Privacy Policy

1. Who handles your information

Kentori LLC operates Spec-N-Glo and specnglo.com. This policy describes information handled through our website, contractor application, and authorized customer and Crew workflows. Contact hello@kentori.net for privacy questions or requests.

Contractors decide what customer and property information to place in their company workspace and whom to authorize. If your information was supplied by a contractor, contact that contractor about its own collection and use as well as contacting us about the software. Separate installation contracts and third-party services may have their own privacy terms.

2. Information we process

• Account and company information: email, display name, verification status, company memberships and roles, business contact details, branding, and licensing information you provide.
• Customer, property and job records: names, business names, emails, phone numbers, addresses, notes, schedules, and relationships between customers, properties, and jobs.
• Photos and designs: uploaded property and completion photographs, selected documents, calibration references, measurements, saved lighting geometry, fixtures, schematics, product assignments, materials, costs, and pricing.
• Commercial and installation history: proposals, contracts, invoices, manual payment records, Crew assignments and actuals, completion evidence, Service requests, warranty information, and comments.
• Electronic signature evidence: signer identity and role, typed name, consent version, time of signing, and a record of the document/version presented for acceptance.
• Verification and operational data: authentication events, verification state, request identifiers, usage and allowance records, provider status, and security or error information. Hosting, authentication, and other providers may also process connection metadata such as IP addresses and browser information.

3. Why information is used

We use information to operate accounts and company workspaces; verify access; produce requested designs, AI results and schematics; calculate materials and estimates; deliver selected documents; support signatures, scheduling, assigned Crew work, invoicing and Service history; and respond to support requests.

We also use limited operational records to administer allowances, prevent abuse and repeated trials, investigate failures, reconcile provider results, protect access, and preserve business or legal evidence. We do not need unrelated sensitive information for ordinary lighting design; avoid including it in photos, notes, or documents.

4. Service providers and enabled features

Information is sent to providers needed for the feature you use. An integration’s presence does not mean paid billing, SMS, or public enrollment is currently active.

• Supabase: account authentication, database records, and private file storage. Signup and recovery emails use the configured authentication email-delivery service.
• Vercel: website/application hosting and request processing.
• OpenAI: requested AI previews may send the original property photo, a saved-design reference image, and structured design guidance. Blueprint generation sends the source photo and generation instructions. Review your authority to submit the image before generating.
• Resend: configured transactional emails, such as invitations or document notifications, may include the recipient, message, and relevant link. This does not mean all authentication emails use the same delivery provider.
• Twilio Verify: when phone verification is enabled, the phone number and submitted code are sent to the verification provider. The application keeps verification status and abuse-prevention records, including a protected phone-derived identifier; it does not retain the one-time verification code as a business record. Contact phone numbers entered elsewhere in the workspace remain ordinary contact records.
• Stripe: when paid billing is authorized and enabled, hosted payment/billing flows process payment details. The application uses provider customer/subscription identifiers, billing periods, status, and transaction references to reconcile access. Billing is not activated by this policy, and a manually recorded customer payment is not a card charge.

Provider processing is subject to the applicable provider arrangements. Contact us about provider or international-processing questions. This policy does not promise a specific hosting region, provider retention period, or provider model-training treatment.

5. Sharing and access

Information is shared with authorized company members and, when requested by the contractor, customers, assigned Crew, or document recipients. Role and assignment checks restrict private workspace actions. A contractor-created proposal or invoice share link can allow recipient review before login; verified recipient identity is required for acceptance/signing. Treat those links as confidential.

We disclose information to service providers to perform requested functions, and may disclose information when legally required or reasonably necessary to investigate abuse, protect rights or safety, or respond to a lawful request. Sharing a proposal or exporting a crew packet creates a copy outside the private workspace that the sender and recipient must handle appropriately.

6. Cookies, browser storage and logs

Authentication and company-selection cookies support sign-in and the active workspace. Short-lived recovery state supports account recovery. Browser storage also holds preferences, dismissed instructions, and some invitation state; local review/tutorial features use isolated browser state. Blocking required cookies or storage can prevent sign-in or saving preferences.

The application records AI request metadata such as request/account identifiers, model, usage, timing, status, and estimated cost. Its AI telemetry excludes raw photos and prompts. This is not a promise that hosting or other providers collect no logs. The current website does not include an application advertising-pixel integration; any future advertising or optional tracking requires an updated assessment and disclosures.

The guided public tutorial uses demonstration content and isolated state. It does not create real customer records or consume AI credits. Normal website requests still reach the hosting service.

7. Retention and account closure

Retention depends on the record’s purpose, account relationship, legal obligations, and any applicable hold. Temporary generation files, working designs, and durable business records are not treated identically. Accepted contracts, signatures, invoices, payment evidence, frozen installation revisions, Crew actuals, and Service/warranty history may need to remain available for legitimate business, dispute, or legal purposes.

Canceling a subscription does not itself delete saved projects or create an account-deletion request. Expired access may restrict use of saved work even when records remain retained. We do not promise a single deletion deadline for all records or immediate removal from backups and provider systems. Contact support about the records you want reviewed and the retention that applies.

8. Privacy requests and choices

Depending on your location and applicable law, you may have rights to access, correct, obtain a copy of, delete, or restrict certain uses of your information, or object to particular processing. Send requests to hello@kentori.net. Identify the account/company and request type, but do not email passwords, verification codes, payment-card details, or unnecessary private files.

We may verify your identity and authority before responding. Requests involving contractor-controlled records may require the contractor’s participation. We consider applicable exceptions and the rights of other people, including preservation of signed or financial records. The application does not currently provide a universal self-service erasure button. Contacting support is the request path, not a guarantee that every retained record can be deleted.

You may manage company permissions, correct editable records, and decline optional generation where those controls are available. Required account/security notices are distinct from optional marketing. Applicable privacy rights are not waived by using the service.

9. Security and responsible use

The cloud application uses authentication, company/role authorization, database access policies, and scoped private-file access. Private files are not made public merely by uploading them; authorized sharing is a separate action. No online service can guarantee absolute security or eliminate all loss, misuse, or unauthorized access.

Protect credentials and shared links, keep devices secure, review recipients, and remove unnecessary user access. Contact hello@kentori.net promptly about suspected exposure. Do not send credentials or private customer photographs in an initial support report.

10. Audience, updates and contact

The service is designed for professional business use and authorized customer/Crew workflows, not as a service directed to children. If you believe a child’s information was supplied inappropriately, contact us so it can be reviewed.

We may update this policy as features, provider arrangements, or legal requirements change. Material changes will be communicated as required. The date above identifies this version. For privacy, retention, account-closure, or provider questions, contact Kentori LLC at hello@kentori.net.