Privacy Policy

COOPERBUILD, INC.(“Cooper,” “we,” “us”) builds Cooper, an operating system for construction companies: software that runs estimating, procurement, submittals, finance, payroll and field operations in one workspace, with AI agents that act inside it on API keys the customer holds. This policy explains what we collect, how we use it, who we share it with, and the choices you have. It is effective as of October 5, 2026.

1. Who this policy covers

This policy applies to cooperbuild.ai, the Cooper web application at app.cooperbuild.ai, and related services, demos, and communications (together, the “Services”). It is operated by COOPERBUILD, INC.(“Cooper,” “CooperBuild”), a corporation with its principal place of business at 4300 Biscayne Blvd, Suite 203, Miami, FL 33137, United States.

When you use Cooper as part of an organization (a “Customer”), that organization is generally the controller of the project data, specifications, and other content it puts into Cooper, and Cooper acts as its processor under a separate customer agreement and data processing addendum (“DPA”). For that content, the Customer's own privacy notices govern; this policy describes how Cooper itself handles personal information.

2. Information we collect

Account information

Account & contact details — name, work email, organization, role, and credentials when you request access, book a demo, or create an account.
Customer content — the documents, data, and objects you or your organization load into Cooper: plans and drawings, specification sets, RFIs, change orders, schedules, estimates, line items, subcontractor and vendor records, purchase orders, and the relationships between them.
Communications — messages, support requests, and feedback you send us, including any attachments.

Project and usage data

Usage data — pages and features used, queries run, actions taken, timestamps, and approximate location derived from IP address.
Device & log data — browser type, operating system, device identifiers, referring URLs, and error logs.
Cookies & similar technologies — used to keep you signed in, remember preferences, and understand aggregate product usage. You can control cookies through your browser settings; some features may not work without them.

Google user data (via OAuth)

When you choose to connect your Google account in Cooper Settings, we request access to your Gmail data using the Google OAuth 2.0 authorization flow. We collect Google user data only after you grant explicit permission. The specific data collected depends on which OAuth scopes you authorize — see Section 3 for the full scope-by-scope breakdown.

We do notaccess your Google account unless you have connected it through Cooper Settings. Connecting your Google account is optional and is never required to use Cooper's core construction management features.

Bank account information (via Plaid)

If someone in your organization with bank account access chooses to connect a bank, Cooper uses Plaid Inc. (“Plaid”) to make that connection. The person connecting signs in to the bank through Plaid; Cooper never receives or stores the bank username or password. Once they agree in Plaid, Cooper receives from Plaid:

Bank — the name of the bank.
Accounts shared— each account's name (and the bank's official name for it), the last four digits of its account number, its type (for example checking or credit card), and its currency.
Balances — current and available balances, and when Cooper last refreshed them.
Connection status — identifiers Plaid assigns to the connection and its accounts, and notices when the bank needs signing in again, stops sharing an account, or has new accounts to share.

Cooper does not receive full account or routing numbers through Plaid. The connection is set up to allow transaction data, and Plaid may begin preparing up to 24 months of transaction history for it, but Cooper does not currently retrieve transaction details; if that changes, we will update this policy first. Connecting a bank is optional and is never required to use Cooper.

AI assistant memory and preferences

Cooper's AI assistant can remember things about you that stay true over time — your role, what you are responsible for, and how you like emails, calls and answers written (for example tone, sign-off, units and date format) — so it does not have to ask again. This applies whether you use the assistant inside Cooper or through an AI app you connect to Cooper, such as Claude or ChatGPT. Each person's memory and preferences are kept within their organization's workspace and are not shared with other customers. You can view, edit and delete everything remembered about you in Cooper under Settings → Cooper AI Profile.

Phone calls and meetings with Cooper's AI agents

At a user's request, Cooper's AI agents can place phone calls, leave voicemails and take part in online meetings on that user's behalf. An agent says it is an AI assistant when it introduces itself on a call, and meeting invitations and calendar entries say when an AI agent will attend. To do this, Cooper processes the audio of the call or meeting, converts speech to text and text to speech, and saves a transcript and summary to the requesting user's Cooper workspace. If your organization has call recording turned on, a recording is saved too.

