Privacy Notice
Version 1.0 · Effective date: November 11, 2026
This notice explains how Brooks Building Solutions, Inc. ("Brooks", "we") handles personal information in CADdy-Hub ("the Hub") about people who are not Brooks employees:
- external users: people at subcontractor companies who sign in to the Hub;
- customer contacts: people whose names, details or signatures are recorded on jobs;
- email correspondents: people whose emails a Brooks employee links to a job;
- vendor contacts and outside engineers and reviewers.
Brooks employees: see the Workforce Privacy Notice instead.
1. Two roles: when Brooks decides, and when your company decides
- Data a subcontractor company puts in the Hub about its own customers and contacts belongs to that company ("Company Personal Data," as defined in the Data Processing Addendum). Brooks handles it only on the company's behalf, under the Data Processing Addendum. If your information is in the Hub because another subcontractor put it there, contact that company about it. If you contact us, we will pass your request to them.
- Everything else in this notice is handled by Brooks for its own business, and Brooks is responsible for it.
2. What we collect, and where it comes from
| Who | What | Source |
|---|---|---|
| External users | Name, work email, company, role, admin status, sign-in password (stored only as a one-way hash), sign-in settings such as email codes, last sign-in time, hourly activity (the hours you used the Hub and how often), what you enter (projects, schedules, calendar items, files, photos), and a record of your acceptance of these documents with the date, time, IP address and browser user agent | You, your company's Hub admin, Brooks admins, and the Hub automatically |
| Customer contacts | Name and contact details on jobs; signatures drawn on service visit and checkout reports, with printed name and date | Brooks staff or subcontractor users; you, when you sign |
| Email correspondents | For an email linked to a job: sender, recipients, subject, date and a short preview (up to 1,000 characters). The full message and attachments are read live from the linking employee's Microsoft mailbox when someone opens them. | The Brooks employee's Outlook mailbox, through Microsoft Graph |
| Vendor contacts | Name, email, phone, company and addresses | Brooks staff |
| Engineers and reviewers | Name, email and review status on submittals | Brooks staff; CADdy-Lite |
| Anyone in uploaded files or photos | Whatever the file shows. Photos keep their original data, which may include GPS location, date and device. The Hub does not remove it. | Whoever uploads the file |
We also get job and customer details from BuildOps, the field service and accounting system Brooks uses.
3. Why we use it
- To run jobs with our customers, subcontractors and vendors: schedule, order, build, check out, service and document the work.
- To give external users access to the Hub and keep it secure.
- To keep records of work done and who approved or signed it.
- To meet legal and contract duties and handle disputes.
4. Who sees it and who receives it
- Brooks staff see what their role allows. An email linked to a job can be read by every signed-in Brooks Hub user, including its attachments. External users cannot see linked emails.
- External users see only their own company's jobs.
- Service providers that run the Hub for us: Microsoft (hosting, storage, sign-in and email), Anthropic (AI features) and the other Brooks systems listed on the Subprocessors page.
- Report and purchase-order recipients: service reports with signatures go to the people the report is sent to, and vendor details print on purchase orders.
- Others when required: if the law requires it, to protect people or property, or in a sale or reorganization of the business.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
5. AI processing
Some Hub features send documents and text to Anthropic's AI model to read them and draft content. These include purchasing documents, re-estimate workbooks, sequence-of-operations pages and controls schematics (as images), drawings and schedules, and inventory item facts. These documents can contain names and contact details. For each job, the AI features that read that job's documents can be turned off.
6. How long we keep it
See the Data Retention Schedule. For example, signatures and service reports are kept as long as the contract for the job requires, and hourly activity for 13 months. Other data is kept while the job or account is active and as long as needed for the purposes above.
7. How we protect it
Traffic to the Hub is encrypted (HTTPS, with HTTP Strict Transport Security). Data is stored encrypted in Microsoft Azure, with automated backups. External sign-ins use hashed passwords, rate limits, lockout and optional email codes. Access depends on role and company. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.
8. Cookies and tracking
The Hub uses only four cookies, all set by the Hub itself and all strictly necessary:
| Cookie | What it does | How long |
|---|---|---|
hub_token | Keeps you signed in | Ends after 12 hours without use |
hub_oauth_state | Protects the Microsoft sign-in step | 10 minutes |
postLoginRedirect | Returns you to the page you asked for after sign-in | 10 minutes |
viewas | Used only by Brooks super admins to preview the Hub as another role or user | Until the preview ends or the browser closes |
The Hub also saves some display settings in your browser's local storage, so pages look the way you left them. These are not used for tracking.
There are no advertising cookies, analytics, tracking pixels, session recording or social media plugins. Because no cookie is optional, there is no cookie banner.
Do Not Track and Global Privacy Control. We do not track you across websites, so there is nothing to opt out of. Because we do not sell or share personal information, a Global Privacy Control signal from your browser is honored by default.
9. Children
The Hub is a work tool for businesses. It is not meant for children, and we do not knowingly collect information from anyone under 16.
10. Your choices and rights
Most of Brooks's users and contacts are in Florida. Some state laws (for example California's) give people rights to know, access, correct and delete their personal information, and to not be discriminated against for using those rights. These rights apply only where the law applies. If Brooks ever holds information about residents of such a state and is conducting business within that state, it will honor their rights under that state's law.
You may always ask us what we hold about you, or ask us to correct it.
How to make a request:
- Email mrubio@brookssolutions.net, or
- write to Brooks Building Solutions, Inc., 4501 Beverly Ave, Jacksonville, FL 32210.
We will confirm who you are before we act, usually by replying to an email address we already have for you or by asking for details that match our records. An authorized agent may make a request for you with your signed permission. We will answer within 45 days, and tell you if we need more time where the law allows it. If your information is in the Hub because a subcontractor put it there, we will send your request to that company (see Section 1 above).
11. Changes
We will post changes here with a new version and date, and list them in the change log. If a change is material, external users will be asked to accept the new version at their next sign-in.
12. Contact
Brooks Building Solutions, Inc. 4501 Beverly Ave, Jacksonville, FL 32210 mrubio@brookssolutions.net
Change log
- 1.0 – first version