and subcontractor information

Project details (such as names, numbers, addresses and dates) and the document requirements you configure; and subcontractor details, such as legal name, trade, contact name, email address, phone number, address and notes your team adds.

Compliance documents and extracted information

Documents uploaded by your team or submitted by subcontractors, including certificates of insurance, workers' compensation certificates, contractor licenses, W-9 forms and signed agreements, and file details such as name, type and size. These documents can contain personal and sensitive information, for example names, addresses, policy and license numbers and, on W-9 forms, taxpayer identification numbers. From these documents we store extracted fields (such as company names, insurers, policy numbers, dates and coverage amounts), confidence scores, review decisions, corrections and notes, document versions and the resulting requirement statuses. Our AI extraction is instructed not to extract taxpayer identification numbers, but the stored document itself contains whatever information it was submitted with.

Submission-link information and communications

Information about secure submission links (such as which project and subcontractor they relate to, and their status) and the documents submitted through them. For documents emailed to a workspace intake address, we receive the message and its attachments and keep details such as the sender and recipient addresses and subject. For reminder and notification emails we send, we keep details such as the recipient address, the message type and its delivery status. If you email us directly, we receive your message and contact details.

Billing and subscription information

Your plan, subscription status, trial and billing-period dates and identifiers from our payment provider for your customer record, subscription and transactions. To apply trial-eligibility rules, we store a hashed form of the account email address and its email domain. Payments are processed by a third-party payment provider: card and other payment details are entered into the provider's checkout, and GCReq365 does not receive or store your full card details. If you request an Enterprise quote, we keep the company name, work email, usage figures and any notes you provide.

Technical, security, usage and activity information

When you use the Service, we and our providers process technical information such as IP address, browser and device information, request and error logs, and timestamps. We keep security records such as rate-limit counters (stored in hashed form). The Service also keeps an activity history (audit log) of actions in each workspace — for example uploads, reviews, approvals, status changes, settings changes and reminders — recording who or what performed the action and when.

Cookies

We use cookies and similar technologies that are needed to run the Service: sign-in session cookies set by our authentication provider, a cookie that remembers your theme preference, and a short-lived cookie used to accept a team invitation. Our payment provider's checkout and billing portal may set their own cookies when you use them. We do not currently use third-party advertising or analytics cookies.

We use the information described above to:

• provide the Service, including accounts, workspaces, projects, subcontractors, document storage, submission links and email intake;
• extract information from documents with AI, apply your configured project rules, and route uncertain results to human review;
• send reminders, invitations, notifications and service messages that you or your workspace configure or request;
• manage trials, subscriptions and billing with our payment provider, including applying trial-eligibility rules and preventing trial abuse;
• secure the Service, prevent fraud and abuse, enforce rate limits, keep activity records, and investigate incidents;
• respond to support requests, quote requests and other communications;
• maintain, troubleshoot and improve the Service; and
• comply with legal obligations, enforce our Terms, and establish, exercise or defend legal claims.

We do not sell personal information, and we do not use Customer documents to train AI models of our own. We do not use Customer documents for advertising.

To extract information, the Service sends document files to a third-party AI model provider, which returns structured results to us. Our current provider is Anthropic (the Claude API). The provider processes documents on our behalf to return these results.

AI output is used only to propose extracted values with confidence scores. Requirement statuses are calculated by deterministic software rules configured by the Customer, and low-confidence or conflicting results go to a person for review.

We share information only as described below:

• Within the Customer's workspace. Information in a workspace, including documents submitted by subcontractors, is available to that workspace's team members according to their roles.
• Service providers. We use providers that process information on our behalf to run the Service, including providers for application hosting and databases, file storage, sign-in and authentication, sending and receiving email, and AI document processing. They may use the information only to provide their services to us.
• Payment provider. Our third-party payment provider processes payments and subscriptions (and, where it acts as reseller or Merchant of Record, sells the subscription to you) and handles your payment information under its own privacy notice.
• Email recipients. Reminders and invitations are delivered to the recipients a workspace chooses, such as subcontractor contacts and invited teammates.
• Legal and safety. We may disclose information if we believe in good faith it is required by law or legal process, or necessary to protect the rights, property or safety of our Customers, users, us or others.
• Business transfers. If the Service or its business is transferred, for example in a sale or reorganization, information may be transferred as part of that transaction, subject to this policy.
• With direction or consent. We may share information when a Customer or user directs us to or consents.

We are based in Bangladesh, and our service providers operate in the United States and other countries. Information you provide may therefore be stored and processed in countries other than your own, including countries whose data-protection laws differ from those where you live. Where applicable law requires safeguards for such transfers, we will take reasonable steps to comply with those requirements.

We use reasonable administrative and technical measures designed to protect information, such as authenticated access, role-based permissions within each workspace, separation of each Customer's data, stored documents that are served only to signed-in members of the owning workspace, and activity records.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, managing who has access to your workspace, and sharing submission links only with intended recipients. If you believe your account or workspace has been compromised, contact us at support@gcreq365.com.

We keep information for as long as it is needed for the purposes described in this policy. We do not currently apply a fixed, automatic deletion period to workspace data.

Ending or canceling a subscription does not automatically delete a workspace. Records, including documents, extracted information, review history and activity history, may remain after a subscription ends. How long information is kept depends on operational needs (such as letting a returning Customer resume work), security and fraud prevention, the resolution of disputes, the enforcement of our agreements, and legal, tax and accounting obligations. Activity history is designed to be kept as a permanent record and is not edited after it is written. Backups and provider logs may also persist for a period after information is deleted from the Service.

A Customer can ask us to delete its workspace or particular information as described below. Billing and transaction records held by our payment provider are retained by that provider under its own policies.

You can view and update much of your account, organization, project and subcontractor information in the Service. To ask about, access, correct, export or delete personal information, or to request deletion of a workspace, email support@gcreq365.com. Depending on where you live, applicable law may give you rights regarding your personal information, such as rights to access, correct, delete or object to certain processing; we will handle requests in line with the law that applies.

• We may need to verify your identity, or your authority to act for an organization, before acting on a request.
• If your information is held in a Customer's workspace (for example as a subcontractor contact or in a submitted document), we may refer your request to that Customer or act on its instructions.
• We may keep some information where we are required or permitted to by law, or where it is needed for security, fraud prevention, dispute resolution or the enforcement of our agreements, as described in the retention section.

We will respond within a reasonable time and within any period required by applicable law.

The Service is a business tool intended for use by adults acting for businesses. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to the Service, contact us at support@gcreq365.com and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the “last updated” date above. If a change is material, we will give reasonable notice, for example by email to the workspace owner or by a notice in the Service.

Privacy questions and requests: support@gcreq365.com. GCReq365 is operated by Jisan Nuren Siam, Bangladesh. See also our Terms of Service and Refund Policy.