Effective date: 11/05/26

 

Who we are

 

Versacon AI LLC ("Versacon," "we," "us") is a Texas limited liability company. You can reach us at support@versacon.ai

 

What Versacon is

 

Versacon is construction project management software for subcontractors and general contractors, with AI document intake and an email assistant. It runs as an app inside Microsoft Teams, called Versacon, and can also be used from Outlook and the rest of Microsoft 365. It also includes an Outlook add-in, called Versacon Add-in, that reads the email you have open, when you ask it to.

 

This policy explains what information Versacon collects, how we use it, where it is stored, and the choices you and your company have.

 

Information we collect

 

From Microsoft sign-in. Versacon does not have its own username and password. You sign in with your organization's Microsoft account, through Microsoft Entra ID and Microsoft Teams single sign-on. When you sign in, Microsoft sends Versacon a signed token containing your display name, work email address (user principal name), your organization's Microsoft tenant ID, and your Microsoft user object ID. Versacon never sees or stores your password.

 

Information you or your company enter. Once signed in, Versacon stores the information your company enters to run its construction projects, including:

 

• Company profile: name, address, licence number, logo reference, tax rate, payment terms

• Users: name, email, role, title, phone number

• Projects, budgets, commitments and contracts, invoices, pay applications, change orders, RFIs, submittals, and daily logs

• Timesheets: worker names, hours, cost codes, and approvals

• Contractors directory and contacts: owners, general contractors, architects, and vendors

• Vendors

• The settings your company chooses within Versacon

• Billing information: the company's billing contact, plan, billing period, invoices and payment status. Card and bank details are collected and held by our payment processor, Stripe, not by Versacon. We keep Stripe's customer and subscription references so we can match payments to your company.

 

Documents and files - and where they live. Versacon generates documents, such as PDFs and Word files, and lets you upload photos and attachments. These files are not stored on Versacon's own servers. They are stored in your company's own Microsoft SharePoint site.

 

Versacon reaches SharePoint through Microsoft Graph, using permissions your Microsoft 365 administrator grants. Versacon only uses those permissions for the specific site and folder your company nominates, typically a folder called "Versacon Documents." In its own database, Versacon keeps only a reference to each file - an identifier and a link - not the file's content. Your Microsoft 365 administrator can revoke Versacon's access at any time in Microsoft Entra.

 

When you use Versacon's AI features. Some features use Anthropic's Claude API, an AI service, to read and draft for you. They run only when someone in your company uses one of them:

 

• Reading a file or an email: a file you drop into Versacon in Teams or in the Outlook add-in, or the email open in Outlook when you ask Versacon to read it. The file's content, or the email's text and the attachments you choose, are sent to Anthropic. Nothing else in the mailbox is sent.

• "Describe what you want" on a new record: the words you type, with the chosen project's name, number, owner and location.

• Improving a scope, or suggesting inclusions and exclusions: the scope text you typed.

• A suggested follow-up reply: facts from the record it follows up on and, if your company has turned on reading emails, the email it answers. Versacon only drafts the reply - it never sends it.

• Asking questions about something Versacon read: your questions and what was read.

 

The content is sent to Anthropic, which processes it for us as a subprocessor, only to return the result to Versacon. Under Anthropic's commercial terms, Anthropic may not train its models on it. Under Anthropic's standard terms it deletes inputs and outputs from its systems within 30 days, except where it needs to keep them to enforce its usage policy or the law requires it (Anthropic, privacy.claude.com, read 26 October 2026). Reading files and emails, and "Describe what you want", are off until your company's administrator turns them on - for the company and for each person - and a monthly limit applies. Versacon does not send your data to an AI provider in the background, or without one of these actions.

 

Automatically - logs. Versacon keeps operational logs recording who did what and when: your email address, your company, the action taken, timestamps, and any errors. For AI features we record which feature was used and how much it was used - not the content. These logs are used for security, billing and troubleshooting.

