Privacy Policy

Effective: 19 September 2026 · Last updated: 8 October 2026

Eave Desk is a building design, sales, and takeoff platform for post-frame building companies, operated by Columbia Groundwork Inc., doing business as Columbia Data Group ("Eave Desk," "we," "us"). This policy explains what we do with personal information, stated plainly.

1. Who this policy covers

Three groups of people:

• Buyers. Anyone who designs, views, prices, or requests a quote on a building using a designer that a building company publishes on Eave Desk. You will usually see that company's name and logo, not ours. If that is you, read section 2 first.
• Building company users. Staff of a company that subscribes to Eave Desk: owners, administrators, managers, sales staff, estimators, and any engineer the company invites to review a design.
• Website visitors and prospects. Anyone who visits eavedesk.com or contacts us about the product.

2. If you are a Buyer: the building company is collecting your details, on our software

When you open a building designer, the company whose name is on the page (the "Company") is the one offering you the building, choosing what you can pick, choosing what prices you see, and deciding whether to ask for your contact details before you can open or save a design. Everything you enter goes into that Company's account.

We run the software. The Company is the controller of your information, and we process it only on the Company's behalf and instructions. We do not sell it, we do not use it to market to you, and we do not share it with any other building company, including any construction business affiliated with us.

To see, correct, or delete your information, contact the Company. Their contact details are on the designer page. If you contact us instead, we will forward your request to the Company within 5 business days and help them respond.

3. Our two roles

• We are the controller for website visitors, prospects, and the people who administer a Company account and its billing. We decide why and how that information is used, and this policy governs it directly.
• We are a processor (a "service provider" under state privacy law) for everything a Company and its Buyers put into that Company's account: designs, leads, customers, projects, prices, files, and quotes. The Company is the controller. We act on its documented instructions under our agreement with it.

4. Information we collect

From Buyers, on a Company's designer

• Contact details, if the Company asks for them. A name, email, and phone number, and sometimes an organization, preferred contact method, and mailing address, entered at a lead gate before opening or saving a design, or when requesting a quote. The Company decides whether and when to ask.
• Your design. The building you draw: dimensions, style, openings, colors, options. Design geometry is stored separately from your identity and contains no personal information on its own.
• Project details, if you provide them. A building site address, region, and postal code, and any notes you type into a quote request.
• A visitor cookie. A random identifier set in your browser for one year, stored on our side only as a hash, so that you can return to a design you saved and so the Company can count how many distinct visitors opened its designer. It is not used for advertising and is not shared with anyone.
• A recovery secret, if you save a design. A private link and, if you set one, a recovery key so you can get back to your design from another browser. The key is stored as a hash.
• Emails the Company sends you through Eave Desk. A quote, a document package, or a portal link, with its delivery status.

From building company users

• Account data. Email, role, display name, and authentication data. Passwords are stored only as salted hashes, never in readable form. Invitations and sessions.
• Work data. Leads, customers, projects, tasks, notes, files, price books, estimates, quotes, engineering requests, and the audit trail of who did what and when.
• API keys. Keys a Company administrator creates for integrations, stored as hashes, with a request log that records what resource was touched and when, never the request contents.
• Interface preferences. Theme and saved list views.

From website visitors and prospects

• What you send us. Name, work email, company, phone, and message, if you contact us or request a demonstration.
• Technical data. IP address, browser and device type, pages viewed, referring page, and timestamps, collected by our website host. SiteGround hosts eavedesk.com in the United States. When demo requests are enabled, HubSpot receives the submitted contact details and records visit analytics, including pages viewed and traffic sources, and can connect those visits to a submitted demo request.

We do not knowingly collect health information, government identification numbers, or payment card numbers anywhere in the Service. Card and bank details for a Company's subscription are entered only on Stripe's payment forms and never reach us. We add no card surcharge and offer no bank-debit discount.

5. How we use information

We use personal information to:

• Publish each Company's designer, save Buyer designs, and deliver quotes, packages, and portal links the Company or the Buyer asked for.
• Provide, operate, secure, and support the platform, and authenticate users.
• Give a Company its own analytics: how many people opened its designer, saved a design, or requested a quote, by traffic source. Source labels contain no contact data. We do not build analytics across Companies.
• Respond to demonstration requests, sales questions, and support requests.
• Bill subscriptions and process payments.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Improve reliability and performance using aggregated or de-identified usage data that does not identify any person, Company, or price.
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Company or Buyer data to train models for other customers. We do not make automated decisions about you that have legal or similarly significant effects. A budget figure a designer shows you is computed from the Company's own price list, not from anything about you.

6. The construction business we are affiliated with

Columbia Data Group is a trade name of a company that also operates a post-frame construction business. We keep a firewall between the two. A Company's leads, Buyer details, price books, and margins are that Company's confidential information. We do not use them for, or disclose them to, our affiliated construction business, and we do not use them to compete with a Company for a Buyer. People with access to production data are bound to that in writing. Where the affiliated construction business uses Eave Desk, it does so as a customer under its own account with no access to any other Company's account.

