1. Information We Collect

When you use Excavation Expert, we collect information that you provide directly to us, including:

• Account Information: Name, email address, password, and company details
• Business Data: Project information, personnel records, equipment data, and financial information
• Location Data: Precise GPS location data collected through our mobile applications (iOS and Android) when you use specific features, as described in Section 1.1 below
• Usage Information: How you interact with our platform, including features used and time spent
• Technical Information: IP address, browser type, device information, and cookies

1.1. Location Data Collection

Our mobile applications collect precise GPS location data to power specific business features. Location data is only collected when the relevant feature is actively in use and with your device's permission. We collect location data in the following contexts:

• Haul Tracking: When a driver is actively logging a haul, GPS coordinates are recorded at regular intervals to track the route, calculate distances, and provide real-time visibility to managers on a live map. Location recording begins when a haul is started and stops when the haul is completed.
• Snow Plow Tracking: When an operator is actively tracking a snow plow shift, GPS coordinates are recorded at regular intervals to document plowed routes, calculate distances traveled, and provide real-time visibility. Location recording begins when a plow shift is started and stops when the shift is ended.
• Time Card / Shift Clock-In: When a crew member clocks in or out of a shift, a single GPS coordinate is captured to verify the location of the clock-in or clock-out event. This is used for attendance verification and is not continuously tracked.

How Location Data Is Used:

• To provide real-time GPS tracking maps for managers and company owners
• To calculate distances traveled for haul logs and snow plow operations
• To verify crew member clock-in/clock-out locations for timecard accuracy
• To generate route history and operational reports

How Location Data Is Stored and Who Can See It: Location data is stored securely in our online systems and is associated with the specific haul log, snow plow shift, or timecard entry. Company Owners, Managers, and Foremen within your organization can view your location data in the following ways:

• During Active Sessions: While you are actively tracking a haul or snow plow shift, authorized users can see your real-time location on a live map within the application.
• Past Sessions: After a haul or plow shift is completed, authorized users can review the recorded route history, GPS coordinates, and distance traveled as part of the completed log entry.
• Clock-In/Clock-Out Records: The GPS location captured at clock-in or clock-out is visible on the corresponding timecard entry to authorized users reviewing timesheets.

Location data is never shared outside of your company account. Only users with appropriate roles within your organization can access this information.

Your Control: Location tracking requires your device's GPS permission. You can revoke location access at any time through your device settings. However, doing so will disable the GPS-dependent features described above.

Background Location: We only access location in the background when you have explicitly started a haul-tracking or snow-plow session. While that session is active, your device continues to record GPS coordinates even if the app is in the background or your screen is locked, so the route stays accurate as you drive. Background tracking stops as soon as you end the session. Outside of an active haul or plow session — including for clock-in/clock-out and routine app use — we do not collect any location data in the background.

2. Geographic Scope

Service Focus: Excavation Expert is built and marketed for contractors and field-services businesses — including excavation, concrete, paving, demolition, dirt work, mining, snow removal, hauling, and related construction trades — operating in North America (United States and Canada). We do not actively serve, market to, or target users in the European Union, the United Kingdom, or other international regions, and our pricing, integrations, and support are oriented around North American operations.

We may restrict or terminate access for users outside our supported regions where doing so is appropriate. If you are a resident of the EU/UK and choose to use the service anyway, you do so at your own initiative and are responsible for ensuring such use complies with the laws applicable to you.

3. How We Use Your Information

We use your information to:

• Provide and maintain our excavation management services
• Process transactions and manage your account
• Send you important updates about your account and our services
• Improve our platform and develop new features
• Power our AI features including bid generation and project analysis
• Ensure platform security and prevent fraud
• Comply with legal obligations

3.1. AI and Machine Learning

Important: We use artificial intelligence and machine learning to improve our services, including bid generation, project analysis, and platform optimization. Here's what you need to know:

• Data Usage for AI Training: We may use aggregated, anonymized data from user interactions to train and improve our AI models. This helps us provide better bid accuracy and platform functionality for all users.
• Individual Data Protection: We do NOT use individual user data to train AI models that would benefit other users. Your specific project details, financial information, and confidential business data remain private to your organization.
• Confidentiality Measures: We implement strict data segregation to ensure that confidential information (marked as such or inherently sensitive) is never used for AI training or shared between user accounts.

