Privacy Policy

Summary of key points

This summary gives the key points. The full sections below give the details.

• What personal information do we process? It depends on how you use Diggit. It includes your account details, the work records your company keeps in Diggit (forms, photos, signatures, job data), your voice when you use voice features, and basic device and usage data. See Section 2.
• Do we process sensitive personal information? Yes, in limited ways. We collect precise location when a form asks for it or while you use voice features with location turned on, and we store login credentials (for example, a securely hashed password). We use these to run and improve the Services, as this policy describes. We do not use them to infer things about you. We do not create voiceprints, and passkey or Face ID checks stay on your device. See Sections 2 and 12.
• Do we use AI? Yes. Diggit uses AI services to turn speech into text, understand what you said, fill in forms, and help build forms and workflows. We may use your company’s content to improve Diggit’s own AI features, unless your company opts out. See Section 4.
• Do we sell your information or use it for targeted ads? No.
• With whom do we share it? With the service providers that run parts of Diggit for us, such as hosting, email, text messages, payments, analytics, and AI, and with AI apps you choose to connect, such as ChatGPT. See Section 5 for the full list.
• How do we keep it safe? We use organizational and technical safeguards. No system is 100% secure. See Section 8.
• What are your rights? Depending on where you live, you may have the right to access, correct, delete, or get a copy of your information. You can delete your account from inside the app. See Sections 10, 12, and 16.

1.Who we are and what this policy covers

In short: Diggit is software for construction crews and the offices that support them. Your company usually decides what goes into Diggit.

Diggit lets field crews fill out forms by voice or by hand, build forms and workflows, collect signatures, attach photos, and see results on dashboards.

Most people use Diggit because their employer or a company they work with (our “Customer”) set up a Diggit workspace for them. In that case:

• The Customer controls the workspace data. This means the forms, records, photos, signatures, and job data in that workspace. We process that data on the Customer’s behalf and under our agreement with them.
• If you want to access, change, or delete workspace data, contact the Customer (for example, your employer) first. If you contact us, we may refer your request to them.
• We control the account, billing, analytics, and marketing information described in this policy.

2.What information do we collect?

Personal information you give us

In short: We collect the information you give us when you sign up, use Diggit, or contact us.

The information we collect depends on how you use the Services. It may include:

• Account information. Name, email address, mobile phone number, job title or role, the company and crews you belong to, and your sign-in details. Passwords are stored only as a secure hash. If you sign in with a passkey, we store the public part of the passkey. The private part and any Face ID or fingerprint check stay on your device.
• Workspace and job data. Projects, jobs, crews, people, equipment, schedules, hours, and the other records your company keeps in Diggit.
• Form content. Everything entered into a form, whether typed, picked, or spoken.
• Voice. When you use a voice feature, we collect the audio of what you say and the text transcript made from it. See Section 4 for how audio is handled.
• Photos and files. Photos and files you attach. Photos can contain hidden data (called EXIF data), such as the time and GPS location where the photo was taken. We read and store that location and time with the photo so it can show on the record.
• Signatures. When you or another person signs a form or a sign-off, we store the drawn signature image, the signer’s name and email, the time of signing, and the signer’s IP address and browser or device type. This helps show who signed and when. People who sign through an emailed link do not need a Diggit account.
• Location. See “Location data” below.
• Messages with the Diggit assistant. Questions you type or say to the in-app assistant, and its replies, are saved in your chat history.
• Assistant memory. The assistant can save short notes about your preferences so it can help you better next time (for example, how you like a report worded). You can see, change, and delete these notes at any time. On the web, go to Account › Memory. In the mobile app, go to voice settings. When you delete a note, we keep a copy in a change log so that you can undo the delete. The change log is deleted with your workspace’s data. You can also ask us to delete it sooner at support@diggit.ai.
• Billing information. For paid plans, our payment processor, Stripe, collects your payment card details. We do not store full card numbers. We keep your plan, billing contact, invoices, and payment status.
• Communications. Messages you send us, such as demo requests, support emails, and feedback.

