Privacy Policy

MagicBuild is operated by 2FLY Digital Marketing. For contractors and their crew we are the service provider for their business data. For clients who receive a link, the contractor decides what to collect and why; we process it on the contractor’s behalf. Either way, you can reach us at hello@2flydigital.com.

From contractors and crew: name, email, phone, business details (address, license, insurance wording, logo), the records you create (leads, estimates, photos, videos and voice notes taken on site, invoices, expenses and receipts, crew hours), and your settings.

From clients (entered by the contractor or by the client on a link): name, phone, email, job and billing address, what the client did on their link (opened, downloaded, approved, declined), the drawn signature, and — when a document is signed — the date and time, internet address and device type, kept as the signing record.

Location: crew members who allow it share their phone’s location while the app is open so it can prompt them to check in when they reach a job and check out when they leave. We keep the check-in and check-out times and the job site’s coordinates; we don’t keep a location history or track anyone with the app closed.

Automatically: device and browser type, rough region from your internet address, and app usage needed to keep the service secure and working. Push-notification tokens if you turn notifications on.

Never: card or bank numbers. Payments are entered directly with Stripe; we only receive the result (paid, amount, last four digits where Stripe provides them).

• To run the app: build and deliver estimates, contracts and invoices, take payments, sync with services you connect, schedule crew and record hours.
• To send the emails and notifications you or the contractor asked for — an estimate to a client, a reminder about an overdue invoice, a check-in nudge to a crew member.
• To power AI features: photos, video, voice notes and text you provide are sent to an AI model to draft estimates, read receipts and answer questions. We use providers that don’t train on this data.
• To keep the service secure, prevent abuse, and fix problems.
• To tell account holders about changes to the service. We don’t send marketing to clients of contractors.

We share personal information only with services that help us run MagicBuild, under contracts that limit what they can do with it:

• Hosting and database (Vercel, Supabase) — everything the app stores.
• Email delivery (Resend) — addresses and the documents sent to them.
• Payments (Stripe) — payer and payee details needed to move money.
• Accounting (Intuit QuickBooks) — only when a contractor connects it, and only the customers, invoices, payments and expenses they choose to sync.
• AI providers (through Vercel AI Gateway) — the content submitted for an estimate or receipt scan.
• Maps (OpenStreetMap Nominatim) — job addresses, to find the site on a map for crew directions.

We also share when the law requires it, to protect someone’s safety, or as part of a sale of the business (you’d be told first). We don’t sell personal information and we don’t share it for advertising.

A contractor sees everything their clients do on a link — that’s the point of tracking. A client can ask the contractor what is held about them; the contractor can export or delete it from the app, or ask us to. If you are a client and can’t reach the contractor, email hello@2flydigital.com and we’ll help.

• Account and business records: while the account is open, and for 30 days after it’s closed so it can be restored by mistake — then deleted.
• Signed contracts and invoices: contractors may need these for tax and legal reasons, so they stay with the contractor’s records as above. The contractor can delete them earlier.
• Email delivery logs and push tokens: up to 12 months.
• Backups: rolling, overwritten within 30 days.

• See, correct or export your data from the app, or by asking us.
• Delete your account and its data from Settings, or by email. We confirm when it’s done.
• Turn notifications and location off any time in your phone’s settings; the app keeps working with a tap instead.
• Opt out of automatic client reminders in Settings › Reminders.

If you live in California, the EU/UK or another place with privacy laws, you may have additional rights (access, deletion, portability, objection). Email hello@2flydigital.com and we’ll respond within 30 days. We don’t discriminate against anyone for exercising their rights.

Data is encrypted in transit and at rest with our hosting providers. Sign-in uses one-time codes rather than passwords. Access to production data inside 2FLY Digital Marketing is limited to the people who need it to run the service. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the authorities as the law requires.

MagicBuild is for businesses and their adult clients. We don’t knowingly collect information from anyone under 18; if you think we have, tell us and we’ll remove it.

Our servers are in the United States. If you use MagicBuild from elsewhere, your information is transferred to and processed in the U.S.

When this policy changes we update the date at the top. For material changes we notify account holders by email or in the app before they take effect.