3. Google User Data

Cooper Build requests the following Google OAuth scopes when a user connects their Google account. Each scope, the data it provides access to, how that data is used, how it is stored, and how long it is retained are described below.

Scope: `https://www.googleapis.com/auth/gmail.readonly`

User-facing description: View your email messages and settings.

Data accessed: Inbound email message metadata (sender, subject, timestamp) and body content for new messages received after the connection is established. Cooper does not import or retroactively read your existing mailbox history.
Purpose: To surface project-relevant emails inside the Cooper workspace, link communications to the correct project objects (RFIs, change orders, submittals), and allow your team to act on them without leaving Cooper.
Storage: Email data is stored in MongoDB Atlas (encrypted at rest, AES-256) within a tenant-scoped data store accessible only to users of your organization. Attachments are stored in AWS S3 with server-side encryption. Inbound message delivery is handled via Google Cloud Pub/Sub push notifications.
Retention: Email data is retained for the duration of your Cooper subscription or until you disconnect your Google account (whichever comes first), after which it is deleted or anonymized in accordance with our standard data-deletion schedule.

Scope: `https://www.googleapis.com/auth/gmail.modify`

User-facing description: Read, compose, and send emails from your Gmail account.

Data accessed: The same inbound message data as gmail.readonly, plus the ability to draft and send reply emails on your behalf from within the Cooper interface.
Purpose: To allow users to reply to project-related emails — such as RFI responses, submittal acknowledgements, and vendor correspondence — directly from Cooper without switching to Gmail. Messages are sent only when you explicitly trigger the action in Cooper.
Storage: Same as above. Outbound drafts composed inside Cooper are stored temporarily and deleted once sent or discarded. Cooper does not retain copies of sent messages beyond what is needed to confirm delivery.
Retention: Same retention schedule as gmail.readonly data.

Important clarifications

Data is processed only after you explicitly connect your Google account in Cooper Settings → Integrations → Connect Gmail.
Cooper mirrors only new inbound messages received after connection. We do not import, scan, or index your existing mailbox history.
Google user data is used exclusively to provide the Gmail integration feature within your Cooper workspace. It is not used for advertising, profiling, or model training. See the Limited Use Disclosure below.

4. Limited Use Disclosure

Cooper Build's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, with respect to Google user data:

We do not use Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models.
We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing features of Cooper Build, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
We do not use or transfer Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
We do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, doing so is necessary for security purposes (e.g., investigating abuse), to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized.

5. How we use information

To provide, operate, and maintain the Services, including modeling your data into the ontology graph and running the queries you request.
To authenticate users, secure accounts, and prevent fraud and abuse.
To provide support, respond to inquiries, and communicate about the Services, including service and security notices.
To monitor, debug, and improve the Services — for example, fixing errors and tuning performance — using usage and log data.
To send product updates and marketing communications where permitted; you can opt out of marketing at any time.
To comply with legal obligations and enforce our agreements.

Google user data is not used for advertising, interest-based profiling, or training any AI or machine learning model. Its use is strictly limited to providing and improving the Gmail integration feature within your Cooper workspace, as described in Sections 3 and 4.

Bank account information from Plaid is used only to show your organization its bank balances in Cooper, to match each bank account to the Cooper bank account it belongs to, to compare bank balances with your books, and to keep the connection working (for example, spotting the same bank connected twice, or a bank that needs signing in again). We do not sell it, use it for advertising, or send it to AI model providers.

Where required by law, we rely on the following bases to process personal information: performance of a contract, our legitimate interests in operating and securing the Services, your consent (for example, for non-essential cookies or marketing), and compliance with legal obligations.

6. AI models and your data

Your business data is never used to train a public model. Cooper is the harness — your data, modeled so a frontier model can reason over it. The model is a swap; the graph is yours.