 

Website cookies. Our marketing website, versacon.ai, is built on Wix. Wix sets its own cookies on that site for site operation and analytics. This is separate from the Versacon application itself, which you reach through Microsoft Teams.

 

QuickBooks Online

 

This section applies only if your company connects QuickBooks Online to Versacon.

 

What Versacon asks Intuit for. Accounting access to the one QuickBooks company your Admin connects - nothing else. Not payments, not payroll, not your Intuit sign-in details. Versacon never sees your Intuit password.

 

Why. Versacon uses QuickBooks data only to run the connection for your company: to send the records your people choose to QuickBooks, and to show in Versacon where each one stands. It is not used for anything else.

 

What Versacon writes to QuickBooks - only when a person your company allows presses Push: a customer or job for a project, invoices, estimates, credit memos, purchase orders, vendors and items. With bill approvals on, it also writes to a bill itself: one line in the bill's private note - who approved or rejected it, and when - and the approval record as a PDF attached to the bill once every part of it is answered. If the bill then changes in QuickBooks, that line is changed to say so. Nothing else on the bill is changed.

 

What Versacon reads from QuickBooks:

 

• changes to the records it sent - for example, that an invoice was paid - so Versacon can show where each one stands;

• your customers, vendors, items, classes, locations and accounts, so your Admin can match them to Versacon's while setting up;

• with bill approvals on, the bills entered in QuickBooks from that day on, to ask your approvers for their answer.

 

What Versacon keeps, and for how long:

 

• the name and plan of the QuickBooks company you connected;

• for each record it sent: QuickBooks' ID and number for it, and its totals and balance;

• a log of each push, with a backup so it can be undone;

• your setup choices and its matching suggestions;

• with bill approvals on, the bill approvals and their history;

• the access keys Intuit issues for the connection, encrypted (AES-256). They are never shown to anyone and never written to a log.

 

Matching drafts are deleted after 7 days. The rest is kept while you use QuickBooks with Versacon, and after a disconnect, until you delete it or your company leaves Versacon. Versacon's encrypted backups keep a copy of everything in the database for up to 365 days, deleted data included; backups are used only to restore the service.

 

What Versacon never does with QuickBooks data:

 

• it never sells it;

• it never shares it with another Versacon customer, or with anyone else - only the providers that store it for Versacon (Google Cloud and Supabase) hold it;

• it never sends it to an AI service, so Anthropic never receives it;

• it never sends it to Stripe, our payment processor, or to our website provider;

• it never uses it for advertising.

 

Intuit's role. QuickBooks is your company's own account with Intuit, under your own agreement with Intuit. Versacon handles your QuickBooks data for your company. It does not process it on Intuit's behalf, and Intuit is not one of the providers that process data for Versacon.

 

Who can see it:

 

• your own people, by their role in Versacon;

• Versacon staff see only whether the connection is working - never your QuickBooks records. A Versacon support session, which your company must allow, needs multi-factor sign-in and cannot change anything in QuickBooks.

 

Where it is kept: in the United States - Google Cloud (us-central1) and Supabase (AWS us-west-2), the same places as the rest of your Versacon data (see "Where it is stored and who processes it").

 

Disconnecting: in Versacon (Setup > QuickBooks > Disconnect from QuickBooks) or in QuickBooks (Manage integrations). Versacon stops reading and writing at once, and tells Intuit to end its access.

 

Deleting it: a company Admin opens Setup > QuickBooks and presses Delete QuickBooks data. Versacon ends its access at Intuit first, then deletes everything listed under "What Versacon keeps". Your company's own Versacon records stay, and nothing in QuickBooks is changed. If no Admin can do it, email support@versacon.ai and we will do it within 30 days. If your company leaves Versacon, its QuickBooks data is deleted with the rest of its data on request. Backup copies expire within 365 days.