4. Information Sharing

We do not sell or rent your personal information or your company data. That includes your business records (projects, customers, financials, equipment, personnel, bids, and any other content you create in the platform) as well as personal information about you and your team. We do not trade any of it for money, services, or anything of value, and we do not provide it to advertisers, data brokers, or list resellers.

We do, however, share certain information with the limited categories below in order to operate the service or comply with the law. These are not sales and we do not receive payment for them:

• Service Providers: Trusted vendors who help us operate our platform (e.g., online infrastructure, payment processing). They are contractually bound to use your data only to deliver the service to us.
• Legal Requirements: When required by law, court order, or to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case the acquirer assumes the privacy commitments described in this policy.
• With Your Consent: When you explicitly authorize us to share specific information for a specific purpose.

5. Data Security and Confidentiality

We implement comprehensive security measures to protect your information and maintain confidentiality:

• Technical Safeguards: Encryption of data in transit and at rest using industry-standard protocols
• Access Controls: Firebase App Check, role-based permissions, and multi-factor authentication
• Infrastructure Security: Secure online systems with physical security controls and regular security audits
• Data Segregation: Strict isolation of customer data to prevent cross-contamination between accounts
• Confidentiality Protection: Special handling procedures for confidential business information, including enhanced encryption and access restrictions
• AI Data Protection: Separate processing pipelines ensure confidential data is never used for AI model training or improvement
• Regular Monitoring: Continuous security monitoring and incident response procedures

5.1. Confidential Information Handling

We understand that your business data may include highly confidential information such as:

• Proprietary bidding strategies and pricing models
• Client information and project details
• Financial data and profit margins
• Trade secrets and competitive intelligence

Our Commitment: We treat all such information with the highest level of confidentiality, implementing additional security measures and ensuring that confidential data is never used to benefit other users or train AI models that could reveal competitive information.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time.

7. Your Rights

You have the right to:

• Access, update, or delete your personal information
• Export your data in a portable format
• Opt out of non-essential communications
• Request information about how we process your data

8. Cookies and Tracking

We use two categories of cookies and similar technologies on our public website and authenticated app:

• Essential cookies — required for the site to function (sign-in session, CSRF protection, theme preference). These are always on and don't require consent.
• Analytics cookies — set only after you accept on the cookie banner or via Privacy Preferences in the footer. Used to count visits, measure feature usage, and improve the product. You can change your choice at any time; the change applies immediately and persists across visits.

What we do NOT do: We do not sell, rent, or trade your personal information to third parties. We do not use cross-site tracking pixels (Meta Pixel, TikTok Pixel, etc.). We do not record audio, video, or what you type into form fields.

If you decline: we stop sending analytics events, stop session replay, and actively delete the analytics cookies (PostHog and Google Analytics) already on your device. Your decline persists across visits.

8.1. Analytics and Product Tools

With your consent, we use the following third-party analytics tools. Each tool sees only the data described below; we do not provide them with your business data, customer records, financials, or any content you create in the app.

