1. Introduction
Welcome to Stone Project. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how Design Master Solutions LLC ("we", "us" or "our"), the company that makes Stone Project, collects, uses, shares, and protects information when you use our mobile application, web application, and related services (collectively, the "Service").
1.1 Who We Are
Design Master Solutions LLC
Yarmouth, MA 02664, United
States
- Data Protection Officer (DPO): [email protected]
- General Inquiries: [email protected]
1.2 Scope of This Policy
This Privacy Policy applies to:
- Stone Project mobile apps (iOS and Android)
- Stone Project web application
- White-label client portals (for your customers)
- API services and integrations
- Marketing websites and communications
1.3 Compliance
We comply with:
- GDPR (EU General Data Protection Regulation)
- LGPD (Brazil Lei Geral de Proteção de Dados)
- CCPA/CPRA (California Consumer Privacy Act)
- SOC 2 Type II (data security certification)
- PCI DSS (payment card security standards)
2. Information We Collect
2.1 Information You Provide Directly
Account Information: Full name and business name, email address, phone number, business address, password (encrypted), and tax identification number.
Business Information: Client and customer data, project details, quotes and invoices, photos and documents, notes and communications, and team member information.
Payment Information: Credit/debit card details (processed by Stripe — not stored by us), billing address, payment history, and bank account information (Enterprise only).
2.2 Information Collected Automatically
Usage Data: Pages and features accessed, time spent on screens, actions taken, search queries, and navigation patterns.
Device Information: Device type and model, operating system and version, app version, screen resolution, and unique device identifiers.
Location Data: IP-based approximate location (city/region level). GPS location only with explicit consent for project mapping.
2.3 Augmented Reality, TrueDepth API, and LiDAR Data
When using the AR Measurement feature, our app utilizes Apple's TrueDepth API and/or LiDAR sensor (via ARKit) solely for the purpose of measuring physical surfaces such as countertops, slabs, and remnants. Specifically:
- TrueDepth / LiDAR depth data is processed entirely on your device in real-time to enable accurate surface measurement
- Camera feed is used for AR overlay and measurement visualization only — it is not recorded, stored, or transmitted
- Measurement results (length, width, area) may be saved to your project if you choose to do so
- We do NOT use TrueDepth data to identify users, create facial profiles, or collect any biometric information
- We do NOT collect, store, or share face data, face maps, or facial geometry of any kind
- No TrueDepth data, depth maps, point clouds, AR session data, or environmental scans are transmitted to our servers or shared with any third parties
- TrueDepth and LiDAR data is used exclusively for surface measurement and is discarded immediately after the AR session ends
2.4 Information from Third Parties
Social Login: Google (name, email, profile photo), Apple (name, email or masked email).
Payment Processors: Stripe (payment status, last 4 card digits, transaction IDs).
Integration Partners: QuickBooks (accounting data you sync), Google Calendar (events you create).
2.5 Google Workspace APIs — Limited Use
Stone Project's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We request the Google Calendar scopes calendar.readonly and calendar.events for a single purpose: to show your own and shared calendars inside the app, and to create, reschedule, and remove the events that mirror your Stone Project activities.
We do not use, transfer, or sell Google Workspace user data — raw, aggregated, or derived — to develop, improve, or train generalized or foundational artificial intelligence or machine learning models, and we do not send it to any third-party AI or ML service. Our AI features (stone cataloging, pricing recommendations, and the in-app assistant) have no access to Google Calendar data. Calendar events read from your account are shown to you in the app's calendar view and are not stored on our servers.
3. How We Use Your Information
- Create and manage your account
- Authenticate identity and secure your account
- Store and sync data across devices
- Process payments and generate invoices
- Send transactional emails (password resets, receipts)
- Provide customer support
- Improve AI features (stone cataloging, pricing recommendations)
- Understand feature usage and fix bugs
- Send marketing communications (with opt-out)
- Comply with legal obligations
- Detect and prevent fraud
4. How We Share Your Information
We never sell, rent, or trade your personal data to third parties for their marketing purposes.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Every sharing category below excludes text messaging originator opt-in data and consent: that information is never shared with any third party.