All personal information you give us must be true, complete, and accurate. Please tell us about any changes.

Location data

In short: We collect precise location only in the Diggit app, only if you allow it, and to fill in your forms.

• When a form asks for site coordinates. If a form includes a location question, the app reads your device’s current location to fill it in.
• During a voice session. While a voice session is open, and only if you have already allowed location for Diggit, the app reads your location about once a minute. We use it to answer location questions in your forms (for example, “where is this job?”). We stop when the voice session ends.
• From photo data. As described above.

The app reads your location only while you are using it. It asks for location only “while using the app.” It does not track your location in the background when the app is closed.

We use precise location from your device to fill in your forms and records. We never use it for analytics or to personalize the app, and we never use it for advertising. Before we use location in any new way, we will update this policy.

You can turn location off at any time in your phone’s or browser’s settings. Some features may not work fully without it.

Information collected automatically

In short: Some information, such as your IP address and device type, is collected automatically when you use the Services.

• Log and usage data. Our servers record service information when you use the Services, such as your IP address, browser and device type, the date and time of your request, and error reports. When you sign in, we store the IP address and device type of each session so you can see and end your sessions.
• Product analytics (web app and mobile app). We use PostHog to learn which features people use and where the app has problems. We record events such as screens viewed, buttons tapped, and errors. We build these events to leave out form answers, on-screen text, email addresses, and phone numbers, and we reduce web addresses to the screen name only. We link events to an internal user number, not to your name. We do not record your screen (session replay is off).
• Page counts (web app). Cloudflare Web Analytics may also count page views in the web app (page address, referring page, browser type, and country). It does not use cookies.
• App performance data. The mobile app sends basic performance data, such as how long it takes to start and any crashes, to Expo, the company that provides our app platform. This data is not linked to your name.
• Push notifications. If you allow notifications, we store a push token for your phone so we can send you reminders. Expo passes these notifications to Apple’s and Google’s push services, which deliver them to your phone.
• Device data. Device model, operating system, app version, and language.

The diggit.ai marketing website

Our marketing website does not use advertising tags or scripts from other websites. Fonts and scripts, including PostHog’s, are served from our own server. On your first visit, a small card asks whether we may use cookies to count visits. Until you choose Accept, nothing is stored in your browser. If you choose Decline or do not answer, your visit is still counted without a cookie: PostHog combines your IP address and browser details with a value that changes every day, so it can count a visitor once a day without storing anything on your device or recognizing you on another day. If you choose Accept, PostHog sets a cookie with a random number so it can also recognize you when you come back. Either way, we record the page you visit, the page that sent you there, your browser and device type, and clicks on Book a demo, the app store badges, and the Waitlist. We remove everything from web addresses except campaign tags (such as utm_source). When you join the Waitlist, we record only the Business Type you picked, never your name or email. PostHog receives your IP address and may work out an approximate location (city and country) from it. The cookie belongs to diggit.ai, so if you accepted and later sign in to the Diggit web app, PostHog can connect your earlier website visits to your app account. If you choose Decline, we keep only your answer in your browser, so the card does not ask again. You can change your answer at any time with Cookie settings at the bottom of the home page. Choosing Decline there removes the cookie. Our web server keeps standard access logs (IP address, browser type, page requested, and time). If you click an email link on the site, your email program sends your message to us. Cloudflare runs the DNS for our domain names. This means it tells your browser where to find our server. Your visit itself goes straight to our server and does not pass through Cloudflare. If you book a demo, the booking page is run by Microsoft Bookings.

Information from other sources

• From your company. Your employer or the Customer may add you to Diggit and give us your name, email, phone number, role, and crew.
• From other users. Coworkers may mention you in forms, reports, or records.
• From service providers. For example, Stripe tells us if a payment succeeded, and our email and text message providers tell us if a message was delivered.

