Security and AI Data Use

SparkQuote is a free beta. This page says plainly what we do to protect your plans, estimates and customers' details, and what we have not done yet. For what the marketing site records about visitors, see the privacy policy.

The short version

• Your projects, plans, takeoffs and estimates belong to your account, or to your team if you use one. Every request is checked against the signed-in account before any data is read or changed.
• Plan PDFs and sheet images sit in a private file store. There are no public file links; the app streams a file only to a signed-in owner.
• Connections use HTTPS. Sign-in is handled by Clerk (email or Google); we never see or store a password.
• The AI reads your plans only to count symbols and read schedules. Plans are not used to train models.
• You can download everything as a JSON file and delete the account, with its files, from Settings.
• We are not SOC 2 or ISO 27001 certified, and no audit has started. If you need a report today, we are not the right fit yet.

Who can see your data

You, and the people you add. Teams have four roles: admin, estimator, reviewer (confirms or rejects takeoff markers, reads the rest) and viewer (read only). Only an admin can manage the team, create access tokens, export everything or delete the account.

Nobody at a customer or partner, unless you send a link. Three kinds of link exist, and each is an unguessable address that works without an account:

• A proposal link shows the customer the proposal and lets them accept it by typing their name. It shows the price and the scope you chose to print, not your cost, labor hours or markups. You see when it was opened and can revoke it at any time.
• A view-only takeoff link shows symbol counts and run lengths, no prices. It can expire, and you can revoke it.
• A supplier quote link shows the items you asked a supplier to price and takes their unit prices.

Us. SparkQuote staff can reach the database to run the service and fix problems. We do not look at customer plans without a reason, such as a bug you reported.

What the AI sees

To count symbols, sheet images and the text extracted from your plans are sent to Anthropic's Claude models through their API. Questions you type into the plan chat or the MCP tools go the same way, together with a short summary of your takeoff counts. Anthropic's API terms apply: inputs sent through the API are not used to train its models by default. Every count the AI makes is shown on the plan for you to confirm or reject, and every estimate line says where its quantity came from.

Access tokens and the MCP server

The account MCP server lets Claude, ChatGPT or another assistant list your projects, read takeoffs and estimates, and add lines to an estimate. It needs an access token from Settings. We store only a hash of the token, show the token once, and you can revoke it at any time. A token acts with the full rights of the account that made it, so treat it like a password. The public NEC calculator MCP server needs no token and sees no account data.

Where the data lives

• Database: Neon Postgres in the US, reached over TLS.
• Files: Vercel Blob, private store.
• Hosting: Vercel.
• Sign-in: Clerk.
• Email: Resend, for the messages the app sends on your behalf (proposal links, bid reminders).

Each provider encrypts stored data and has its own security program; we rely on them and do not add a separate encryption layer of our own.

Leaving

Settings has Download everything (JSON), which exports your company details, library, projects, sheets, markers, measurements, panels and estimates; plan PDFs are downloaded from each plan set. Delete my account removes the database records and the stored files and deletes your sign-in. Deletion cannot be undone.

Reporting a problem

Email privacy@sparkquote.ai with what you found. We reply within a few business days and will not pursue anyone who reports a problem in good faith and does not access other people's data.