We share data only with providers that run the Service:
- Cloud Infrastructure: AWS (database and file storage, US region), Cloudflare (CDN), Vercel (web hosting)
- Payment Processing: Stripe (PCI DSS compliant)
- Communication: AWS SES (email), Firebase (push notifications)
- Analytics: Google Analytics (anonymized website visits and sign-ups only; never phone numbers or SMS data)
- Error tracking: Sentry
- AI processing: Anthropic, OpenAI and Google, only for the AI features you use
All service providers are contractually bound to use data only for providing services, implement appropriate security, and comply with privacy laws.
Apps you connect: you can connect an AI assistant such as Claude or ChatGPT to your Stone Project account. When you or an admin of your company does this, we send it the records of the company you choose (projects, clients, quotes, invoices, payments, orders, suppliers and inventory) only when you ask it to read them, because you asked us to, and anything you ask it to create or change is written with your permissions. This stops when you disconnect it in Settings → Integrations → AI Connections.
4.1 Text messaging (SMS)
When you give consent in your customer portal, Stone Project (a DBA of Design Master Solutions LLC) sends transactional text messages about the projects you have with shops that use Stone Project; Stone Project is the sender — appointment reminders, project stage updates, quote, invoice and payment notifications. Your mobile number and the consent record are stored on your customer record and used only for that purpose.
Mobile information and SMS opt-in consent are never shared with third parties or affiliates for marketing or promotional purposes, and are never shared with any third party for any other purpose. SMS opt-in data and consent remain with Design Master Solutions LLC, the original consent recipient, and are never shared with or sold to any third party. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Reply STOP to any message to opt out, or untick the consent box in your portal. See our SMS Terms and Conditions for the full program details.
5. Data Security
- TLS 1.3 encryption for data in transit
- AES-256 encryption for data at rest
- Multi-factor authentication (MFA) available
- Role-based access control (RBAC)
- Regular security audits and penetration testing
- OWASP Top 10 vulnerability prevention
- 24/7 security monitoring
In case of a data breach, we will notify you within 72 hours of discovery.
6. Data Retention
- Active accounts: Data retained while your account is active
- Canceled accounts: Data retained for 90 days (for reactivation), then permanently deleted
- Usage logs: Retained for 90 days
- Support tickets: Retained for 3 years
- Backups: Purged within 30 days of deletion
7. Your Privacy Rights
All Users
- Access: Request a copy of your data (JSON, CSV, PDF)
- Correction: Update inaccurate information anytime
- Deletion: Delete your account and all data
- Opt-Out: Unsubscribe from marketing at any time
GDPR (European Users)
Additional rights: restriction of processing, object to processing, data portability, right not to be subject to automated decisions, and right to lodge complaints with authorities.
LGPD (Brazilian Users)
Additional rights: anonymization, blocking, portability, explanation of processing, and consent withdrawal. Contact: [email protected]. Response within 15 days.
CCPA/CPRA (California Residents)
Right to know, delete, opt-out of data sale (we don't sell data), correct, and limit use of sensitive data. No discrimination for exercising rights.
How to Exercise Your Rights
- Self-Service: Account Settings → Privacy & Data
- Email: [email protected]
- Response Time: 30 days (15 days for LGPD, 45 days for CCPA)
8. International Data Transfers
Primary data center: AWS US-East-1 (Virginia). We use Standard Contractual Clauses (SCCs) for transfers from the EEA or Brazil.
9. Children's Privacy
Stone Project is a B2B service for adults 18+. We do not knowingly collect data from children under 18. If discovered, such data will be deleted within 48 hours.
10. Cookies
- Essential: Authentication, security, performance (cannot disable)
- Functional: Language/theme preferences (can disable)
- Analytics: Google Analytics and Google Ads conversion measurement (can disable). Off by default outside the United States until you accept. In the United States it is on by default and you can opt out at any time; a Global Privacy Control signal is honored as an opt-out.
11. Changes to This Policy
We'll notify you of material changes via email and in-app notice at least 30 days before they take effect. Continued use constitutes acceptance.
12. Contact Us
- Privacy: [email protected]
- Support: [email protected]
- Brazil DPO: [email protected]
Design Master Solutions LLC · Yarmouth, MA 02664, United States