3.How do we use your information?

In short: We use your information to run and improve Diggit, keep it secure, communicate with you, and follow the law.

We process your information to:

• Create and manage accounts. Sign you in (by password, emailed link, emailed code, text message code, or passkey), keep your account working, and manage workspaces, crews, and invitations.
• Provide the Services. Save and show forms and records, turn your voice into form entries, process photos, collect signatures, run the workflows your company sets up, and build dashboards.
• Send service messages. Send sign-in codes, invitations, signature requests, workflow emails, reminders, and notices about your account. These are part of the Services.
• Bill for paid plans. Process payments, track usage against plan limits, and send invoices.
• Protect the Services. Detect and prevent fraud, abuse, and security incidents.
• Improve the Services. Understand which features are used and fix problems, using the limited analytics described above. Train, tune, and improve Diggit’s own AI features, unless your company opts out (see Section 4).
• Respond to you. Answer support requests and demo requests.
• Follow the law. Meet legal, tax, and accounting duties, and enforce our Terms of Service.
• With your consent. For other purposes, if you agree.

We do not sell your personal information, and we do not use it for targeted advertising.

4.How does AI process your voice and text?

In short: When you use voice or assistant features, your audio or text is sent to AI service providers to be processed. We do not keep recordings of your voice.

Voice sessions (hands-free talk). When you start a voice session in the app:

1. Your audio travels over a secure connection through LiveKit, which provides our real-time voice service.
2. Your speech is turned into text by a speech-to-text service (Deepgram, provided through LiveKit). Or, if your company chose a different voice mode, your audio goes straight to Google (Gemini Live) or OpenAI (Realtime).
3. The text is sent to our servers. Our servers use an AI model to understand it and fill in your forms.
4. The spoken reply is made by a text-to-speech service (Cartesia, provided through LiveKit).

Background noise may be filtered from your audio before it is processed. The noise filter (from ai-coustics) is software that runs on our own voice server. Your audio is not sent to ai-coustics.

Push-to-talk voice clips. When you hold a button and speak, the short audio clip is sent to our server and then to Google (Gemini) to understand what you said. Our server holds the clip in memory only for that request.

Building forms and workflows, and the assistant. When you ask Diggit to build a form or workflow, or you type to the assistant, your request and the related workspace content are sent to an AI model. Today, the form and workflow builder uses OpenAI, and the text model behind voice uses Google (Gemini). AI steps in automated workflows, when they are turned on, also use OpenAI. If we add or change an AI provider, we will update Section 5.

What we keep. We do not store audio recordings. We keep the results: the form entries, the chat messages, and assistant memory notes described in Section 2. The AI providers process your audio and text to give us results. They may keep it for a short time under their own terms (for example, to check for abuse).

Training. We may use the content your company puts into Diggit to train, tune, and improve Diggit’s own AI features for the Services. Your company can opt out at any time by emailing support@diggit.ai. The opt-out applies from the time we receive it.

We do not sell your content. We do not let the outside AI companies we use under our own accounts train their general models on it. We do not let our speech providers train on your audio. We do not use your content to train AI models that we offer to anyone outside the Services.

We use paid business accounts with our AI providers, not free or personal accounts. Here is what their terms say about training:

• OpenAI and Google (Gemini). Under their business API terms, these companies do not use data sent through their APIs to train their models by default.
• Cartesia (text-to-speech, through LiveKit). We reach Cartesia through LiveKit’s model service. LiveKit’s published terms for that service say that neither LiveKit nor the model companies behind it keep, log, or train on the audio and text sent through it.
• Deepgram (speech-to-text, through LiveKit). We also reach Deepgram through LiveKit’s model service. LiveKit’s terms for that service do not allow LiveKit or the model companies it uses to keep your audio or use it to train or improve their models.
• LiveKit (voice connection). LiveKit carries your live audio. We do not use LiveKit’s recording features. LiveKit says it does not train on customer data without permission.