 

How we use this information

 

We use the information above to:

 

• Run and operate the Versacon service for you and your company

• Keep the service and your data secure

• Provide support when you contact us

• Bill your company for its subscription

• Meet our legal and accounting obligations

 

Where it is stored and who processes it

 

Versacon's database - everything listed under "Information you or your company enter" above - is a cloud Postgres database hosted by Supabase in the United States (Amazon Web Services, Oregon).

 

Versacon's application servers run on Google Cloud (Cloud Run) in the United States. Google Cloud also stores our operational logs, encrypted daily database backups kept for up to 365 days, and files waiting to be read by an AI feature, which are deleted after about a day.

​

What Versacon read for you. When you ask Versacon to read an email or a file, it keeps what it read - the text, the summary it wrote and any questions you asked about it - with your company's other Versacon data, so you can come back to it. Versacon does not copy your mailbox: the email itself stays in Outlook. A record made from an email keeps the email's subject, sender, date, a short summary and a link back to the email. When someone in your company asks Versacon to read an email, we keep that email's subject, date, sender, and To and Cc addresses with the read, so a reply can go to the same people. They are kept for as long as the read is, and shown only to people who may open it. A read is kept until the person who asked for it, or your company's administrator, deletes it in Versacon with "Delete this read". Deleting a read removes its text, summary and questions for good; Versacon keeps only who deleted it and when. Otherwise it is kept like the rest of your company's data, as described under "Retention and deletion" below.

 

Your documents and files are stored in your company's own Microsoft SharePoint, accessed through Microsoft Graph as described above.

 

We also use Google Workspace for Versacon's own company email, and Wix to host our marketing website.

​

Subscription payments are processed by Stripe, Inc. in the United States. When your company starts a trial or an administrator manages billing, Versacon opens Stripe-hosted pages (checkout.stripe.com and billing.stripe.com), and payment details go directly to Stripe. Stripe's privacy policy is at stripe.com/privacy.

 

In short, the providers that process data on Versacon's behalf are: Microsoft (Entra ID, Teams, Microsoft Graph and SharePoint), Google Cloud (application hosting, logs, backups, files waiting to be read), Supabase (database), Anthropic (subprocessor for the AI features described above: it processes the files, email text and attachments you send to Versacon's reader), Stripe, Inc. - subscription payments and invoices (United States), Google Workspace (our email), and Wix (our website).

 

Sharing

 

We do not sell or rent your data, and we do not show advertising in Versacon. We share information only:

 

• With the providers listed above, so they can host and run the service

• Within your own company, according to each user's role - for example, an Admin can see more than a Field user

• When required by law, such as in response to a valid legal request

 

Security

 

• All data is encrypted in transit (TLS) and at rest, by the providers listed above

• Every request to Versacon is authenticated using a Microsoft-signed token

• Data is kept separate by company

• Access is controlled by role, and this is enforced by the service itself, not only by what a screen shows

 

Retention and deletion

 

We keep your company's data for as long as your subscription is active, plus a short wind-down period afterward. If your company's administrator asks us in writing to delete your data, we will do so within 30 days; backup copies age out within 365 days after that. Some records - for example, those needed for tax or accounting purposes - may be kept longer where the law requires it.

 

Your choices and rights

 

• Your company's administrator can access, correct, export, or delete your company's data by emailing support@versacon.ai

• Your company's administrator can turn Versacon's AI reading features off, for the company or for any person

• If you are an individual user and want your own information corrected or removed, please ask your company's administrator first - they control access to your company's Versacon account

• Your Microsoft 365 administrator can revoke Versacon's access to your SharePoint at any time, in Microsoft Entra

 

Children

 

Versacon is a business product for construction companies. It is not directed at children, and we do not knowingly create accounts for anyone under 16.

 

Changes to this policy

 

We may update this policy from time to time. If we make a material change, we will update the effective date above and, where appropriate, let your company's administrator know.

 

Contact

 

Questions about this policy? Email us at support@versacon.ai