Cooper is model-agnostic by design. To answer your queries and run AI features, the Services send the content needed for each request to one or more frontier models, operated by third-party providers or run on infrastructure you control in a self-hosted deployment. The third-party AI providers we use are:

Anthropic, OpenAI, Google and xAI— language models that answer questions, run Cooper's AI agents and automations, and read the documents and project files you ask them to work with, including payroll reports, résumés, receipts and supplier invoices. Which provider handles a request depends on the feature and on your organization's AI settings.
Amazon Web Services (Amazon Textract) — extracting text from uploaded documents such as payroll reports, résumés, receipts and invoices.
Deepgram, OpenAI and ElevenLabs— speech-to-text and text-to-speech when Cooper's AI agents take part in phone calls and meetings.

We will identify the model providers in use as subprocessors in our DPA and subprocessor list.

No training on your content. We do not use Customer content (including Google user data) to train, fine-tune, or improve any foundation model that is offered to other customers or the public. Where we use third-party model APIs, we use offerings and contractual terms that exclude your inputs and outputs from provider model training.
The wiki and ontology compound for you alone.Templates, pricing heuristics, and the object graph that get sharper with every closed project belong to your organization's deployment. They are not pooled across customers.
Self-hosting. Where you run Cooper in your own environment, your Customer content stays in your infrastructure and is not transmitted to us except as you configure (for example, diagnostic logs you choose to share).
Aggregate, de-identified telemetry. We may use aggregated, de-identified usage statistics that do not identify you, your organization, or any project to operate, secure, and improve the Services.

8. Data retention

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Customer content is retained for the term of the applicable customer agreement and deleted or returned thereafter as described in that agreement and our DPA, subject to backup retention cycles and any legal hold.

Google user data is retained for the duration of your active Gmail connection in Cooper. When you disconnect your Google account (via Cooper Settings → Integrations → Disconnect Gmail), we initiate a stop-watch on inbound push notifications, deactivate the stored OAuth tokens, and mark the connection inactive. Associated email data is deleted or anonymized within 30 days of disconnection, subject to backup cycles.

Bank account informationreceived through Plaid is retained while the bank connection is active. When a bank is disconnected in Cooper, we tell Plaid to end the connection and delete Cooper's stored access token, so Cooper can no longer read new information from that bank. If Cooper cannot end the connection at Plaid and the bank is removed from Cooper instead, Cooper stops using it and keeps its encrypted access token only so the connection can still be ended; contact us and we will work with Plaid to end it. You may also be able to end it yourself through Plaid (see Section 11).

The bank name and the account details and last balances described in Section 2 remain part of your organization's records until your organization asks us to delete them, or they are deleted with your organization's other Customer content as described above, subject to backup cycles. To request deletion, contact us at hello@cooperbuild.ai.

Account and contact data tied to demos or trials that do not convert is retained for a limited period and then deleted or anonymized.

9. Security

We use administrative, technical, and physical safeguards designed to protect information, including:

AES-256 encryption at rest for all stored data, including OAuth refresh tokens.
HTTPS / TLS encryption for all data in transit.
Access controls and least-privilege practices — your email data is scoped to your organization's tenant and inaccessible to other organizations.
Network segmentation, logging, and monitoring.
Regular review of our security controls.

Cooper's security program is built toward SOC 2 attestation. No system is perfectly secure; you are responsible for keeping your credentials confidential and for the security of devices you use to access the Services. See our Terms of Service for more on your responsibilities.

10. International data transfers

Cooper is headquartered in the United States and stores data in US-region infrastructure. We may process information in other countries where we or our service providers operate. Where required, we use appropriate safeguards — such as the European Commission's Standard Contractual Clauses or equivalent mechanisms — for transfers of personal data out of the EEA, the UK, or Switzerland.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; and to withdraw consent. You can also opt out of marketing emails using the unsubscribe link in any such message.

