Privacy Policy

Section 1

Who We Are

Kaos Design Werks, LLC is the legal entity operating the RedRock platform. We are incorporated in Texas and maintain our principal place of business in Austin, TX. For all privacy-related matters, including data subject requests, you may reach us at info@redrock-cm.com.

Section 2

Data We Collect

We collect the following categories of personal data:

• Account data — name, email address, company name, and authentication credentials provided during registration.
• Project data — construction project records, documents, schedules, financial data, daily reports, RFIs, submittals, and other content you upload or create within the platform.
• Usage data — IP address, browser type, pages visited, feature interactions, and timestamps collected automatically when you use the platform.
• Payment data — billing name, address, and last-four card digits; full payment card numbers are handled exclusively by our payment processor and are never stored on our servers.
• Support data — correspondence, attachments, and metadata you send when contacting our support team.

Section 3

Legal Bases (GDPR Art. 6)

Where the GDPR applies, we rely on the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing necessary to deliver the platform services you subscribed to.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, security monitoring, product analytics, and improving platform reliability.
• Legal obligation (Art. 6(1)(c)) — compliance with applicable tax, financial reporting, and law enforcement requirements.
• Consent (Art. 6(1)(a)) — where we explicitly request your consent, such as for marketing communications.

Section 4

How We Use Data

• Provision and maintenance of the RedRock platform and its features.
• User authentication, account management, and access control.
• Processing subscription payments and invoicing.
• Providing customer support and responding to inquiries.
• Detecting and preventing fraud, abuse, and security incidents.
• Analyzing usage patterns to improve platform performance and features.
• Sending service-critical communications such as security alerts and billing notices.

We do not sell personal data to third parties, nor do we use your project data to train machine learning models.

Section 5

Data Sharing

We share personal data only with trusted sub-processors necessary to operate the platform:

• Cloud infrastructure — hosting, storage, and database services.
• Payment processor — secure handling of subscription billing.
• Email delivery — transactional and notification emails.
• Customer support — ticketing and helpdesk tooling.
• Analytics — aggregated, anonymized usage metrics.

All sub-processors are bound by data processing agreements incorporating Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as applicable.

Section 6

International Transfers

Personal data may be transferred to and processed in the United States and other countries. For transfers from the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or addenda to SCCs as approved by the UK Information Commissioner's Office.

Section 7

Your Rights (GDPR Art. 15–22)

Where applicable law provides these rights, you may exercise them by contacting info@redrock-cm.com:

• Access (Art. 15) — request a copy of personal data we hold about you.
• Rectification (Art. 16) — correct inaccurate or incomplete personal data.
• Erasure (Art. 17) — request deletion of your personal data under applicable conditions.
• Restriction (Art. 18) — request that we limit our processing of your data.
• Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw at any time without affecting prior lawfulness.
• Lodge a complaint — file a complaint with your local supervisory authority.

Section 8

Data Retention

We retain personal data for as long as your subscription is active. Following termination or expiration of your subscription, we provide a 30-day export window during which you may download your data. All personal data and project data is permanently deleted within 90 days of account termination, except where retention is required by applicable law (e.g., tax and accounting records).

Section 9

Security

We implement industry-standard technical and organizational measures to protect personal data, including TLS 1.2+ for data in transit, AES-256 encryption for data at rest, role-based access controls, and multi-factor authentication options. In the event of a data breach affecting your personal data, we will notify you and applicable supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR Art. 33–34.

Section 10

Cookies

We use strictly necessary cookies and session tokens required for platform authentication and security. We do not use advertising, tracking, or behavioral profiling cookies. No third-party ad networks or social media trackers are present on the platform.

Section 11

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated with at least 14 days' advance notice via email or an in-platform notice. Continued use of the platform following the effective date of any changes constitutes your acceptance of the updated policy.