Check AI results. AI can make mistakes. Diggit shows you what it heard and filled in so you can check it before you submit. Please review AI-filled forms, especially safety reports, before relying on them. See Section 4 of our Terms of Service.

5.When and with whom do we share your information?

In short: We share information with the service providers that help us run Diggit, with your company, and in a few other cases described here.

Service providers. We share data with vendors that perform services for us and need access to do that work. We have contracts with them that are designed to protect your information. They may use it only to provide services to us.

Push notification services. Expo passes push notifications to Apple’s and Google’s push services, which deliver them to your phone. These services receive your push token and the notification text.

Your company and other users. Information you put in a workspace is visible to your company and to other users in that workspace, based on the permissions your company sets. People who sign a form through an emailed link can see the parts of the record they are asked to sign.

Integrations your company turns on. If your company connects Diggit to another system (for example, accounting or payroll software), we send the data your company chooses to that system.

AI apps you connect. You can connect Diggit to an AI app you use, such as ChatGPT. When you connect, you sign in to Diggit and choose the company. The app can always look at your work there; you choose whether it may also change records and file forms, and build forms and record types. The app then works as you, with your permission level in that company. When you ask the app about your work, Diggit sends it the records, forms, and other workspace content it asks for, which can include names, contact details, and anything else in your company’s records. If the app asks to be told about changes, Diggit also sends it updates as they happen. Diggit receives what the app asks it to do, which can include words from your conversation, but not your whole conversation. We keep a record of the connection: the app’s name, the company and the permissions you chose, its sign-in tokens, and any updates it asked for. Changes the app makes are saved in Diggit’s history under your name. What the app and its provider do with the information is governed by their own terms and their own privacy policy, not this one, and they are not our service providers. You can disconnect the app at any time in its settings. We keep the connection record until you delete your Diggit account, which ends the connection.

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.

Legal reasons. We may share information when the law requires it, or to protect the rights, property, or safety of Diggit, our users, or others.

No other sharing. We do not share your information with any other company, except as this section describes.

6.Do we use cookies and other tracking technologies?

In short: The Diggit app uses a few cookies and similar technologies to sign you in and to run analytics. The diggit.ai marketing website sets a visit-counting cookie only if you choose Accept.

• Sign-in cookie. The web app sets a cookie that keeps you signed in. Without it, the app cannot work. Sessions last up to 60 days and are refreshed when you use the app.
• Analytics storage. In the web app, PostHog stores an identifier in a cookie and in your browser’s local storage so it can count visits correctly. The mobile app stores a similar identifier on your device.
• Website visit counts. On the marketing website, PostHog sets a cookie only after you choose Accept on the cookie card. Without Accept, visits are counted without a cookie or other browser storage, and Decline keeps only your answer in your browser. Change it any time with Cookie settings at the bottom of the home page. See The diggit.ai marketing website.
• No advertising. We do not allow third parties to use advertising or cross-site tracking technologies on our Services.

Most web browsers accept cookies by default. You can usually set your browser to remove or reject cookies. If you block the sign-in cookie, you will not be able to sign in.

7.How long do we keep your information?

In short: We keep your information as long as we need it to provide the Services, unless the law requires us to keep it longer.

• Account information is kept while your account is open.
• Workspace data is kept for as long as the Customer keeps its workspace, or until the Customer deletes it.
• When a company closes its workspace, the workspace is suspended right away, and no one can use it. Its data is not deleted automatically. We delete it by hand when the company asks us to. To ask, email support@diggit.ai.
• Voice audio is not stored by us (see Section 4).
• Sign-in sessions expire after 60 days without use.
• Server logs stay on our own servers. We do not send them to an outside log service. We delete them on a rolling basis, normally within 30 days.
• Analytics data is kept by PostHog for as long as we need it to improve the Services, and then deleted.
• Assistant memory notes are kept until you delete them. When you delete a note, we keep a copy in a change log so that you can undo the delete. The change log is deleted with your workspace’s data. You can also ask us to delete it sooner at support@diggit.ai.
• Billing records are kept as long as tax and accounting laws require.
• Backups. We keep backup copies of our database and files with Cloudflare (R2), apart from our main servers, and a few recent database copies on our own servers. We back up your information every night and keep each backup copy for up to 35 days. Data you delete may stay in a backup copy until that copy is deleted.

