How We Handle
Personal Information

1. Who We Are

This policy explains how SURI Intelligence LLC ("SURI", "we", "us") handles personal information when you visit asksuri.ai or use Ask SURI, our AI assistant for construction schedules.

It covers visitors to asksuri.ai, people who create an Ask SURI account or are invited to one, billing contacts, and people who email us.

For privacy questions and requests, email admin@asksuri.ai. Legal notices under the SURI Subscription Agreement go to the same address, as that agreement says.

2. Two Kinds Of Information

Ask SURI holds two kinds of information, and our role is different for each.

Customer content. This is what an organization and its users put into Ask SURI or create there: schedules, documents, questions, settings and the reports the service produces from them. Schedules, documents, questions and settings belong to that organization (Subscription Agreement §8.1), and the organization may use the reports and other results as §10.2 of that agreement allows. We handle all of it on the organization's behalf and follow its instructions. Under privacy laws, the organization is the "controller" or "business", and SURI is its "processor" or "service provider". If a schedule or document someone else uploaded names you, for example as a resource or a project contact, please contact that organization. If you contact us instead, we will pass your request to it.

Account and service information. This is what we need to run accounts, bill customers, keep the service secure, send emails, and understand visits to our website. SURI decides how this information is used and is responsible for it under this policy.

If your organization has signed a Data Processing Addendum (DPA) with us, the DPA governs how we handle your organization's customer content and its users' account information, as between your organization and us. Where this policy is more protective of you, it applies as well.

3. What We Collect

Information You Give Us

• Account details: your name, work email address and company name. When you sign up for a trial, your company is taken from your email domain.
• Password: stored only as a one-way (bcrypt) hash; we never store the password itself. If your organization asks us to set a password to recover an account, we choose that password and you are emailed that your password has changed. Please change it when you next sign in.
• Two-step verification: if you turn it on, the secret your authenticator app uses, stored encrypted, and your recovery codes, stored as one-way hashes.
• Your role and projects: your company role in Ask SURI (Admin, Analyst or Explorer) and the projects you belong to.
• Acceptances and signatures: when you accepted our Acceptable Use and Trial Terms. If you e-sign the Subscription Agreement, we record the version you signed and your name, title, IP address and browser type with the signature.
• Invitations: the email address of anyone you invite, with the project and role.
• Email preferences, and any messages you send us.

Customer Content

• Schedule files (for example P6 .xer files) and the data in them. A schedule can hold the names, email addresses, phone numbers, employee codes and pay or cost rates of people recorded as resources, and names in activity notes.
• Documents uploaded to the service, such as contracts, specifications, estimates and delay evidence; progress spreadsheets; and site map files.
• The questions you ask Ask SURI, a preview of each answer, and facts about the project that the service learns from your questions.
• Any feedback you give on an answer, helpful or not, with your note, the reasons you pick and a description of what was on your screen.
• Settings your users enter, such as their own checks, milestone classifications and contract facts.
• Reports and other results the service produces.

The service has no field designed for sensitive information such as health data or government ID numbers. Please do not upload it.

Information Collected Automatically

• Sign-in and security records: sign-ins and failed sign-ins (including Sign In With Microsoft), password and two-step changes, invitations sent and accepted, role and membership changes, file uploads, data downloads, and data read through API keys. Each record holds the time, the account and the IP address.
• Usage records: the pages and features you use, with your IP address and browser type, and the text of the questions you ask.
• Misuse-check results: the nightly check in section 4 stores a score for the recent chat activity of each account it checks and, for an account it flags, a written case and any action we take.
• Website visits: when you open our home page or the Ask SURI app, whether or not you are signed in, we record the page, the page you came from, any campaign tags in the link you followed (such as "utm_source"), your IP address, your browser type and a random visitor code kept in your browser (section 6). These visit records are not stored with your account, although they hold the same IP address and browser type as your other records.
• Approximate location: the country, region and city your IP address points to, looked up in a file on our own servers and kept in a lookup table there. Your IP address is not sent to anyone for this lookup.