• PostHog (product analytics) — captures page views, feature-use events (e.g. "bid generated"), and an anonymous distinct ID stored in a first-party cookie and localStorage. Once you sign in, your email is associated with the distinct ID so we can see how authenticated users move through the product. Session replay is enabled with strong masking: every form input value (text, email, phone, password, etc.) is masked at the browser before any data is sent, and audio/video elements are blocked entirely. The replay shows us how a user moves through the UI to help us debug issues; it never contains the contents of what they typed. Data is retained for up to 12 months and stored in PostHog's US region.
• Google Analytics 4 / Firebase Analytics (audience analytics) — sets _ga and _ga_* cookies to count unique visits and measure traffic sources. IP addresses are truncated before storage. Default retention is 14 months.
• Sentry (error monitoring) — captures unhandled errors, stack traces, and a short replay buffer of the seconds leading up to an error to help us debug. Replays are only captured on error, not during normal use. All text and media are masked before upload, so customer names, project details, addresses, and similar PII never leave your browser. Data is retained for 90 days. We treat error monitoring as a legitimate-interest service for site reliability and use it regardless of your analytics choice; no third party receives this data.

9. Third-Party Services

Our platform integrates with carefully selected third-party services:

• Firebase (Google): Database and authentication services - subject to Google's privacy policy
• Stripe: Payment processing - subject to Stripe's privacy policy
• Resend: Email delivery services - subject to Resend's privacy policy
• AI Services: We may use third-party AI services for certain features. When we do, we ensure that:
• Only necessary, non-confidential data is shared
• All data sharing complies with our confidentiality commitments
• Third-party AI providers are contractually bound to protect your data
• No confidential business information is used to train external AI models

We carefully vet all third-party services to ensure they meet our security and privacy standards.

10. Company Website Hosting (findmy.expert)

Our Service includes an optional feature that allows paid subscribers to create and publish a professional company webpage hosted on the findmy.expert domain (e.g., yourcompany.findmy.expert).

What Information Is Published: When you use this feature, you choose what information to include on your public webpage. This may include:

• Company name, logo, and address
• Contact information (phone number, email)
• Service descriptions and service area
• Photos of your work
• Links to your external website

Public Availability: Information you include on your findmy.expert webpage is publicly accessible on the internet. You control what information appears on your page and can unpublish your page at any time through your account settings.

Data Storage: Website content and images are stored in our secure online storage and served through a global content delivery network for fast, reliable delivery.

Third-Party Content: Excavation Expert is not responsible for the accuracy or completeness of information published by users on their findmy.expert webpages.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers.

12. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

13. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding the personal information we collect about you. These rights are in addition to the rights described in Section 7.

• Right to know — you can ask us what categories of personal information we collect, the sources, the purposes for which we use it, and the categories of third parties we share it with. The categories are described in Sections 1, 8, and 8.1 above.
• Right to delete — you can ask us to delete the personal information we have collected from you, subject to legal exceptions (e.g. data we're required to retain for tax or audit purposes).
• Right to correct — you can ask us to correct inaccurate personal information we hold about you.
• Right to opt out of "selling" or "sharing" for cross-context behavioral advertising — California treats sharing data with analytics and advertising vendors as "sharing" under the CPRA, even when no money changes hands. You can exercise this right at any time by clicking Privacy Preferences in our footer and selecting "Decline analytics." The change applies immediately and persists across visits and devices.
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of service for exercising any of these rights.

How to make a request: contact us at legal@montanaaisolutions.com. We will respond within the timeframes required by California law (generally 45 days, with an optional 45-day extension if needed).

What we don't do: we do not sell, rent, or trade your personal information. We do not use cross-site advertising pixels. We do not record audio, video, or what you type into form fields. The PostHog session replay described in Section 8.1 captures UI interactions (clicks, page transitions) with form values masked at the browser before any data leaves your device.

California Invasion of Privacy Act (CIPA): We do not use wiretap-style or pen-register-style tools to intercept the contents of your communications with us. The analytics tools described in Section 8.1 — including session replay — capture UI metadata (e.g. that a button was clicked, which page was viewed) but mask form input values and run only after your explicit consent. If you decline or later withdraw consent, we stop session replay, stop event capture, and delete the related cookies and localStorage entries from your device.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by email or through our platform.

15. Contact Us

If you have questions about this privacy policy, please contact Montana AI Solutions, LLC at:

• Email: legal@montanaaisolutions.com