When we no longer have a business need for your information, we delete it or remove the details that identify you. If that is not possible right away (for example, because it is in backups), we store it securely and keep it from any further use until it can be deleted.

8.How do we keep your information safe?

In short: We protect your information with organizational and technical security measures.

We use reasonable technical and organizational measures designed to protect the personal information we process. For example, data travels over encrypted connections, passwords are stored only as a hash, access inside a workspace is controlled by roles and permissions, and access to production systems is limited.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. We cannot promise that hackers, cybercriminals, or other unauthorized third parties will never defeat our security and improperly collect, access, steal, or change your information. Please protect your password and your devices, and tell us right away if you think your account has been misused.

9.Do we collect information from minors?

In short: Diggit is for adults at work. We do not knowingly collect data from children under 18.

We do not knowingly collect, request, or market to children under 18 years of age, and we do not knowingly sell such personal information. By using the Services, you confirm that you are at least 18. If we learn that we have collected personal information from someone under 18, we will deactivate the account and take reasonable steps to delete that data promptly. If you know of any data we may have collected from a child under 18, please contact us at support@diggit.ai.

10.What are your privacy rights?

In short: You can review and change your account information at any time, and you can delete your account from inside the app.

Withdrawing your consent. If we rely on your consent to process your personal information, you can withdraw it at any time by contacting us (see Section 15). You can also turn off location, microphone, or camera access in your phone’s settings at any time. Withdrawing consent does not affect processing that happened before you withdrew it, or processing based on other lawful grounds.

Account information. You can review and change your account information in your profile at any time.

Opting out of AI training. Your company can opt out of Diggit using its content to train, tune, and improve Diggit’s own AI features. Email support@diggit.ai. The opt-out applies from the time we receive it. See Section 4.

Getting a copy of your data. To get a copy of your data, email us at support@diggit.ai. We will provide it within 30 days.

Deleting your account. You can delete your account yourself in the app (Profile › Delete account) or on the web at the Delete account page. When you do:

• We remove your name, email address, password, and passkeys, and we end your sign-in sessions.
• If other records in a workspace still point to you (for example, forms you submitted for your company), we keep a “deleted account” marker in your place, instead of breaking your company’s records. The work records themselves belong to your company and stay in its workspace.
• Your assistant memory notes and chat history are deleted with your workspace’s data. You can also ask us to delete them sooner at support@diggit.ai.
• If you are the only owner of a workspace, you must first either hand ownership to another member or choose to close the workspace. Section 7 explains what happens to a closed workspace.

We may keep some information where needed to prevent fraud, fix problems, help with investigations, enforce our Terms of Service, or follow the law.

Cookies. See Section 6.

If you have questions or comments about your privacy rights, email us at support@diggit.ai.

11.Controls for Do-Not-Track and Global Privacy Control

Most web browsers, and some mobile operating systems and apps, include a Do-Not-Track (“DNT”) setting. No uniform standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will describe it in a revised version of this policy.

Some browsers send a Global Privacy Control (“GPC”) signal to opt out of the sale or sharing of personal information. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of.

12.Do United States residents have specific privacy rights?

In short: If you live in California or another US state with a consumer privacy law, you may have the right to access, correct, get a copy of, or delete your personal information. These rights may be limited in some cases by law.

Categories of personal information we collect

In the past twelve (12) months we have collected the following categories of personal information:

We use sensitive personal information only to provide the Services you ask for, to keep them secure, and for other purposes the law allows. We do not use it to infer characteristics about you.