Information From Others

• Your organization: your company's Admins and colleagues can invite you, add you to projects, change your role, or upload files that name you.
• Your organization's sign-in service: if your company sets up Sign In With Microsoft and you use it, your company's directory confirms your email address and name to us, and we store the identifiers it uses for you and your organization to link your account. We never receive your directory password, and we do not keep its sign-in tokens.
• Our payment processor: whether a payment succeeded or failed, and the status of a subscription.
• Joining by email domain: if you sign up with an address at an email domain that already belongs to a company on Ask SURI, you join that company's account automatically, unless its Admins have switched this off. That company's Admins can then see your name, email address and role.

What We Do Not Collect

• Card and bank numbers. Our payment processor collects card and bank details directly on its own page. We never see or store full card or bank account numbers.
• Audio. We never record or store audio. Where your browser offers voice input, your browser's own speech service turns your speech into text, which can involve servers run by your browser's maker, and Ask SURI receives only the text.

4. How We Use Information

• To provide Ask SURI: run your account, analyze schedules, answer questions, produce reports, apply changes you ask for, and let Admins download project data (section 10).
• For AI features: to answer a question, read a document, classify activities, match risks to activities, or write a narrative, summary, report, review finding or delay analysis, we send the question, schedule data or document text it needs to our AI model provider (section 5). After each chat exchange we send the question and answer again, to write a short recap for later questions in that conversation and to pull out facts about that project, which are used only for that project. We will update this policy, and give customers with a signed DPA advance notice, before we add another AI provider.
• To keep the service and your account secure: sign-in limits, security records, and a nightly automated check of chat activity for signs of automated (bot) or abusive use. The check gives each account with recent chat activity a score, which we store. For an account it flags, we send the account's name, email address, company, account age, number of questions, AI cost over the period checked and short samples of its recent questions to our AI model provider, which writes a case for our review; we store that case and email it to ourselves. A flagged account's answers may be slowed automatically by a few seconds. A new account, less than 24 hours old, is also slowed automatically if another account in its company has been blocked. Your company's Admins can ask us to exempt named users from the automatic slow-down. After review we may block chat for an account.
• To support you: we can open a read-only view of an account for up to four hours, to help you, fix a problem or comply with law. Each request made in that view is logged against the named person who opened it.
• To manage accounts and access: we can also create accounts, set a password, send a password reset, reset two-step verification, change a role, mark an email address as verified, turn an account on or off, give an account access to a project, move a project or people between companies, change a company's Sign In With Microsoft settings, and view each user's usage. We use these powers to act on an organization's verified requests, to fix problems and to comply with law. Each use is logged against the named person at SURI. We email the account owner when we set a password, send a password reset or reset two-step verification. We email your company's Admins when we create an account in your company, move an account into your company, give an account from another company access to your project, move a project into or out of your company, merge another company into yours, merge your company into another, or change your company's Sign In With Microsoft settings.
• To read questions and answers: we read records of the questions asked in Ask SURI and the answers given only to support you, fix problems, keep the service secure, and improve answers using the feedback users choose to send us.
• To bill: set up and manage subscriptions through our payment processor.
• To email you: service emails (email verification, invitations, password and two-step notices, billing and subscription notices, notices before data is deleted, and deletion certificates) come with having an account. Trial emails (tips and reminders during the first 45 days after you sign up; a free trial lasts 30 days) are timed on whether and when you have asked questions, not on what you asked, and every one has an unsubscribe link. Project digests go only to people who leave that option ticked at sign-up or turn it on in Notifications.
• To run and plan the service: we count activity across the service, such as visits, features used and response times. These counts do not include the content of your schedules, documents or questions, and we do not try to re-identify anyone from them.
• To improve the service: under our Subscription Agreement (§8.2), we may use aggregated, de-identified information to improve the service for all customers. This may include the kinds of questions users ask, but not project data. This is switched off today. If we switch it on, we use only questions asked on projects under a signed Subscription Agreement, never trial or sample projects. Without any AI model, each question is reduced to a type of question and a pattern that keeps only everyday English and scheduling words: names from the project, and every other word, number, date, email address and web address, are replaced. We store only the type, the pattern, the month it was asked, the month we processed it and the part of Ask SURI it was asked in: no company, project, person, day or time. We keep that information de-identified, do not attempt to re-identify it, and require anyone we share it with to do the same. A customer can ask us to exclude its data, and we then leave its questions out. Patterns stored before that request cannot be traced back to the customer, so they stay.
• To meet legal duties: comply with law, enforce our terms, and protect the rights and safety of our users and of SURI.

