Privacy Policy

1. Introduction

Icon & Ikon, Inc., doing business as Olumba ("Olumba," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform for AEC project management and permit tracking, our free tools, and related services (collectively, the "Service").

By accessing or using our Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when registering for an account, including:

• Name and email address
• Organization name and business information
• Billing information (card details are collected and stored by Stripe, not by us)
• Profile information and preferences
• Public firm profile content, if you choose to publish one
• Communications you send to us

We also hold information about other people that you or your team add to the Service, such as collaborators, clients, and consultants you invite, and the names of city staff and plan reviewers that appear on letters you upload.

2.2 Documents and Files

When you use our Service, you may upload, store, and manage documents and files, including:

• Construction plans, drawings, and specifications
• Project documentation and reports
• Correspondence and comments
• Any other files you choose to upload

We treat all uploaded documents as confidential and do not access, use, or share them except as necessary to provide the Service or as required by law.

2.3 Automatically Collected Information

When you access our Service, we automatically collect certain information, including:

• Device information (browser type, operating system, device identifiers)
• Log data (IP address, access times, pages viewed)
• Usage information (features used, actions taken)
• Cookies and similar tracking technologies
• When someone opens a share link, the time, IP address, and browser type, so the sender can see that it was viewed

2.4 Connected Accounts

If you choose to connect a Google or Microsoft account, we access only what the feature you turn on needs: for example, a file you pick in Google Drive, or the email threads and attachments the Service tracks for you. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from connected accounts for advertising, do not sell it, and do not use it to train AI models. You can disconnect an account at any time.

2.5 Information From Other Sources

We may collect business contact information about architecture, engineering, and construction firms and their principals from public sources and business data providers, and use it to contact those firms about Olumba. You can opt out at any time by replying to one of those emails or by contacting us, and we will stop emailing you.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service: To operate our document management platform, process your requests, and deliver the features you use.
• Account management: To create and manage your account, authenticate users, and provide customer support.
• Communication: To send you service-related notices, updates, security alerts, and support messages.
• Billing: To process payments and manage your subscription.
• Improvement: To analyze usage patterns, diagnose technical issues, and improve our Service.
• Security: To detect, prevent, and address fraud, abuse, and security issues.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

4. AI Tools and the Olumba Learning Corpus

Olumba operates AI-powered tools (for example, the correction-letter parser, plan-check pre-review, text recognition for scanned documents, and drafted responses) that improve over time based on aggregate usage. To keep these tools accurate for all users, we maintain a learning corpus of de-identified jurisdiction and review patterns derived from documents processed by the tools.

To run these tools, the content of the documents and project information involved is sent to our AI service providers, Anthropic and Google, which process it on our behalf to return a result. They are not permitted to use your content to train their models.

4.1 What we include in the corpus

• Names of jurisdictional departments and reviewer groups (for example, "Building & Safety," "Fire Prevention Bureau")
• Code reference patterns and common correction language observed in the document
• Document structure metadata (round numbers, department groupings, discipline tags)
• Anonymized aggregate statistics used to tune model prompts and shown on our public jurisdiction pages (for example, typical review times and common correction categories by department)
• Names of city plan reviewers as they appear on letters, kept in a shared reviewer directory

4.2 What we do not include

• Project addresses
• Applicant, owner, or client names
• Permit numbers tied to identifiable projects
• The raw uploaded PDF file itself. For our free correction-letter tool, the file is deleted once the parse succeeds; if a parse fails, we keep the file only to diagnose the failure. Letters you upload into a project are stored with that project like any other document.

We process this information on the legal basis of legitimate interest in providing and continually improving the Service for all users. You may opt your uploads out of the learning corpus at any time through our contact form, and we will exclude your future uploads and remove any associated corpus entries within 30 days.

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

5.1 With Your Consent

We share information when you direct us to, such as when you invite collaborators to your projects or share documents with external parties.

5.2 Service Providers

We work with third-party service providers who perform services on our behalf, including:

• Hosting and storage: Vercel (application hosting) and Supabase (database and file storage), in the United States
• Authentication: Clerk
• Payments: Stripe
• Email delivery: Resend
• AI processing: Anthropic and Google
• Analytics: PostHog and Vercel Web Analytics
• Address lookup and bot protection: Geoapify and Cloudflare

These providers are contractually obligated to protect your information and may only use it to provide services to us.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

6. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure cloud infrastructure with leading providers
• Access controls and authentication mechanisms
• Regular security assessments and monitoring

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information and documents for as long as your account is active or as needed to provide you with the Service. In addition:

• Documents you delete go to a trash folder and are permanently deleted after 30 days.
• When you delete your user account, we remove your name, email address, and profile photo. Content you contributed to your firm's projects stays with the firm, no longer attributed to you by name.
• If your firm wants its account and documents deleted, email us; we will confirm the request and delete them within 30 days. Ending a subscription alone moves the firm to the free plan and does not delete its data.
• We may retain certain information as required by law or for legitimate business purposes.
• Backups are purged according to our retention schedule.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Export: Request a portable copy of your data.
• Opt-out: Opt out of marketing communications at any time.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, please contact us through our contact form.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential: keep you signed in, keep guest sessions open, and remember your preferences and settings
• Analytics cookies (only if you accept): PostHog analytics cookies help us understand how the Service is used. Inside the app, this includes session recordings of how pages are used.
• Cookieless analytics (if you decline or have not chosen): PostHog counts page views and product events without cookies or browser storage. It does not record sessions or link the activity to your account; visitors are counted using a privacy-preserving hash that PostHog computes on its servers.
• Cookieless measurement: Vercel Web Analytics counts page views without cookies or cross-site tracking

We do not use advertising cookies or tracking pixels. We also record some product events on our servers (for example, that a project was created) to operate and improve the Service. You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of our Service.

10. Children's Privacy

Our Service is intended for business use by adults and is not intended for anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

We store and process your information in the United States. If you use the Service from elsewhere, your information will be transferred to and processed in the United States and may be processed by our service providers in other countries. These countries may have different data protection laws. We take appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: