Privacy Policy

Overview & Applicability

Rekonstruct, Inc. (“Rekonstruct,” “we,” “us,” or “our”) is a Delaware corporation headquartered in San Francisco, California, providing artificial intelligence-driven proposal generation, scope analysis, and tender workflow automation software for large-scale engineering, procurement, and construction (EPC and EPCM) firms.

This Privacy Policy (“Policy”) articulates how we collect, store, process, transfer, and protect personal information and organizational data when you access or interact with our public website (rekonstruct.ai), request product demonstrations, communicate with our team, or utilize our proprietary enterprise software platform and application programming interfaces (collectively, the “Services”).

This Policy applies specifically to users, enterprise representatives, and business contacts residing in North America, including the United States of America and Canada. If your enterprise has entered into a separate Master Services Agreement (“MSA”), Data Processing Addendum (“DPA”), or confidentiality covenant with Rekonstruct, that agreement governs in the event of an irreconcilable conflict with this general Policy.

Information We Collect

In delivering enterprise infrastructure proposal software, Rekonstruct collects information directly from you, automatically through your technological interactions with our platform, and from verified commercial or public registries.

A. Information You Provide Directly

• Business Contact and Demo Inquiries: When you request a platform demonstration, join an access waitlist, or contact our sales team, we collect your full name, corporate work email address, company or firm name, professional role or title, telephone number, and message notes describing your infrastructure project challenges.
• Enterprise Account and Credentials: When your organization provisions access to Rekonstruct, we collect authorized user identifiers, single sign-on (SSO) credentials, corporate email addresses, and encrypted authentication tokens.
• Customer Project and Tender Materials: In utilizing the proposal generation engine, enterprise users upload Requests for Proposals (RFPs), project specifications, past technical submissions, bill-of-quantities templates, and engineering narratives (“Customer Content”). Customer Content may incidentally contain business contact identifiers of bid team members or client engineers. The strict non-training and isolation protections governing Customer Content are detailed in Section 4.

B. Information Collected Automatically

• Device & Connection Telemetry: Internet Protocol (IP) address, operating system, browser type and version, language preferences, referring domain, and internet service provider (ISP).
• Platform Interaction & Operational Metrics: System access timestamps, features utilized, query latencies, interface rendering states, session duration, and crash diagnostic logs necessary for system stability and SLA tracking.
• Cookies and Local Storage: We use strictly necessary session cookies and security tokens to maintain authentication states, protect forms against Cross-Site Request Forgery (CSRF), and respect user interface preferences. We do not deploy third-party advertising cookies or cross-context tracking pixels.

C. Information from Third-Party Commercial Sources

To maintain high data integrity for our B2B commercial outreach, we may corroborate enterprise contact details against publicly available sources, official corporate directories, verified LinkedIn profiles, and public infrastructure procurement notices.

How We Use Information

We process personal information exclusively for documented business and commercial purposes consistent with enterprise software operations:

• Service Delivery & Proposal Synthesis: Provisioning your organization's tenant workspace, executing document parsing routines, generating structured bid deliverables, and orchestrating proposal workflows at your direction.
• Customer Inquiries & Technical Demonstrations: Contacting you to arrange requested platform walkthroughs, answering technical architecture questions, and evaluating enterprise licensing fits.
• Platform Security & Integrity: Detecting unauthorized intrusions, verifying tenant access privileges, preventing fraudulent API calls, and maintaining compliance with SOC 2 / ISO security frameworks.
• Account Administration & Billing: Invoicing, managing enterprise seats, executing software updates, and dispatching critical system status alerts.
• Legal Compliance: Complying with federal, state, and provincial statutory mandates, lawful court orders, and accounting, tax, or corporate governance rules in the United States and Canada.

AI & Enterprise Data Isolation

Our infrastructure intelligence architecture is engineered around the rigorous operational requirements of Tier 1 EPC contractors:

• Logical Tenant Partitioning: All Customer Content submitted to Rekonstruct is cryptographically partitioned within dedicated enterprise tenant boundaries. Bid narratives generated for your firm are inaccessible to other customers.
• Zero Subprocessor Retention on AI Inference: Where external large language model infrastructure is utilized for specialized inference routines, such processing occurs exclusively under zero-data-retention enterprise agreements that contractually prohibit the model host from persisting or using customer payloads for any secondary model training.
• No Automated Legal Decisions: Rekonstruct provides drafting aids and proposal compilation tooling. The platform does not execute binding legal determinations, certify engineering calculations, or submit proposals without explicit human review and authorization by your qualified personnel.

Sharing & Disclosure

Rekonstruct does not sell your personal information, nor do we disclose personal data to third parties for cross-context behavioral advertising. We disclose personal information solely within the bounded contexts below:

• Infrastructure & Hosting Subprocessors: We engage verified cloud hosting providers (e.g., SOC 2 Type II-certified data centers such as AWS or Google Cloud), database operators, security monitoring vendors, and enterprise transactional email providers. All subprocessors are subject to written data protection agreements imposing confidentiality and security standards no less stringent than those stated in this Policy.
• Corporate Transactions: In the event of a merger, acquisition, corporate reorganization, asset divestiture, or bankruptcy, personal information held by Rekonstruct may be transferred to the successor entity subject to this Policy or an equivalent protective standard.
• Legal & Regulatory Mandates: We may disclose information if required to do so by federal, state, or provincial law, valid subpoena, warrant, or court order, or when we determine in good faith that disclosure is necessary to protect the rights, property, or life-safety of our personnel, customers, or the public.
• Authorized Enterprise Directives: When an authorized administrator of your organization directs us to share or integrate data with designated third-party systems (such as corporate single sign-on providers, cloud storage repositories, or ERP platforms).

Security & Safeguards

We implement enterprise-grade administrative, technical, and physical safeguards engineered to defend personal and commercial data against unauthorized access, destruction, loss, alteration, or disclosure:

• Encryption Standards: Data in transit is secured using Transport Layer Security (TLS 1.3/1.2). Data at rest within our production databases and storage volumes is protected using AES-256 cryptographic standards.
• Access Governance: Internal access to production systems is restricted to authorized engineering personnel using mandatory Multi-Factor Authentication (MFA), least-privilege role-based access control (RBAC), and centralized audit logging.
• Continuous Security Verification: Routine automated vulnerability assessments, static code analysis, and third-party security audits are executed against our platform surface.

Data Retention

Rekonstruct retains personal information only for the period necessary to fulfill the business purposes for which it was gathered, satisfy applicable enterprise contractual commitments, or comply with statutory record-keeping requirements under United States and Canadian commercial laws.

When personal information or enterprise project files are no longer required, we securely purge or anonymize the data in accordance with industry-standard data destruction methodologies. Enterprise administrators may request tenant data extraction and permanent deletion upon termination of their commercial agreement.

United States Privacy Rights

This section supplements our Policy for residents of United States jurisdictions with comprehensive state privacy statutes, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), and comparable state laws.

Notice at Collection: Categories of Personal Information

Over the preceding 12 months, Rekonstruct has collected the following statutory categories of personal information for commercial business purposes:

Your US Statutory Privacy Rights

Subject to statutory verifications and permitted legal exceptions, US residents enjoy the following rights:

• Right to Know / Access: You have the right to request disclosure of the specific pieces and categories of personal information we have collected about you, the categories of sources, the commercial purposes for collection, and the categories of third parties to whom data was disclosed.
• Right to Deletion: You have the right to request deletion of your personal information collected and retained by Rekonstruct, subject to standard exceptions (such as completing contracted transactions, security defense, or legal compliance).
• Right to Correction: You have the right to request the rectification of inaccurate personal information maintained in our active records.
• Right to Opt-Out of Sale or Sharing: Rekonstruct does not sell your personal information or share it for cross-context behavioral advertising. We do not participate in automated profiling producing legal effects.
• Right to Limit Sensitive Personal Information: Rekonstruct does not collect or use sensitive personal information for purposes beyond providing requested business services.
• Right to Non-Discrimination: We will never deny services, charge differentiated prices, or alter service quality because you exercised statutory privacy rights.

California "Shine the Light" & Global Privacy Control

Under California Civil Code § 1798.83, California residents may request confirmation that we do not share personal information with third parties for direct marketing purposes. Furthermore, our web properties respect the Global Privacy Control (GPC) browser signal where applicable.

Canadian Privacy Rights (PIPEDA & Provincial Laws)

For Canadian residents and enterprise clients, Rekonstruct governs personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), as well as substantially similar provincial statutes, including Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), British Columbia’s PIPA, and Alberta’s PIPA.

A. Consent & Business Inquiries

We collect and process personal information based on meaningful, informed consent obtained at or prior to collection. Where you submit a demo inquiry or contact form on behalf of your firm, consent is provided for Rekonstruct to communicate with you regarding our enterprise proposal capabilities. You may withdraw consent at any time, subject to legal or contractual constraints.

B. Cross-Border Transfers to the United States

Rekonstruct’s primary server infrastructure and operational facilities are situated in the United States. Personal information originating in Canada is transferred to and hosted within secure cloud facilities in the US. By utilizing our Services, you acknowledge that your personal information will be transferred across international borders and will be subject to the laws and lawful access of US authorities and courts.

C. Canada’s Anti-Spam Legislation (CASL)

Rekonstruct strictly complies with Canada’s Anti-Spam Legislation (CASL). We do not send Commercial Electronic Messages (CEMs) to Canadian recipients without express consent or an existing commercial business relationship. Every commercial communication dispatched by Rekonstruct features an explicit, functional unsubscribe mechanism and identifies Rekonstruct, Inc. as the sender.

Children’s Privacy

Rekonstruct is strictly an enterprise business-to-business (B2B) infrastructure software platform. Our website and Services are not directed to, marketed to, or intended for use by minors. We do not knowingly collect personal information from individuals under the age of 16 (or under 13 under the US Children’s Online Privacy Protection Act, COPPA). If we learn that personal data of a minor has been inadvertently submitted, we will immediately delete that information.

International Transfers & Updates

Rekonstruct reserves the right to amend or update this Privacy Policy periodically to reflect technological evolutions, platform features, or shifts in federal, state, and provincial privacy jurisprudence.

When material revisions occur, we will update the "Effective Date" at the top of this document and provide prominent notice across our platform or via direct email to registered enterprise administrators prior to the changes taking effect. Continued utilization of our Services following the posting of an updated Policy signifies your acceptance of the revised terms.

Contact & Privacy Officer

To exercise your statutory privacy rights, submit a verified consumer request, request access to or correction of personal records, or submit inquiries regarding our AI data governance, please reach out to our designated Privacy Officer:

For Canadian residents wishing to challenge compliance, you may also contact the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca or your respective provincial Privacy Commissioner (e.g., Commission d’accès à l’information du Québec).