Privacy Policy

Senku is a software-as-a-service estimating and project-management platform operated by SJ Tech Solutions LLC (“Senku,” “we,” “us,” or “our”) at senkulab.com. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. By creating an account or using the platform, you agree to the practices described here.

Information We Collect

• Account information.Your name, email, password (hashed), company name, address, phone, and (optionally) your trade and NJ Home Improvement Contractor registration details. Stored in Supabase.
• Customer data you upload.When you create estimates, you may enter your own customers’ names, addresses, phone numbers, emails, and photos of their property. You are the data controller for that information; Senku is the processor. We do not sell or share it.
• Payment data.We do not store payment-card numbers. Card data is collected by Stripe directly through embedded Checkout. Stripe shares back the last four digits, brand, expiry, and a token. See Stripe’s privacy policy.
• Usage data.Pages visited, referring URL, approximate city-level location, browser type, device, and session timing. Collected through Vercel Analytics (cookieless, privacy-friendly) and our own application logs.
• Communications.Emails and SMS sent through Senku are processed by Resend (email) and Twilio (SMS). We retain message content to power the inbox and audit history.

How We Use Information

• To provide the platform, including estimates, payments, scheduling, and communication tools.
• To draft AI-assisted estimate line items when you use the AI estimate feature (see “AI providers” below).
• To send transactional notifications (estimate accepted, payment received, subscription renewals).
• To detect abuse, prevent fraud, and meet legal obligations.
• To improve the product through aggregated, de-identified analytics.

We do not sell your data. We do not use your customer-data uploads to train AI models. We do not show third-party advertising on the platform.

Who We Share With

We only share data with third parties strictly necessary to operate the platform:

• Supabase — database, authentication, and file storage.
• Vercel — hosting and cookieless analytics.
• Stripe — payment processing (platform subscriptions and tenant-customer charges).
• Resend — outbound and inbound email delivery.
• Twilio — outbound and inbound SMS.
• AI providers (Anthropic, xAI) — only when you explicitly invoke an AI feature. The text of the request is sent to the provider; the response comes back to your account. We do not pass customer-portal photos or full estimates unless required by the specific AI action you invoke.
• OpenStreetMap / Nominatim — address geocoding only (street + city; no personal identifiers attached).

We may also disclose data when required by law (subpoena, court order) or to protect rights and safety. Where we do, we’ll attempt to notify the affected account unless legally prohibited.

Retention

We keep your account data for as long as your account is active. If you delete your account, we delete or de-identify personal data within 30 days, except where retention is required to comply with tax, payment-dispute, or other legal obligations (typically up to 7 years for payment records). Backups roll over within 30 days.

Your Rights

Depending on where you live, you may have rights to:

• Access the personal data we hold about you.
• Correct or update inaccurate data.
• Delete your data (with exceptions noted under Retention).
• Export your data in a portable format.
• Object to certain processing or withdraw consent.

To exercise any of these rights, email privacy@senkulab.com. We respond within 30 days.

California (CCPA/CPRA): we don’t sell personal information. You may request what we collect, how we use it, and that we delete it. EU/UK (GDPR): our lawful basis is contract performance for account data, legitimate interest for analytics, and consent for marketing email.

Cookies and Local Storage

We use first-party cookies for authentication, theme preference (dark/light mode), and CSRF protection. Vercel Analytics does not use cookies. We don’t run third-party advertising trackers. You can clear cookies from your browser at any time; doing so will sign you out.

Security

Data in transit is encrypted with TLS 1.2+. Customer-side Stripe secret keys are encrypted at rest with AES via our application. Database access is gated by row-level security policies that scope every read and write to the authenticated user’s tenant. We follow OWASP guidance on dependency hygiene, secret management, and incident response. No system is perfectly secure; if you believe you’ve discovered a vulnerability, see our security.txt.

Children

Senku is built for businesses; we do not knowingly collect data from anyone under 16. If you believe a child has provided personal data, email privacy@senkulab.com and we’ll delete it.

Changes

We’ll update this policy when our practices change. The “Last updated” date at the top reflects the most recent revision. Material changes will be announced via email or a banner in the app.

Contact

Questions: privacy@senkulab.com. Mailing address: SJ Tech Solutions LLC, Mays Landing, NJ.