What We Do Not Do

• We do not sell personal information, and we do not "share" it for cross-context behavioral advertising.
• We do not show advertising, and we use no third-party advertising or analytics trackers.
• We do not use customer content or personal information to train or fine-tune AI models. We have no model-training pipeline, and our AI model provider's terms for our account bar it from training on our data.
• We do not use one customer's content to produce results for another customer. Stored AI results and facts learned from questions stay within the customer's account.

5. Who Receives Information

Service Providers

We use a small number of providers to run Ask SURI. Each receives only what its service needs.

The named list of our providers is confidential. We give it to customers on written request, under a non-disclosure agreement or a signed DPA (Subscription Agreement §8.3). Customers with a signed DPA get advance notice of a new provider and can object.

Services Your Browser Contacts Directly

When you open our website, including this page, your browser loads fonts from a public font service. When you open Ask SURI, it also loads open-source code libraries from public content networks, each pinned to a fixed version and checked for integrity, and the map view loads map images from public map services. These services receive your IP address, your browser type and our site's address; the map services also receive the map area you view, which can show a project site's location. Our servers send them nothing. They handle what they receive under their own privacy terms, may collect this information when you visit other websites that use them, and may answer from outside the United States.

Your Organization And Projects

• Your company's Admins see the full team list: each person's name, email address, company role, sign-in status, whether two-step verification is on, and their projects.
• Other members see only the people they share a project with: name, email address and role on that project.
• People working on a project can see its content.
• A user from another company sees your organization's project only if someone with the right role on that project invites them, or if we give that user access, move the project, or merge your company into another (section 4, "To manage accounts and access"). We email your company's Admins when we do any of these. Under a signed DPA, we move a project between companies, or merge companies, only with both companies' written consent.

Legal And Other Disclosures

• Legal demands. We disclose information to law enforcement or other authorities only when the law requires it. Where a demand concerns customer content, we first direct it to the customer where reasonable, and tell the customer unless the law forbids it.
• Protection. To protect the rights, safety or security of our users, the public or SURI, for example to investigate misuse of the service.
• Advisers. To our professional advisers, such as accountants, who must keep it confidential.
• Business transfers. If SURI is involved in a merger, acquisition or sale of assets, information may pass to the successor, which must continue to protect it as this policy describes.

"Protection" and "Advisers" apply to account and service information. We disclose customer content only as the Subscription Agreement and any DPA allow.

6. Cookies And Browser Storage

Ask SURI keeps a few items in your browser's own storage, and sets cookies only to complete a sign-in or email-verification step, or for SURI's own administrator accounts. It sets no advertising cookies.

You can clear these items in your browser's settings. Clearing the sign-in token signs you out. Signing out removes the sign-in token, your profile details and your last project, but not your preferences or saved results, so on a shared computer, clear your browser's storage as well.

The services in section 5 that your browser contacts directly see your IP address. Ask SURI does not respond differently to "Do Not Track" or Global Privacy Control signals, because we do not sell or share personal information or track you across other websites.

7. Where Information Is Stored

Ask SURI is hosted in the United States (California), and our encrypted backups are stored with a separate provider in western North America. Our AI model provider stores the information it receives in the United States, but may process requests in other countries where it operates. Our other providers may process the limited information they receive in the United States and in other countries where they operate. Traffic between your browser and Ask SURI is encrypted and may pass through the point of our hosting provider's network nearest you, which can be outside the United States. We administer the service from the United States, and occasionally from India while travelling. The services in section 5 that your browser contacts directly may answer from outside the United States.

