1. Introduction
Welcome to Stone Project. We respect your privacy and are committed to protecting your personal data. This Política de privacidade explains how Design Master Solutions LLC ("Stone Project", "we", "us", or "our") collects, uses, shares, and protects information when you use our mobile application, web application, and related services (collectively, the "Service").
1.1 Who We Are
Design Master Solutions LLC
Yarmouth, MA 02664, United
States
- Data Protection Officer (DPO): privacy@stoneproject.app
- General Inquiries: support@stoneproject.app
1.2 Scope of This Policy
This Política de privacidade applies to:
- Stone Project mobile apps (iOS and Android)
- Stone Project web application
- White-label client portals (for your customers)
- API services and integrations
- Marketing websites and communications
1.3 Compliance
We comply with:
- GDPR (EU General Data Protection Regulation)
- LGPD (Brazil Lei Geral de Proteção de Dados)
- CCPA/CPRA (California Consumer Privacy Act)
- SOC 2 Type II (data security certification)
- PCI DSS (payment card security standards)
2. Information We Collect
2.1 Information You Provide Directly
Account Information: Full name and business name, email address, phone number, business address, password (encrypted), and tax identification number.
Business Information: Client and customer data, project details, quotes and invoices, photos and documents, notes and communications, and team member information.
Payment Information: Credit/debit card details (processed by Stripe — not stored by us), billing address, payment history, and bank account information (Enterprise only).
2.2 Information Collected Automatically
Usage Data: Pages and features accessed, time spent on screens, actions taken, search queries, and navigation patterns.
Device Information: Device type and model, operating system and version, app version, screen resolution, and unique device identifiers.
Location Data: IP-based approximate location (city/region level). GPS location only with explicit consent for project mapping.
2.3 Augmented Reality, TrueDepth API, and LiDAR Data
When using the AR Measurement feature, our app utilizes Apple's TrueDepth API and/or LiDAR sensor (via ARKit) solely for the purpose of measuring physical surfaces such as countertops, slabs, and remnants. Specifically:
- TrueDepth / LiDAR depth data is processed entirely on your device in real-time to enable accurate surface measurement
- Camera feed is used for AR overlay and measurement visualization only — it is not recorded, stored, or transmitted
- Measurement results (length, width, area) may be saved to your project if you choose to do so
- We do NOT use TrueDepth data to identify users, create facial profiles, or collect any biometric information
- We do NOT collect, store, or share face data, face maps, or facial geometry of any kind
- No TrueDepth data, depth maps, point clouds, AR session data, or environmental scans are transmitted to our servers or shared with any third parties
- TrueDepth and LiDAR data is used exclusively for surface measurement and is discarded immediately after the AR session ends
2.4 Information from Third Parties
Social Login: Google (name, email, profile photo), Apple (name, email or masked email).
Payment Processors: Stripe (payment status, last 4 card digits, transaction IDs).
Integration Partners: QuickBooks (accounting data you sync), Google Agenda (events you create).
2.5 Google Workspace APIs — Limited Use
Stone Project's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We request the Google Calendar scopes calendar.readonly and calendar.events for a single purpose: to show your own and shared calendars inside the app, and to create, reschedule, and remove the events that mirror your Stone Project activities.
We do not use, transfer, or sell Google Workspace user data — raw, aggregated, or derived — to develop, improve, or train generalized or foundational artificial intelligence or machine learning models, and we do not send it to any third-party AI or ML service. Our AI features (stone cataloging, pricing recommendations, and the in-app assistant) have no access to Google Calendar data. Calendar events read from your account are shown to you in the app's calendar view and are not stored on our servers.
3. How We Use Your Information
- Create and manage your account
- Authenticate identity and secure your account
- Store and sync data across devices
- Process payments and generate invoices
- Send transactional emails (password resets, receipts)
- Provide customer support
- Improve AI features (stone cataloging, pricing recommendations)
- Understand feature usage and fix bugs
- Send marketing communications (with opt-out)
- Comply with legal obligations
- Detect and prevent fraud
4. How We Share Your Information
We never sell, rent, or trade your personal data to third parties for their marketing purposes.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Every sharing category below excludes text messaging originator opt-in data and consent: that information is never shared with any third party.