We may also collect other personal information when you contact us in person, online, by phone, or by mail, for example when you ask for support or a demo.

How long we keep each category: see Section 7.

Sources, use, and sharing

• Sources: see Section 2.
• How we use it: see Sections 3 and 4.
• Who we disclose it to: we disclose personal information to the service providers in Section 5 under written contracts, for business purposes.

We have not sold personal information, and we have not shared it for cross-context behavioral advertising, in the preceding twelve (12) months. We do not sell or share the personal information of consumers under 16.

Your rights

You have rights under certain US state privacy laws. These rights are not absolute, and in some cases we may decline a request as the law allows. They include:

• The right to know whether we are processing your personal data.
• The right to access your personal data.
• The right to correct inaccurate personal data.
• The right to request deletion of your personal data.
• The right to get a copy of the personal data you shared with us.
• The right not to be discriminated against for using your rights.
• The right to opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. (We do not do any of these.)

Depending on the state where you live, you may also have:

• The right to get a list of the categories of third parties to which we have disclosed personal data (for example, under California and Delaware law).
• The right to get a list of the specific third parties to which we have disclosed personal data (for example, under Oregon law). Section 5 lists them.
• The right to limit the use and disclosure of sensitive personal data (for example, under California law).
• The right to opt out of the collection of sensitive data and personal data collected through a voice or facial recognition feature (for example, under Florida law).

Workspace data. If your request is about data in your company’s workspace, we may refer it to your company, because it controls that data (see Section 1).

How to exercise your rights

Email us at support@diggit.ai. You can also delete your account yourself (see Section 10).

You can name an authorized agent to make a request for you. We may deny a request from an agent that does not show proof that you authorized them.

Request verification

When we receive your request, we need to confirm that you are the person the information is about. We will use the information in your request only to verify your identity or authority. If we cannot verify you from the information we already have, we may ask for more information for verification, security, and fraud prevention.

If an authorized agent submits the request, we may need more information to verify your identity, and the agent must provide your written, signed permission.

Appeals

Under some US state laws, if we decline to act on your request, you may appeal by emailing us at support@diggit.ai. We will tell you in writing what we did or did not do in response, and why. If your appeal is denied, you may file a complaint with your state attorney general.

California “Shine the Light” law

California Civil Code Section 1798.83 (“Shine the Light”) lets California residents ask us, once a year and free of charge, for information about the categories of personal information (if any) we disclosed to third parties for their direct marketing, and the names and addresses of those third parties, for the prior calendar year. We do not disclose personal information to third parties for their direct marketing. To make a request, contact us using the details in Section 15.

13.Where is your information processed?

In short: We store your information in the United States. Some providers may process it elsewhere.

Our servers are hosted by Hetzner in Hillsboro, Oregon, in the United States. Some of our service providers process data in other countries. For example, PostHog processes our analytics data in the United States. If you use Diggit from outside the country where your data is processed, your information will be transferred to, stored in, and processed in that country, where privacy laws may be different from those in your country.

14.Do we make updates to this policy?

In short: Yes. We will update this policy as needed to stay accurate and to follow the law.

We may update this privacy policy from time to time. The updated version will show a new “Last updated” date at the top. If we make material changes, we will tell you by posting a clear notice in the Services or by sending you a message. We encourage you to review this policy often.

15.How can you contact us about this policy?

If you have questions or comments about this policy, email Diggit, Inc. at support@diggit.ai.

16.How can you review, update, or delete the data we collect from you?

Depending on the laws of your state or country, you may have the right to ask for access to the personal information we collect from you, details about how we have processed it, correction of inaccurate information, or deletion of your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some cases by law.

• To review or update your account information, go to your profile in the app.
• To get a copy of your data, email us at support@diggit.ai. We will provide it within 30 days.
• To delete your account, use Delete account in the app (see Section 10).
• For anything else, email us at support@diggit.ai.