7. When we share information

We share personal information only in these situations:

• Within the Company's account. The platform shows a Company's data to that Company's users according to their roles. Buyers see only their own designs, quotes, and portal.
• With the Company's reviewers. If a Company sends a design for engineering review, the packet goes to the reviewer the Company named.
• Subprocessors. Vendors that run infrastructure on our behalf, listed in section 8, under contracts that limit them to our instructions.
• Systems the Company connects. If a Company connects Eave Desk to its own software through our integration API, data flows to that software on the Company's instruction and under its own contracts.
• Legal requirements. When we are legally compelled. We notify the affected Company unless the law forbids it, direct the requester to the Company where we can, challenge demands that are overbroad, and disclose only the minimum required.
• Business transfer. If Eave Desk is acquired or merged, information transfers with the business, subject to this policy.

8. Subprocessors

The vendors below process personal information on our behalf. The list is accurate as of the last updated date, and we update it when it changes.

Companies that want advance notice of subprocessor changes receive it under our Data Processing Addendum.

9. Cookies and tracking

Inside the platform and on Company designers we use only:

• A session cookie for signed-in Company users, so you stay signed in. HTTP-only.
• A visitor cookie on Company designers, described in section 4, so you can return to a saved design and the Company can count distinct visitors. HTTP-only, one year.
• Local storage for interface preferences such as theme.

There is no advertising tracking in the product, and no third-party analytics script runs on a Company's designer.

On eavedesk.com we use strictly necessary cookies for security and forms. When demo requests are enabled, HubSpot analytics cookies identify visits and connect submitted demo requests to their sources. We do not use advertising pixels. The website can be used without the HubSpot cookies.

You can block or delete cookies in your browser. Blocking the session cookie will break sign-in; blocking the visitor cookie means a design you save may not be recoverable from that browser without your private link or recovery key. We honor Global Privacy Control signals where the law requires it. Browser "Do Not Track" signals have no agreed standard and we do not respond to them separately.

10. How long we keep information

• Company account data is kept for as long as the subscription is active, subject to any retention period the Company sets per data class in its own settings. Each Company can set how long it keeps designs, contacts and leads, packages, delivered files, sent emails, and audit records; the default is to keep them until the Company deletes them.
• After a subscription ends, the account is read-only for 30 days so the Company can export its data, and we delete it within 60 days after that, except where the law requires longer.
• Removed records are recoverable by the Company for 30 days after removal, then purged.
• Design geometry is stored immutably. When a design is deleted, its link to any person is severed and it disappears from every list, link, and export; the anonymous shape itself may persist.
• Website leads are kept until you ask us to delete them or they go stale, whichever comes first.
• Billing records are kept as long as tax and accounting law requires.

Backups age out on their own cycle, so deleted data can persist in backups for a short period before being overwritten.

11. How we protect information

• Role-based access control with capability checks; a permission that was not granted does not exist.
• Company isolation enforced in the database, so one Company's data is not reachable from another's.
• Encryption in transit. Passwords and API secrets stored only as salted hashes.
• Immutable design revisions and an audit trail with actor and timestamp.
• Session management with revocation. Rate limiting on sign-in, recovery, and the API.
• Secret links for Buyer pages, with expiring links for released files.

No system is perfectly secure. If a breach affects your information we will notify affected Companies, and regulators where required, as the law requires. We say plainly that we hold no third-party security certification today and that multi-factor authentication is not yet available; ask us and we will tell you exactly where we stand.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to opt out of sale or sharing (we do neither), to limit the use of sensitive information (we collect none by design), and to be free from discrimination for exercising these rights.

• Data in a Company's account, including everything you entered as a Buyer: contact that Company. We will help them respond.
• Data we control (website leads, our own account and billing contacts): email privacy@eavedesk.com. We will verify your identity before acting.
• Marketing email from us: unsubscribe from any marketing message. Operational messages about a Company's account and billing are part of the service.
• Emails a Company sends you through Eave Desk: those are the Company's messages. Ask the Company to stop, and tell us if they do not.
• How requests work: we acknowledge within 10 business days and respond within 45 days, extendable once by 45 days where the law allows, and we will tell you if we extend. An authorized agent may submit a request for you with written permission we can verify.

You may appeal a denied request by replying to our decision, and you may complain to your state attorney general or supervisory authority.

13. Children

Eave Desk is a business tool, and a Company's designer is for people shopping for a building. Neither is directed to children. We do not knowingly collect personal information from anyone under 18 as a user of the platform, or from anyone under 13 as a Buyer. If you believe a child has entered contact details on a Company's designer, tell the Company or email privacy@eavedesk.com and the record will be deleted.

14. International visitors

Eave Desk is operated from the United States and processes information there. If you use the service from outside the United States, you are sending information to the United States, where privacy law differs from your own. We offer the Service to businesses in the United States.

15. Changes to this policy

We will update this page when our practices change and revise the "last updated" date. For material changes affecting Companies, we will give notice through the platform or by email before the change takes effect.

16. Contact us

Privacy questions, requests, and complaints:

• Email: privacy@eavedesk.com
• Mail: Columbia Groundwork Inc., P.O. Box 1855, Castle Rock, WA 98611

If you are a Buyer, the building company whose designer you used is your first contact, and its details are on that page.