AutoFill Privacy Notice

Last updated: 15 September 2026

1. What this notice covers

This notice explains how AutoFill handles information used to provide its authenticated BOQ pricing, project-costing, document analysis and related account services. It applies to the current AutoFill customer service and should be read with the Terms of Use.

2. Information AutoFill processes

• Account information: email address, display name, password-verification data, session records, accepted Terms/Privacy versions and account-security events.
• Project information: BOQs, RFPs/SOWs, uploaded source files, extracted scope, quantities, rates, estimates, notes, revisions, drawings and other project-working data that you choose to store.
• Usage and security information: technical request information needed for security, abuse prevention, diagnostics and service operation. AutoFill's application-level authentication rate-limit keys use SHA-256-derived identifiers rather than storing raw email or IP values in those counters.
• Password recovery information: when recovery is enabled, AutoFill stores a one-way digest of a short-lived, single-use reset token. The raw token is delivered in the reset link and is not stored in the database.
• Billing information: subscription state, payment references and provider correlation identifiers needed to verify access. Payment-card details are processed by the payment provider and are not stored by AutoFill.

3. Why the information is used

Information is used to authenticate accounts, isolate each customer's workspace, import and store project files, calculate and save estimates, operate AI-assisted features requested by the user, provide account recovery when configured, verify paid access, prevent abuse, diagnose failures and maintain revision/history functions.

4. AI-assisted processing

When you use AI pricing, document extraction, project chat or photo analysis, relevant project content may be sent to the configured AI service provider to perform that request. AutoFill currently integrates OpenAI for enabled AI functions. AI outputs are provisional working assistance and are not treated as verified supplier quotations or engineering approvals. Do not upload information that you are not authorised to process or share with the service providers required to perform the requested function.

5. Hosting and service providers

The active Cloudflare deployment uses Cloudflare infrastructure for the application, database and stored project files. PayTabs is used for supported payment flows, and OpenAI is used when enabled AI features are requested. When Cloudflare password-recovery email is configured, AutoFill uses Resend to deliver the reset email; the recipient email address and reset-message content are sent to Resend for that purpose. These providers may process technical, account or transaction information under their own contractual and privacy terms. AutoFill does not publish customer BOQs, project files or private pricing as a public catalogue and does not sell customer project data.

6. Authentication, cookies and password recovery

The active Cloudflare service uses an essential authentication session cookie. It is marked HttpOnly and Secure and uses SameSite protections. Passwords are not stored in plaintext; the service stores salted PBKDF2-HMAC-SHA256 password-verification hashes. New Cloudflare password hashes use a 600,000-iteration work factor and older supported hashes are upgraded after successful login. Password-reset links, when enabled, are short-lived, single-use and revoke existing sessions after a successful reset. Advertising cookies are not required by the current AutoFill Cloudflare build.

7. Retention and deletion

Project information is retained while needed to provide the workspace and revision features or until it is deleted. Workspace deletion removes user-scoped projects, revisions, stored project files, upload state, sessions, payment mappings, estimate cache and AI-usage counters while leaving the account identity available. Permanent account deletion, where offered, additionally removes outstanding reset tokens, recorded legal acknowledgements and the AutoFill login identity. Short-lived reset records are also expired and cleaned automatically. Separate records held by payment, email, hosting or other service providers may be retained under their own terms or applicable legal obligations.

8. Security

AutoFill uses HTTPS, secure session cookies, salted password hashing, account-scoped database/file access, authentication throttling, same-origin checks on sensitive browser requests, verified payment callbacks, Content Security Policy and server-side access controls. These measures reduce risk but do not make any internet service impossible to compromise. Users should use a unique password, protect their email account and avoid sharing credentials.

9. Your choices and rights

You can choose what project content to upload and can use the available workspace-deletion and, where available, permanent account-deletion controls. Depending on applicable law, you may also have rights to request access, correction, deletion or information about processing. Mandatory rights under applicable law are not limited by this notice.

10. Changes

If the service materially changes how customer information is handled, this notice should be updated before the changed processing is relied upon for new customer activity. The update date appears at the top of this page.

Terms of Use · Back to AutoFill