Privacy Policy

This Privacy Policy explains what information NEOVEKK LLC ("Neovekk", "we", "us") collects through the Neovekk website at neovekk.com and the Neovekk app, how we use it, who we share it with, how long we keep it, and the choices you have. It describes how the service works on the date above.

Who we are

NEOVEKK LLC is a limited liability company registered in Michigan, United States.

Mailing address: 13166 Imlay City Rd, Emmett, MI 48022, United States
Email: support@neovekk.com

Customer records and our own records

Neovekk is a service for businesses. Companies that use it ("customers") keep records about their buildings in Neovekk and invite their staff, contractors and others to work with those records.

Customer records. What customers and the people they invite put into Neovekk (locations, equipment, photos, documents, floor plans, notes and the history around them) belongs to that customer. We process it on the customer's behalf under our agreement with them. The customer decides who can see its records and how long they are kept, so questions about them usually go to the customer first. We will help the customer answer you.
Our own records. We are responsible for what we collect for ourselves: website inquiries, the account details needed for sign-in, security records, page-speed measurements and our correspondence with you.

What we collect

Account details

Accounts are created only by invitation. When you accept an invite we keep your name, email address, the companies and locations you can access and your role there, and the version of our Terms of Service and Privacy Policy you agreed to and when. You may also have a phone number, job title and trade on your profile.

Your password goes to our sign-in provider, which stores only a one-way hash of it. If you turn on two-step sign-in, the provider also stores the secret your authenticator app uses.

If you download records for offline use, we register your browser with its platform name (such as "Android" or "Windows"), a one-way hash of a random identifier the app keeps in your browser, and when it last synced.

Building records

Customers and the people they invite add records such as: companies, locations, buildings, floors and rooms; equipment and its details (for example make, model, serial number, warranty and inspection dates); electrical panels and breakers; notes, including their earlier wordings; inspections; Projects, coordination messages, handoffs and requests; proposed changes and their reviews; and pins on floor plans. Each record keeps who created or changed it and when.

Photos and their capture details

Photos and 360° Photo Spheres can carry details added by the camera, such as when the photo was taken, the phone or camera model, and the GPS location where it was taken. What we do with them depends on the photo setting a location's administrators choose:

Keep photo details (the default). We store the photo as it was received, or a smaller copy with exactly the same pixels, and copy its time, device and location into a private record that people with access to the photo can see.
Strip GPS only. We remove the location from the stored photo and do not record it. Time and device details are kept.
Strip all. We remove all descriptive details from the stored photo and record none of them.

While a removal setting is on, a photo whose details can't be removed without changing the image (some HEIC/HEIF photos, for example) is refused rather than stored with them. A setting applies to photos uploaded after it is chosen.

For every photo we also record who uploaded it, when our server received it, and a fingerprint of the file (a SHA-256 hash) so later copies can be checked against it. Photo Spheres also send the phone's orientation for each frame so the frames can be stitched together. Markups drawn on a photo or floor plan are saved separately and never overwrite the original.

The app does not ask for your device's location. The only location information we receive is what is inside the photos you upload.

Documents and floor plans

We store the files you upload, such as manuals, warranties, reports and drawings. For PDF floor plans we extract the text on each page so people can search a sheet. A location's welcome image is resized and stored as a presentation image.

QR labels and scans

When someone scans a Neovekk label we record which label was scanned, when, what the person was shown (for example the public page, or the full record because they were signed in with access), and their account if they were signed in. Some lookups also record the browser's user-agent string (its name and version). We do not store the IP address of a scan. The scanner in the app reads codes on your device; camera images are not uploaded.

Access requests

If you ask for access from a label's public page, we collect your name, email address, company, trade (optional) and your reason, and send them to that location's managers. Once a request has been decided and is more than 90 days old, we remove those contact details and the reason; only the decision and dates remain. A request that is still waiting for a decision keeps them until it is decided.

Audit and history records

To keep an accurate record and protect customers, we log important actions: changes to records, access and settings; reviews and approvals; file removals and restores; exports; and label scans and access decisions. Entries say who did what and when, and may include a record's values before and after a change.

Website inquiries

When you send the form on our website we keep the topic, your name, email address, company and message, the page you sent it from and, for builder early access, your answers about homes built, region, role and timing. We do not store your IP address or device details with an inquiry.

Page-speed measurements

Pages in the signed-in app report how quickly they loaded: the kind of page, the measurement, a rough screen size (small, medium or large), the connection type and whether the page came from the app's offline cache. These samples carry no name, account, record or web address, and we delete them after 30 days.

Our sign-in provider keeps session and security logs, including the IP address and browser used to sign in. To slow down password guessing and spam, we count attempts to sign in, reset a password, accept an invite, request access and look up labels using one-way hashes of the IP address or email address. We never store the address itself, and the counts are cleared after about a day. Our hosting provider also keeps short-lived technical logs of requests.

Messages to us

If you email us, we keep your message and our reply.

Cookies and storage on your device

We use only the cookies the service needs to work:

sign-in cookies that keep you signed in; they expire 30 days after your last visit;
a cookie that remembers which location you chose in the app;
a 10-minute cookie, used only by the sign-in page, that keeps your email address filled in after a failed attempt.

We do not use advertising or cross-site tracking cookies.

The app also keeps some things in your browser's own storage: your theme, sound and motion preferences, unsent form drafts, offline copies of records you download for field work, and photos or Photo Spheres waiting to upload. Signing out clears saved offline copies; work that has not uploaded yet stays on the device so it is not lost.

When we add website analytics, we will use Vercel Web Analytics, which counts visits to our public website without cookies and without identifying individual visitors. The link at the bottom of a label's public page carries campaign tags so we can count visits that came from a label scan; the tags say nothing about the person, the label or the record.

How we use information

To provide the service: sign you in, show records to the people allowed to see them, process uploads (photos, documents, floor plans and Photo Spheres) and keep each record's history.
To keep the service and customers' records secure: limit repeated attempts, log important actions, investigate misuse and incidents.
To support and communicate with you: answer inquiries and support requests, and send service messages such as password-reset emails.
To keep the service fast and reliable, using page-speed measurements and technical logs.
To meet legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for targeted advertising.

Service providers. These companies process information for us so we can run Neovekk:

Supabase: our database, file storage and sign-in.
Vercel: hosting for the website and app, our server functions, the isolated Vercel Sandbox workers that process floor plans and Photo Spheres, and the queues that schedule that work.
Postmark: sends our transactional email, such as invitations, sign-in and password-reset emails, access-request updates, website inquiry alerts and the optional daily summary. It receives each recipient's email address and the message. We turn off open and click tracking.

People in a customer's workspace. People a customer invites see that customer's records as their role allows. A label's public page shows only what the location's settings allow.

Legal and safety. We may disclose information when the law requires it, or when needed to protect the rights, property or safety of our customers, users, the public or Neovekk.

Business transfers. If Neovekk is involved in a merger, acquisition or sale of assets, information may transfer as part of it, and this policy will continue to apply to it.

With your permission or at your direction.

Where information is processed

We are based in the United States. Our service providers may store and process information in the United States and in other countries where they operate.

How long we keep information

Account details: while you have an account. See "Your choices and rights" below for deleting it.
Building records: for as long as the customer keeps them under its agreement with us. Our Terms of Service explain export and deletion when a customer leaves.
Removed photos, documents and floor plans: they can be restored during the location's recovery window, which is 180 days unless its administrators choose between 7 and 365 days. After that a daily job deletes the stored files. Files marked as evidence are kept rather than deleted this way. Photos and documents that are proof in a Project that has been submitted, accepted, completed or archived can't be removed; a location administrator can redact one instead, which hides it for good while keeping the record that it existed.
Earlier wordings of notes: kept with the note.
Unfinished uploads: expire after 24 hours, and most are cleaned up automatically.
Access-request contact details and reasons: removed once a request has been decided and is more than 90 days old.
Page-speed measurements: 30 days.
Attempt counts used to limit repeated requests: about a day.
Audit, history and scan records: for as long as the customer's records exist, so the history stays complete.
Website inquiries and emails: as long as we need them to respond and follow up, or until you ask us to delete them.

Information deleted from the service may remain for a limited time in our providers' backups and logs.

Your choices and rights

Download your data. Signed-in users can download a copy of what Neovekk holds about them at /account/data. It includes your profile, the companies and locations you can access, the access requests you sent and the records you created (titles, dates and where). Files you uploaded stay in the customer's workspace and are listed, not copied.
Delete your account. You can delete your account at /account/data. You are signed out everywhere, your name, email address, phone and job details are removed from your profile, your access to every company and location ends, and contact details on access requests you sent are removed. Records you created for a customer (photos, notes, changes) stay with that customer and show "Former user" where the app names their author. Names already written into a record's history, such as an audit entry or a photo's "uploaded by" line, may remain as part of the customer's records. If you are the only owner of a company, make someone else an owner first.
Correct your details. Ask your company's administrator, or email us.
Records that belong to a customer. Contact that customer. If you contact us instead, we will pass your request on and help them answer it.
Website inquiries. Email us to see or delete what you sent.

Depending on where you live, you may have rights to know about, access, correct, delete or receive a copy of your personal information, and to object to some uses. Email support@neovekk.com to make a request. We may need to confirm your identity first, and we will not treat you differently for making a request.

Security

We protect information with private storage, short-lived signed file links, database access rules, server-checked permissions and audit logs. Our Security page describes what is in place, what is not yet, and how to report a vulnerability. No system is perfectly secure, and we cannot guarantee that information will never be accessed without permission.

Children

Neovekk is a service for businesses and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email us and we will delete it.

Changes to this policy

When we change this policy we will post the new version here with a new effective date. If a change materially affects how we use information we already hold, we will tell customers' administrators or affected users before it takes effect, and we may ask you to agree to it again.

Contact us

Questions or requests about this policy or your information:

NEOVEKK LLC, 13166 Imlay City Rd, Emmett, MI 48022, United States
support@neovekk.com