We share data with:
- Cloud Infrastructure: AWS (database and file armazenamento, US region), Cloudflare (CDN), Vercel (web hosting)
- Payment Processing: Stripe (PCI DSS compliant)
- Communication: AWS SES (email), AWS End User Messaging (SMS text messages), Firebase (push notifications)
- Analytics: Google Analytics (anonymized), Sentry (error tracking)
- Advertising: Meta (Facebook) receives the business email address of countertop shops and prospective shops — our own account holders and leads — in hashed (encrypted) form, only to show Stone Project ads to similar businesses and to avoid showing them to existing customers. Meta matches the hashes against its own accounts and cannot read the original data. No phone number of any kind is shared for advertising, and mobile numbers and SMS opt-in consent are never shared with Meta, Google or any other third party. To opt out, email privacy@stoneproject.app.
All service providers are contractually bound to use data only for providing services, implement appropriate security, and comply with privacy laws.
4.1 Text messaging (SMS)
When you give consent in your customer portal, Stone Project sends transactional text messages about the projects you have with shops that use Stone Project; Stone Project is the sender — appointment reminders, project stage updates, quote, invoice and payment notifications. Your mobile number and the consent record are stored on your customer record and used only for that purpose.
Mobile information and SMS opt-in consent are never shared with third parties or affiliates for marketing or promotional purposes, and are never shared with any third party for any other purpose. Phone numbers are disclosed only to the messaging carrier and to our messaging provider (AWS End User Messaging), acting solely as our subprocessor to deliver the messages you asked for. Reply STOP to any message to opt out, or untick the consent box in your portal. See our SMS Terms and Conditions for the full program details.
5. Data Security
- TLS 1.3 encryption for data in transit
- AES-256 encryption for data at rest
- Multi-factor authentication (MFA) available
- Role-based access control (RBAC)
- Regular security audits and penetration testing
- OWASP Top 10 vulnerability prevention
- 24/7 security monitoring
In case of a data breach, we will notify you within 72 hours of discovery.
6. Data Retention
- Active accounts: Data retained while your account is active
- Canceled accounts: Data retained for 90 days (for reactivation), then permanently deleted
- Usage logs: Retained for 90 days
- Support tickets: Retained for 3 years
- Backups: Purged withem 30 dias of deletion
7. Your Privacy Rights
All Users
- Access: Request a copy of your data (JSON, CSV, PDF)
- Correction: Update inaccurate information anytime
- Deletion: Delete your account and all data
- Opt-Out: Unsubscribe from marketing at any time
GDPR (European Users)
Additional rights: restriction of processing, object to processing, data portability, right not to be subject to automated decisions, and right to lodge complaints with authorities.
LGPD (Brazilian Users)
Additional rights: anonymization, blocking, portability, explanation of processing, and consent withdrawal. Contato: privacy@stoneproject.app. Response within 15 days.
CCPA/CPRA (California Residents)
Right to know, delete, opt-out of data sale (we don't sell data), correct, and limit use of sensitive data. No discrimination for exercising rights.
How to Exercise Your Rights
- Self-Service: Account Settings → Privacy & Data
- E-mail: privacy@stoneproject.app
- Response Time: 30 days (15 days for LGPD, 45 days for CCPA)
8. International Data Transfers
Primary data center: AWS US-East-1 (Virginia). We use Standard Contractual Clauses (SCCs) for transfers from the EEA or Brazil.
9. Children's Privacy
Stone Project is a B2B service for adults 18+. We do not knowingly collect data from children under 18. If discovered, such data will be deleted within 48 hours.
10. Cookies
- Essential: Authentication, security, performance (cannot disable)
- Functional: Language/theme preferences (can disable)
- Analytics: Google Analytics, product analytics (can disable)
- Marketing: Ad retargeting (optional). Off by default outside the United States until you accept. In the United States it is on by default and you can opt out at any time; a Global Privacy Control signal is honored as an opt-out.
11. Changes to This Policy
We'll notify you of material changes via email and in-app notice at least 30 days before they take effect. Continued use constitutes acceptance.
12. Contato Us
- Privacy: privacy@stoneproject.app
- Support: support@stoneproject.app
- Brazil DPO: privacy@stoneproject.app
Design Master Solutions LLC · Yarmouth, MA 02664, United States