Privacy Notice

Some customers use our Services through an AI Assistant rather than through our own web or mobile interface. To support that, we make available an MCP server that lets an AI Assistant you have authorized carry out a defined set of operations on your behalf. These integrations reach the data held in our Takeoff & Estimate solution, which we host in the United States, together with STACK’s own product reference documentation, which contains no information about you. This section explains how that works and what it means for your information, and applies in addition to the rest of this notice.

How the connection is established. We issue the credentials for this integration ourselves. The AI Assistant does not vouch for who you are, and we receive no identity assertion, profile, or sign-in information about you from it. Instead, you sign in to STACK with your own STACK credentials and existing session, you choose which specific operations the AI Assistant may perform, and we then issue an access credential to it. That credential identifies your internal STACK user and company identifiers, the AI Assistant, the permissions you granted, and the specific list of operations you consented to. It does not contain your email address. We never receive your STACK password, and we do not receive or ask for authentication codes, API keys, or other authentication secrets through the integration. We also receive registration details about the AI Assistant software itself, such as its name and the addresses of its own terms and policies; that information identifies the software, not you.

What each operation accepts. Each operation accepts only the inputs it needs to do its job. Those inputs are record identifiers, search and filter terms, and structured parameters defined in advance; no operation asks for general background or conversational context. Two inputs are free text: the words you search for, and the description of what you are looking for when searching our product reference documentation. As with free-text fields elsewhere in the Services, please do not put sensitive personal information there. Operations that report on estimate data are composed from a predefined query structure we control; an AI Assistant cannot supply its own database query. The operations available let you and an AI Assistant you authorize:

• Find, look up, and search projects, takeoffs, and estimates, including takeoffs saved in your company’s library. Project results include the names of the users assigned to each project.
• Read estimate and pricing information, and run predefined estimate reports.
• Read company configuration options, tags, and labels.
• Create and update projects, including the jobsite address fields for a project. An update replaces the project setup values it names.
• Create new takeoffs on a project, and edit existing takeoffs, including replacing their current values.
• Save copies of a project’s takeoffs to your company’s library, and import takeoffs from that library into a project.
• Create tags in your company’s library, and assign tags to library takeoffs, which replaces any tags previously assigned to them.
• Import your company’s labels for use on projects.
• Search and read STACK’s own product reference documentation, which describes our Services and contains no information about you.
• Return your own profile information when you ask for it, which consists of your display name, your email address, and your company.

What an AI Assistant can change. Some of these operations write to your account, and some replace information that is already there. An AI Assistant you have authorized can create projects, takeoffs, library entries, and tag vocabularies; copy takeoffs between a project and your company’s library; and overwrite existing records, including renaming projects and takeoffs, changing bid dates, statuses, privacy settings, notes, and addresses, and setting or clearing tag values. It can only carry out the specific operations you consented to when you authorized it, and only where you already hold the underlying permission in STACK.

What we return. A response returns the records and fields you asked for, drawn from the categories above. Some operations return a record as a whole rather than a selected set of fields, so a response may carry every field that record holds, including any label and tag groups your organization has defined on it. Where a response is drawn from a stored snapshot of an estimate that is no longer current, we also tell you that it is out of date. We do not include credentials, authentication secrets, or internal diagnostic metadata such as session, trace, or request identifiers in a response.

What we do not receive or collect. Our MCP server has no technical means to ask an AI Assistant for the contents of your conversation, and it does not do so. It sees only the parameters of the operation you invoked, and we make no attempt to obtain, reconstruct, or infer anything more. No operation accepts device location, GPS coordinates, or any other geolocation input; where an operation accepts a street address, that address describes the jobsite for a project and not you. We do receive the IP address your request comes from, as any web service does, and we use it to apply rate limits and to protect the Services rather than to determine where you are. No operation is designed to collect or return payment card data, protected health information, government identifiers such as social security numbers, or access credentials, and you should not enter that kind of information into free-text fields such as project names or labels.

How we log these requests. We deliberately do not write the contents of an operation’s parameters to our logs, because those parameters may contain personal information. We log the identifiers and outcome described under “Service and request logs” above instead. In one narrow case, where a request is rejected because it fails validation, the resulting error record may include a shortened excerpt of the value that was rejected.

Who receives it. The AI Assistant you authorized receives the response we return, because that is how the result reaches you. That includes any personal information the records you asked for happen to contain. Project results carry the names of the users assigned to each project; a request for your own profile returns your name, email address, and company; and free-text fields such as project notes carry whatever your organization recorded in them, which may include details of colleagues, subcontractors, suppliers, or clients. Some of those people will not have authorized the connection themselves. It handles that information under its own privacy policy and terms, which we do not control, and we encourage you to read them. Beyond that, information from these integrations is shared only with the categories of recipients described in “Who we share your information with” below. We do not sell information we receive through these integrations, we do not share it for advertising purposes, and we do not use it to build advertising or behavioral profiles.

Your controls. You choose which operations an AI Assistant may perform at the time you authorize it, and we record and enforce that choice. Your permissions are checked twice on every action: the AI Assistant can only attempt the operations you consented to, and we separately re-check that you still hold the underlying permission in STACK at the moment the action runs. If that permission is removed in STACK, access through the integration stops immediately rather than at the next credential renewal. You can review and revoke any connection at any time from the Connected Apps page in your STACK account, and the AI Assistant software can also revoke its own credential. Once you revoke a connection, requests for your data fail on the next attempt, and the credential itself expires in full within one hour. Your organization can also stop using these integrations at the company level, which prevents further access from being renewed. Revoking a connection does not by itself delete information we already hold; to ask us to delete it, see “How can I control my personal information?” below.