Who We Are

CSH-HUB LLC ("CSH-HUB," "we," "us," or "our") is a Delaware limited liability company headquartered in Smyrna, Tennessee. We operate a cloud-based construction management platform at csh-hub.com and platform.csh-hub.com that serves general contractors, subcontractors, architecture firms, engineering firms, and other construction industry professionals.

This Privacy Policy applies to all users of the CSH-HUB platform, website, mobile application, and related services (collectively, the "Services"). By using our Services, you agree to the collection and use of information as described in this policy.

For questions about this policy or your data, contact: kimrichardson@csh-hub.com

Information We Collect

Information You Provide Directly

• Account information: Name, email address, company name, job title, phone number, and password when you register
• Business information: Company address, EIN/tax identification number, business license details, NAICS codes, SAM.gov registration data
• Employee and payroll data: Employee names, Social Security Numbers (SSNs), addresses, bank account details for direct deposit, wage and hour information, tax withholding elections (W-4), employment classifications
• Financial data: Invoice information, accounts payable and receivable records, bank transaction data, expense receipts, job costing entries
• Project data: Project names, addresses, contract values, RFIs, submittals, documents, photos, and communications uploaded to the platform
• Vendor and subcontractor data: Vendor company names, contacts, tax ID numbers (1099 data), insurance certificates, contract data

Information Collected Automatically

• Usage data: Pages visited, features used, time spent, actions taken within the platform
• Device information: IP address, browser type, operating system, device identifiers
• Log data: Server logs, error reports, performance data
• Cookies and similar technologies: Session tokens, authentication cookies (see Section 9)

Information from Third Parties

• Bank and financial institutions (via Plaid): Bank account details, transaction history, and account balances when you connect your bank accounts through our Plaid integration
• ADP and QuickBooks: Payroll records, employee data, chart of accounts, and financial records when you migrate or sync data from these platforms
• American Express and other card providers: Transaction data when you connect corporate card accounts for expense management

How We Use Your Information

We do not use your data for advertising. We do not sell your data to third parties. We do not use your payroll or financial data to train AI models.

How We Share Information

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

Service Providers (Sub-processors)

• Supabase Inc. — Database, authentication, and file storage infrastructure. All data stored in Supabase's SOC 2 Type II certified infrastructure.
• Vercel Inc. — Application hosting and content delivery.
• Stripe Inc. — Payment processing for platform subscriptions. Stripe is PCI DSS Level 1 certified.
• Plaid Inc. — Bank account connection and transaction data retrieval. Subject to Plaid's own privacy policy.
• Resend / SendGrid — Transactional email delivery (notifications, payroll alerts, account emails).

Within Your Organization

Data is shared with other users in your organization based on their role and permissions. Role-based access controls (RBAC) and row-level security (RLS) ensure each user only sees data they are authorized to access.

Legal Requirements

We may disclose your information when required by law, regulation, legal process, or governmental request, including DCAA audits, IRS requirements, and court orders.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email or prominent notice on our platform before your data becomes subject to a different privacy policy.

Financial & Bank Data (Plaid Integration)

When you connect bank accounts through our Plaid integration:

• Your bank login credentials go directly to Plaid — CSH-HUB never sees or stores them
• Plaid returns tokenized access to transaction data, which CSH-HUB stores in encrypted form in Supabase
• You can revoke CSH-HUB's access to your bank data at any time through your account settings
• Plaid's privacy policy governs the handling of your credentials and bank authentication
• Transaction data is used solely for reconciliation and financial reporting within your CSH-HUB account

Payroll and SSN Data

Social Security Numbers, bank routing and account numbers, and other sensitive payroll identifiers are encrypted at rest using AES-256 encryption via Supabase Vault. These fields are never stored as plain text. Access is restricted to authorized users within your organization and to CSH-HUB's infrastructure systems for payroll processing purposes only.

Data Retention

We retain your data for as long as your account is active or as needed to provide our Services. Specific retention periods:

Upon account termination, you may request a full export of your data within 30 days. After the retention period, data is permanently deleted from our systems and backups.

Security

We implement industry-standard security measures to protect your data:

• Encryption at rest: AES-256 encryption for all sensitive data via Supabase Vault. SSNs, bank account numbers, and payroll data are never stored in plain text.
• Encryption in transit: All data transmitted between your browser and our servers is protected by TLS 1.2 or higher.
• Access controls: Role-based access control (RBAC) and row-level security (RLS) enforced at the database level. Users only access data their role permits.
• Multi-factor authentication: TOTP-based MFA available and required for administrative accounts.
• Infrastructure security: Hosted on Supabase (SOC 2 Type II certified) and Vercel. We do not manage physical servers.
• OAuth 2.0: All third-party integrations (QuickBooks, ADP, Plaid) use OAuth 2.0 token-based authentication. No third-party passwords are stored by CSH-HUB.
• Audit logging: All data access and modification events are logged with timestamps and user attribution for DCAA compliance.

While we implement these safeguards, no system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law within 72 hours of discovery.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

For All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Opt-out of marketing: Unsubscribe from marketing communications at any time

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected and sold, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.

EEA/UK Residents (GDPR)

If you are located in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with your supervisory authority. Our legal basis for processing is set out in Section 3.

To exercise any of these rights, contact: kimrichardson@csh-hub.com. We will respond within 30 days.

Cookies & Tracking

CSH-HUB uses essential cookies and session tokens to operate the platform. We do not use advertising cookies or tracking pixels.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in to the platform.

Children's Privacy

CSH-HUB is a business-to-business platform intended for use by adults in a professional capacity. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us immediately at kimrichardson@csh-hub.com and we will delete it promptly.

International Users

CSH-HUB is headquartered in the United States and our infrastructure is primarily located in US-based data centers. If you access our Services from outside the United States — including from Canada, the Caribbean, or Europe — your data will be transferred to and processed in the United States.

For users in the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses (SCCs) as the lawful mechanism for international data transfers. For Canadian users, our data practices are consistent with PIPEDA requirements.

For international enterprise clients requiring specific data residency arrangements, please contact us to discuss a custom Data Processing Agreement.

Data Processing Agreement

Enterprise clients requiring a Data Processing Agreement (DPA) for GDPR compliance, DCAA requirements, or internal procurement policies may request one by contacting kimrichardson@csh-hub.com.

A standard DPA is included with all Enterprise and Enterprise Plus tier subscriptions. The DPA covers:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data and categories of data subjects
• Obligations and rights of the data controller (your organization)
• Technical and organizational security measures
• Sub-processor list and notification obligations
• Data breach notification procedures (72-hour SLA)
• Data deletion and return upon contract termination

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice within the CSH-HUB platform

Your continued use of the Services after the effective date of changes constitutes your acceptance of the updated policy. If you do not agree to the changes, you should stop using the Services and contact us to close your account.

Contact Us

For privacy-related questions, data requests, or concerns about this policy, contact: