Enterprise Privacy Policy — Covalent Technologies

1. Introduction & Overview

Covalent Technologies LLC ("Covalent", "we", "our", or "us") is committed to maintaining strict data privacy, enterprise isolation, and confidentiality standards for all users of our web platform and our marketplace micro-applications, including:

Covalent Sentinel for Procore (Procore App Marketplace)
Covalent Sentinel for Autodesk Construction Cloud (ACC) (Autodesk App Store)
Covalent Legal Sentinel for Clio (Clio App Directory)

This Privacy Policy explains how our systems interact with your host platform accounts, what data is collected via authorized OAuth 2.0 handshakes, how that data is secured, and our strict non-monetization guarantees.

CORE PRIVACY COMMITMENT: Covalent Technologies operates on an enterprise B2B subscription model. We DO NOT sell, rent, broker, or monetize your company vendor directories, subcontractor rosters, or legal matter files. Your proprietary directory data is never cross-shared with other tenants or used to train public machine learning models.

2. Data Ingestion & OAuth Permission Scopes

When you authorize a Covalent Sentinel application within your host platform, we request only the minimal OAuth permission scopes required to perform statutory compliance checks and write back verified status badges:

Host Platform	Permission Scope	Purpose & Functionality
Procore	`Read Companies` `Read / Write Vendors` `Read / Write Insurances`	Identifies project vendor records, reads CSLB license numbers, cross-references with CA DIR registry, and writes verified PWCR compliance badges and expiration dates into the vendor’s `/insurances` tab.
Autodesk ACC	`Read Account Companies` `Read Project Directories`	Audits subcontractor lists in Autodesk Construction Cloud (BIM 360 / ACC) against state public works registries to flag unregistered or expired contractors.
Clio	`Read / Write Matters` `Read Contacts` `Write Notes`	Cross-references attorney contacts and counsel against State Bar disciplinary records and writes certified good standing confirmation notes into matter logs.

3. Information We Collect Automatically

In delivering the Services, our Cloud Run backend collects and processes:

OAuth Authentication Tokens: Encrypted access tokens and refresh tokens issued by the host platform (Procore, Autodesk, or Clio) to maintain authorized API communication.
Entity Audit Records: Business names, contractor license numbers (CSLB), public works contractor registration numbers (PWCR), and State Bar numbers submitted for automated verification.
Audit Telemetry: Timestamp of verification, audit result status (e.g. compliant, expired, unregistered), execution latency, and webhook transaction IDs stored in our Cloud SQL audit log.
Billing Details: Billing is processed through Stripe. Covalent does not store raw credit card numbers or CVVs on its servers. Stripe provides us with customer identifiers, subscription status, and billing tier.

4. Multi-Tenant Architecture & Data Security

Covalent enforces defense-in-depth security across all software tiers:

Strict Database Isolation: Tenant authentication credentials and audit logs are partitioned into dedicated PostgreSQL tables (ingestion.procore_tenants, ingestion.autodesk_tenants, and ingestion.clio_tenants) with row-level security and explicit tenant ID constraints.
Encryption at Rest & in Transit: All communication between host platforms and Covalent Cloud Run microservices is strictly encrypted via TLS 1.3. OAuth tokens and secrets at rest are protected by Google Cloud Key Management Service (Cloud KMS) and AES-256 database-level encryption.
Serverless Ephemeral Processing: Audit payloads are evaluated in memory in under 0.25 milliseconds. No full database dumps of your host platform are retained outside of the specific vendor IDs necessary for automated badge synchronization.

5. Third-Party Disclosures & Subprocessors

Covalent does not share your private account data with any third parties except the following essential enterprise infrastructure subprocessors:

Google Cloud Platform (GCP): Hosting infrastructure (Cloud Run, Cloud SQL, Cloud Scheduler) in the us-central1 region under Google's Business Associate and Data Processing Addendums.
Stripe, Inc.: Payment processing and PCI-DSS Level 1 compliant subscription management.
Host Platforms: Secure API data round-tripping to Procore Technologies, Inc., Autodesk, Inc., and Themis Solutions Inc. (Clio) as directed by your authorization.

6. Data Retention, Revocation & Deletion Rights

You remain in full control of your data at all times:

1-Click Revocation: You may instantly revoke Covalent's access at any time through your Procore Developer Portal, Autodesk App Store, or Clio App Settings.
Automated Token Purging: Upon receipt of an uninstallation webhook or subscription cancellation, access tokens are permanently deactivated.
Right to Deletion: You may request the complete, permanent deletion of your tenant record and historical audit logs by sending an email to privacy@covalenttechnologies.ai. We will process and confirm deletion within thirty (30) days.

7. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide specific rights:

Right to Know: You may request disclosure of the specific categories of data collected.
Right to Delete: You may request deletion of non-essential personal information.
Right to Non-Discrimination: We will not deny services or alter pricing if you exercise privacy rights.
Notice of Non-Sale: Covalent does not sell personal information or share personal information for cross-context behavioral advertising.

8. Contact the Data Protection Officer

For privacy inquiries, audit trail requests, or data protection officer communications, please contact:

Covalent Technologies LLC
Attention: Privacy & Compliance Office
Email: privacy@covalenttechnologies.ai
General Support: support@covalenttechnologies.ai