To revoke Cooper's access to your Google account:

Within Cooper: Go to Settings → Integrations → Disconnect Gmail. This immediately deactivates the OAuth connection and stops all further data collection.
Via Google: Visit https://myaccount.google.com/permissions and remove Cooper Build from the list of connected apps.

To revoke Cooper's access to your bank:

Within Cooper: Someone in your organization with bank account access goes to Settings → Integrations → Plaid and chooses Disconnect on the bank. Cooper stops reading information from that bank. If Disconnect is not offered, or fails and Cooper offers to remove the bank from Cooper only, the connection may stay open at Plaid; contact us (see Section 8) and we will work with Plaid to end it.
Via Plaid: You may also be able to remove Cooper's access in Plaid Portal (my.plaid.com). This stops new information reaching Cooper; to delete what Cooper already holds, see Section 8.

To exercise any other rights, or to request deletion of Google user data, contact us at hello@cooperbuild.ai. If you are a user within a Customer organization, please direct requests about Customer content to that organization; we will assist them as their processor. We will not discriminate against you for exercising your rights. You may also have the right to lodge a complaint with your local data protection authority.

12. Mobile messaging (SMS) and your phone number

We collect mobile phone numbers only when you provide them — for example, when you book a demo, create an account, contact support, or expressly opt in to receive SMS messages from CooperBuild. We use those numbers to send account-related and transactional messages (such as security codes, confirmations, and service notices), to respond to support requests, and — where you have specifically opted in — to send program-related SMS communications (such as product updates or demo follow-ups).

No mobile information (mobile phone numbers, opt-in data, or consent records) will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell or rent mobile phone numbers, and we do not pass them to lead generators.

If you opt in to an SMS program from CooperBuild:

You may opt out at any time by replying STOP to any message. We will send a single confirmation that you have been unsubscribed and will stop sending you messages from that program.
You may request assistance by replying HELP, or by contacting us at hello@cooperbuild.ai.
Message frequency varies by program; for recurring programs the frequency will be disclosed at the point of opt-in.
Message and data rates may apply, depending on your wireless plan.
Wireless carriers — including T-Mobile, AT&T, and Verizon — are not liable for delayed or undelivered messages.

Even if you opt out of marketing or program SMS, we may still send essential transactional or security messages where permitted by law. The SMS program terms that govern your enrollment are in our Terms of Service. You can opt in to messages from CooperBuild on our demo request page; consent is never a condition of booking a demo or of purchasing any goods or services.

Messages sent through Cooper on behalf of our Customers

Cooper is also a software platform that our business Customers — construction firms — use to communicate with their own contacts, such as subcontractors, vendors, and project stakeholders. When a Customer sends messages through Cooper:

The Customer is the sender and the controller of that communication. CooperBuild acts as their service provider (processor) and sends the message on their behalf.
The Customer is responsible for obtaining and retaining consent from each recipient before messaging them, and for honoring opt-out requests. Our Acceptable Use terms require it.
STOP and HELP are always honored.Opt-out keywords are processed automatically for every message sent through Cooper, regardless of which Customer sent it, and the opt-out is recorded against that Customer's messaging.
Recipient phone numbers and consent records held on a Customer's behalf are scoped to that Customer's tenant. They are not pooled across Customers, sold, or shared with third parties or affiliates for marketing or promotional purposes.

If you received a message from a construction firm using Cooper and want it to stop, reply STOP to that message. You may also contact us at hello@cooperbuild.ai and we will route your request to the Customer that sent it.

13. Children's privacy

The Services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make material changes — including any changes to how we handle Google user data — we will update the “Last updated” date and provide additional notice (for example, by email or in-product). Your continued use of the Services after an update means you accept the revised policy.

15. Contact us

Questions about this policy, our data practices, or to request deletion of your data? Email hello@cooperbuild.ai or call +1 (917) 531-4445.

COOPERBUILD, INC.
4300 Biscayne Blvd, Suite 203, Miami, FL 33137
United States