Privacy policy

01 Who we are

National Lumber & Building Materials Co. is an independent Rhode Island corporation supplying framing takeoffs and building-material packages to contractors across New England. We operate online-first and do not run a walk-in yard. We are the party responsible for this website and for the plan files you send us.

Reach us at nationallumberri@gmail.com or 1-800-784-4206.

02 Site storage and tracking

The site uses storage and service requests needed for sign-in, saved projects, upload retries and abuse prevention. Firebase Authentication and App Check, and Stripe when checkout is enabled, also process information needed to provide their services. We do not describe these features as cookie-free or storage-free.

• The site does not install Google Analytics, advertising pixels, session recording or heatmaps.
• Typefaces are served with the site rather than requested from an external font service.
• We do not sell, rent or trade personal information.

03 What leaves your browser

The parameter-based planning estimate runs in your browser. Automated takeoffs contact our estimating service; submitting a project for review sends its drawings, contact details and simulation reference to our team.

04 Requests, accounts and messages

Website forms submit to our server. A received confirmation and reference mean the request has been saved. Plan files are uploaded to private cloud storage, and the server checks the complete file set before confirming the request. You do not need to open your own email app to complete a website submission.

We store the contact details and project information you provide, selected materials, document information, status changes, quotes and conversations so our team can respond and you can follow your work. Requests submitted while signed in can be associated with your account. Access to customer records is limited by account ownership and staff permissions.

Firebase Authentication handles account creation, sign-in, email verification and password reset. Our portal does not display account passwords. Signing out or clearing your browser does not erase records already saved to your account.

Confirmations, quote notices and message notifications are queued for delivery through our email provider when it is configured. A delivery delay does not remove the saved request. Email contains the recipient address and message content and is not end-to-end encrypted. Direct email links remain available as a separate way to contact us.

We use request information to prepare your takeoff, quote your package and follow up about that project. A takeoff request does not automatically subscribe you to an updates list.

05 Automated plan review

When you run the estimator at /estimate, the selected plan files are uploaded to private storage. Our estimating service retrieves supported files and sends them, together with the project information used for the read, to OpenAI's API. The returned measurements and material list are processed against our catalog.

Takeoffs require a verified account. Your project details and results are stored with your account and linked to the private upload session. When you send it for review, authorized staff can access the saved simulation and original drawings. Your project history lets you return to saved results and interrupted takeoffs. The uploaded drawings and any request you subsequently submit are separate stored records; they do not disappear when the analysis finishes.

OpenAI states that API data is not used to train its models unless the customer opts in. Its own retention rules, including abuse-monitoring retention, still apply. See OpenAI's current API data controls. If your drawings cannot be processed by an automated service, contact our team about the restriction before uploading them.

Line corrections

Changes to quantities and product matches can be stored to improve the assembly and matching rules. These records include a file hash, project type, model and pricing information, and the affected material lines. They do not include the original file, but material descriptions or other text may contain project information; we do not promise that these records are impossible to associate with a project.

Estimates and purchases

An automated takeoff does not place an order or issue a staff-approved quote. Review it with our estimating team before relying on its quantities. Payment for reviewed project proposals follows the process described in the terms.

06 What stays on your device

Your browser keeps working data such as your product list, unfinished form or upload details, dismissed notices, sign-in state and a signed identifier used for the takeoff allowance. Authentication tokens and request identifiers are sent back to the relevant service when needed to sign in, resume an upload or apply a usage limit.

Older workspace drafts and unsent changes may exist only in the browser where they were created. Clearing site data removes those local values and may sign you out. It does not delete submitted requests, uploaded files, cloud projects, saved reads, quotes, conversations or orders. Use your account to check which work has been saved before clearing local data.

07 Hosting, logs and abuse controls

Google Firebase and Google Cloud provide hosting, authentication, application functions, database and file storage. Service logs can include IP addresses, request times, requested resources, browser information, errors and operational identifiers. We use operational records to run the service and investigate failures or abuse.

The takeoff page also sends brief technical events when it opens and when an upload, analysis or review request starts, succeeds or fails. Each event includes a temporary browser-session code, an attempt code when available, a stage, a technical error code and limited file-count/size information. These diagnostic events do not contain drawing content, file names, contact details, project notes, authentication tokens or error-message text. Delivery may fail when the browser is offline or blocks the connection.

Firebase App Check with reCAPTCHA Enterprise protects supported public submission and estimating routes. Authentication protects account and staff functions. Takeoff limits use a signed visitor identifier and counters, including keyed hashes of IP addresses; infrastructure logs may separately record an IP address. These controls are not a claim that all activity is anonymous.

08 Service providers

• Google: Firebase Authentication, Hosting, Firestore, Cloud Functions, Cloud Storage and App Check provide account, application, storage and abuse-prevention services. See Firebase privacy and security information.
• OpenAI: processes files and project information you submit for an automated plan review, under its API data terms linked above.
• Stripe, when online payments are enabled: provides hosted checkout and payment-method management. Payment details are entered in Stripe's interface; our application stores order and payment-reference/status information, not full card numbers or card security codes. See Stripe Checkout.
• Resend, when notification delivery is enabled: receives recipient addresses and the notification content needed to send confirmations and updates. See Resend's privacy policy.
• Email providers: process messages you send to us directly and notifications delivered to your inbox.

09 How long we keep things

• Uploaded drawings: stored privately. Guest download links expire after 30 days; authenticated portal download links are short-lived. Link expiry by itself does not mean the underlying file or its request record has been deleted.
• Account, project and transaction records: saved requests, reads, conversations, quotes, orders and notification history remain in the service's business records. Clearing browser storage or removing a draft does not erase them.
• Operational data: quota records, correction records and logs follow their configured service retention. Our application does not currently promise one automatic deletion period for all of these records.
• Provider records and backups: follow the relevant provider's processes. A deletion request or an expired link does not guarantee immediate removal from all logs and backups.

Contact us about access, corrections or deletion for a particular account or project. Records needed for an active order, accounting, warranty or other applicable obligations may need to be retained.

10 Your choices

You can ask us what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. Email nationallumberri@gmail.com and we will respond. Where a law such as the Rhode Island Data Transparency and Privacy Protection Act gives you a stronger right than this paragraph, that law wins and you can hold us to it.

There is nothing to unsubscribe from unless you joined the updates list. If you did, tell us and you are off it.

One limit worth being straight about: we cannot delete a project record we need to keep for tax or warranty purposes, and we cannot reach into a third party's systems on your behalf. For anything OpenAI or Google holds, their own processes apply.

11 Children

This site sells building materials to construction businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child sent us something, email us and we will remove it.

12 Changes and contact

When this policy changes, the issue date and revision letter in the title block change with it. Material changes to what we collect or who processes it will be described here rather than folded in quietly.

Questions about this policy, or about a specific project's files:

National Lumber & Building Materials Co.
Rhode Island corporation, online-first
nationallumberri@gmail.com
1-800-784-4206

See also the Terms of Use (Sheet NL-91).