Privacy Policy

structIQ is built for professionals in regulated industries. We understand that your project data may contain sensitive business information. Trust is a prerequisite, not a feature.

— Your project data is encrypted at rest and in transit.

— We never use your data to train AI models, and we contractually require the same of every AI provider we use.

— Each user's data is fully isolated. No one else can see your projects.

— You can delete your projects and account at any time. Deletion is permanent and complete.

— We don't sell your content. We use a small set of vetted sub-processors to run the service — listed on our Sub-Processors page — each contractually bound to process your data only on our behalf, never for their own purposes.

Account information. Email address and optional display name.

Project data. Project descriptions, epic content, estimates, and chat messages you create within the app.

Uploaded documents. Files you upload for context extraction (PDF, Word, PowerPoint, images). These are stored in encrypted cloud storage and deleted when you delete the project or complete it.

Usage statistics. Anonymized, non-content data such as number of projects created, features used, and session duration. We never track or log the content of your projects.

Payment information. Payment information is collected only when you subscribe to a paid plan after your free trial.

— We do not use your project data to train AI models, not ours, not anyone else's.

— We do not sell your data, and we do not share it with third parties for their own purposes. To operate the service we rely on the sub-processors listed on our Sub-Processors page, each contractually bound to process your data only on our instructions.

— We do not serve ads or let advertisers access your information.

— We do not use content-based analytics or tracking tools on your project data.

— We do not log epic content, project descriptions, or chat messages on our servers.

All data is encrypted at rest using AES-256 encryption.

All data in transit is protected via TLS/SSL.

All communication with our AI providers (Anthropic and Voyage AI) is protected via TLS/SSL.

Every user's data is fully isolated at the database level using Row Level Security (RLS).

No user can access another user's projects, templates, or any associated data, not even through direct database access.

Authentication tokens are validated on every request.

You can delete individual projects at any time. Deletion removes all associated data: epics, content blocks, estimates, chat history, and uploaded documents.

You can delete your entire account from the Settings page. This permanently removes all your data including projects, templates, feedback, and personal information. Nothing is retained.

Deletion is immediate and irreversible.

structIQ uses two AI providers to process your data, and neither trains on your content:

Anthropic (Claude) powers epic generation, content review, estimation, chat, and the extraction of structured information from your uploaded documents. Under Anthropic's Commercial Terms of Service, Anthropic is contractually prohibited from training models on customer content, and processing is governed by Anthropic's Data Processing Addendum.

Voyage AI (Voyage AI Innovations, Inc., a MongoDB company) generates numerical embeddings of short text excerpts derived from your project data, which structIQ uses to detect duplicate and related items across your documents. structIQ has opted out of Voyage's data-retention and model-training program, so these excerpts are processed with zero-day retention and are never stored or used to train any model.

Both providers process data in the United States; see “International data transfers” below.

To operate the service, structIQ relies on a small set of vetted sub-processors — for database and storage, AI processing, hosting, payments, email, monitoring, and DNS. Each is contractually bound to process your data only on our behalf, never for their own purposes. The complete, current list — including each sub-processor's purpose, the data they process, their processing location, and their data processing agreement — is maintained on our Sub-Processors page. We update that page as our sub-processors change.

For business customers, our processing of personal data on your behalf is governed by our Data Processing Agreement.

structIQ is operated from Switzerland and stores your project data within the European Union. Some of our sub-processors are located in the United States — including our AI providers (Anthropic and Voyage AI) and certain hosting and monitoring providers. Where your data is transferred outside Switzerland or the European Economic Area, we put in place appropriate safeguards, such as the European Commission's Standard Contractual Clauses together with the Swiss addendum. You can request more information about these safeguards at privacy@structiq.co.

structIQ uses only essential cookies required for authentication and session management. We do not use:

— Analytics cookies (no Google Analytics or similar)

— Advertising or marketing cookies

— Third-party tracking pixels

— Content-based behavioral tracking

We do not track what you write in your projects. Usage statistics (number of projects, features used) are collected anonymously without any content data.

Depending on your location, you may have the following rights regarding your personal data:

— Right to access: Request a copy of the personal data we hold about you.

— Right to correction: Request correction of inaccurate personal data.

— Right to deletion: Delete your account and all associated data at any time from the Settings page. Deletion is immediate and permanent.

— Right to data portability: Export your project data via Excel or PDF at any time.

— Right to object: Object to specific data processing activities.

— Right to withdraw consent: Withdraw consent for optional data processing at any time.

To exercise any of these rights, contact us at privacy@structiq.co. We will respond within 30 days.

— Active accounts: Your data is retained as long as your account is active.

— Completed projects: Project content (epics, estimates, chat history) is retained. Uploaded documents are deleted when a project is completed.

— Deleted projects: All associated data is permanently deleted immediately, including epics, content, estimates, chat history, and uploaded documents.

— Deleted accounts: All data is permanently deleted immediately. Nothing is retained.

— Inactive accounts: Accounts with no login activity for 12 months may be flagged for deletion. We will notify you via email 30 days before deletion.

— Derived data, such as the text embeddings used for duplicate detection, is stored together with the associated project data and is permanently deleted together with it.

structIQ is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us at privacy@structiq.co and we will promptly delete it.

We may update this privacy policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. If we make material changes, we will notify you via the email address associated with your account at least 30 days before the changes take effect. We encourage you to review this page periodically. The “Last updated” date at the top indicates when the policy was last revised.

If you have questions about your data or this privacy policy, contact us at privacy@structiq.co.