If you use Ask SURI from another country, your information is transferred to the United States, and may be processed in the other places named above.

8. How Long We Keep Information

9. Security

We protect information with measures that include: HTTPS for all traffic, with browsers told to use HTTPS only; passwords stored as one-way hashes; two-step verification available to every user, which a company Admin can require for everyone on the company's projects; a check on every request against your company and project membership; nightly backups encrypted by us before they leave our hosting environment; and administrative functions limited to SURI's named administrator accounts that use two-step verification, with each request logged.

Customers' data is separated logically, within one shared hosting environment and platform database, not in physically separate databases.

No system is completely secure. If a security incident affects your personal information, we will notify you, and your organization, as the law and our agreements require.

Our Trust Center describes our security practices in more detail, including what is not in place yet.

10. Your Choices And Rights

What Anyone Can Do

• Update your details. Change your name, password and two-step settings on your Account page. To change your email address, email us.
• Stop trial emails. Use the unsubscribe link in any trial email. The Notifications screen controls project digests only. Service emails continue while you have an account.
• Ask for a copy, a correction or deletion. Email admin@asksuri.ai from the address on your account and say what you want. We confirm that we have received it within 10 business days, and we confirm it is you by replying to that address before we act. If your account was provided by your organization, we tell your organization about your request and follow its instructions; we may keep records your organization needs, and we may decline to delete the last Admin of a company that still has projects until another Admin is named. We answer within 45 days, and tell you if we need up to 45 more.
• Website visit records. These hold a random visitor code, not your name. To ask about them, send us the visitor code your browser holds (section 6). We may not be able to verify a request about them, because the code and an IP address do not show who you are.
• Customer content. Your company's Admins, and project Admins whose company role is Admin or Analyst, can download a project's data themselves at any time until it is deleted. If downloading is paused, they can email us and we will send the data. Requests about customer content go to the organization that owns it: if you send one to us, we pass it to that organization within five business days and act on its instructions, unless the law requires otherwise.
• Deletion certificate. When we delete an account or project at a verified request, we email a deletion certificate.

US State Privacy Rights, Including California

Depending on where you live, the law may give you the right to:

• know what personal information we collect, use and disclose, and get a copy of it, including in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of its sale, of its sharing for cross-context behavioral advertising, of targeted advertising, and of profiling with legal or similarly significant effects. We do none of these;
• limit the use of sensitive personal information. The only sensitive personal information we collect is your account sign-in (your email address with your password or two-step code), and we use it only to sign you in and secure your account;
• not be treated differently for exercising these rights. We will not deny you the service, charge you a different price or give you a different level of service because you exercised them;
• use an authorized agent. An agent must give us your signed permission, and we may ask you to confirm your identity with us directly;
• appeal if we decline your request. Reply to our answer with "Appeal" in the subject line, and we will respond within 45 days.

California details. In the past 12 months we collected the categories below. We did not sell or share any of them, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Sources and uses are in sections 3 and 4.

We do not disclose personal information to third parties for their own direct marketing.

11. Children

Ask SURI is a service for businesses and is not directed to children. It is not intended for anyone under 18, and we do not knowingly collect personal information from children under 16. If we learn that we have, we will delete it.

12. Visitors From Outside The United States

Ask SURI is run from the United States. We have not yet put in place the terms that the laws of the European Economic Area, the United Kingdom and Switzerland require for sending personal information from those places to the United States, and this policy does not describe the rights those laws give. If you are in one of those places, please contact us before using Ask SURI. An organization that signs our DPA agrees not to supply personal information covered by those laws until it has agreed transfer terms with us in writing.

13. Changes To This Policy

We will post any change here with a new Last Updated date. If we make a material change, we will tell account holders by email or in the app before it takes effect. Earlier versions are available on request.