Privacy Policy

Version 1.5

Effective Date: November 5, 2026

1. Introduction

Wallabie, LLC DBA Roaddrafter, a Utah limited liability company ("Company," "we," "us," or "our"), operates the Road Drafter platform ("Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide when you:

(a) Create an account, including:

• Name (first and last)
• Email address
• Job title
• Phone number
• Office or district designation
• Organization name and type

(b) Complete your professional profile, including:

• Professional Engineer (PE) license number, license state, license branch or discipline, and expiration date (if applicable)

(c) Create or submit traffic control Plans, including:

• Plan inputs (project name, location, road name, speed limit, lane configuration, work zone type, etc.)
• Uploaded documents and attachments
• Notes, comments, and annotations

(d) Communicate with us, including support requests and feedback.

(e) Billing information, if you or your organization purchase a paid plan, credit, or feature: billing contact name, billing email, billing address, a tax identification number if you provide one, and the type and last four digits of your payment method. Full card numbers and bank account details are entered on pages operated by our payment processor and are held by the processor, not by us. We keep records of your orders, invoices, receipts, refunds, and payment disputes. If you are named as the billing contact for an organization but do not have an account, we hold your name, email address, and billing address to issue and send invoices.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Log data: IP address, browser type, pages visited, timestamps, and referring URLs
• Device information: Device type, operating system, and browser version
• Session data: Authentication tokens and session identifiers
• Usage data: Features used, actions taken, and time spent in the Service
• Diagnostic data: Error reports from the Service: the type of error, the page template with identifiers removed, a status class, the software build, and your account identifier if you are signed in. They do not include error messages, stack traces, query strings, URL fragments, or text you type.

2.3 Information from Third Parties

We may receive information from:

• Identity providers: If we offer sign-in through a third-party identity provider (for example, your organization's Microsoft or Google account), we receive account information from that provider, including your name, email address, and organizational domain. The identity provider's privacy policy governs information they collect and provide to us.
• Your organization: Your employer or agency may provide your account information or configure your access.
• Payment processor: When a payment is made, our payment processor sends us confirmation of the payment, the type and last four digits of the payment method, invoice and receipt records, and notices of failed payments, refunds, and disputes.

3. How We Use Your Information

We use the information we collect to:

(a) Provide the Service:

• Authenticate your identity and manage your account
• Process and store traffic control Plans
• Compute values referenced to the MUTCD and applicable state supplements, and flag values the Service cannot automatically verify
• Generate PDF plan documents
• Route plans for PE review and agency approval

(b) Ensure professional accountability:

• Record Professional Engineer attestations and approvals with timestamp, license data, and a cryptographic hash of the Plan content attested
• Maintain immutable audit logs of plan actions for regulatory and legal purposes

(c) Communicate with you:

• Send notifications about plan status, review assignments, and deadlines
• Respond to support requests
• Send service announcements and updates

(d) Operate, develop, and improve the Service:

• Analyze usage patterns to improve features
• Debug technical issues
• Develop, test, evaluate, and improve the Service and our related products and services, including training and tuning the models and algorithms used in them, as licensed under Section 6.2 of the Terms of Service

When we use your content under this subsection (d), we will not publish, sell, or license it to any third party as your content; identify you, your organization, your personnel, or any specific project as its source in output made available to another customer; or use it to re-create or make available to another customer a substantially complete copy of one of your Plans. We do not use product telemetry, usage logs, or error reports to train or tune models or algorithms.

(e) Create aggregated and de-identified data:

• We may create and use aggregated or de-identified data derived from your content without restriction. Aggregated or de-identified data does not identify you, your organization, or a specific project, and we will not attempt to re-identify it.

(f) Comply with legal obligations:

• Respond to lawful requests from government authorities
• Maintain records required by applicable law

(g) Protect the Service and enforce our Terms:

• Detect, investigate, and prevent fraud, abuse, scraping, unauthorized access, and violations of our Terms of Service, including Sections 5.2 and 6
• Protect our intellectual property and the security of the Service

(h) Bill for the Service:

• Process payments, issue invoices and receipts, and keep account balances
• Calculate, collect, and remit sales and similar taxes where we are registered to do so
• Handle failed payments, refunds, payment disputes, and chargebacks, and detect and prevent payment fraud
• Collect overdue amounts, including by referring an account to a collection agent or attorney where the Contractor & Consultant Commercial Terms allow

4. How We Share Your Information

4.1 Within Your Organization

Information you submit is shared with other members of your agency or organization as needed to facilitate the Plan review and approval workflow. Organization administrators can view all Plans and member activity within their organization.

4.2 With Other Agencies (Submissions)

When a contractor submits a Plan to a receiving agency, that agency's authorized reviewers can access the submitted Plan, your name, and your organization's information.

4.3 Professional Engineer Attestations

When a PE reviews and attests to a Plan, the PE's name, license number, license state, and attestation timestamp are embedded in the generated PDF and stored in our audit logs. This information may be shared with receiving agencies, inspectors, or regulatory bodies as part of the Plan record.

4.4 Service Providers

We share information with third-party service providers who assist in operating the Service, including:

• Cloud infrastructure providers (hosting, storage, and databases)
• AI model providers, which process Plan inputs and related content to generate draft Plan content and computed values
• Mapping and basemap providers, which receive the location data needed to render maps
• Authentication providers
• Email delivery services
• Website and product analytics providers (see Section 8)
• Payment processor (Stripe), which receives your billing name, email address, and billing address, your payment card or bank account details, the amount and description of each charge, and any tax identification number you provide, to process payments, issue invoices and receipts, and handle refunds and disputes. Checkout and the billing portal where you manage your payment method and view invoices are pages operated by Stripe.
• Tax calculation (Stripe Tax), which receives your billing address and the amount and type of each purchase to calculate the tax due

All service providers are bound by contractual obligations to protect your information and may only use it to provide services to us, except that our payment processor also uses payment information for its own purposes, such as preventing fraud and loss, securing its services, and complying with financial regulations, as described in its privacy policy at https://stripe.com/privacy. A current list of our service providers is available on request at privacy@roaddrafter.com.

4.5 Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable law
• Protect the rights, property, or safety of the Company, our users, or the public
• Detect, prevent, or address fraud or security issues

4.6 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice before your information is transferred.

4.7 With Your Consent

We may share your information for other purposes with your express consent.

4.8 Government Agency Customers

Where the Service is provided to a government agency under a dedicated written contract between the Company and the agency, that contract governs our use of that agency's data and controls over this Privacy Policy to the extent of any conflict. Where there is no such contract, this Privacy Policy applies. Agency records may also be subject to public records or freedom-of-information laws.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may retain certain information for longer periods:

• Plan records and audit logs: Retained for 7 years after the associated Plan is closed, to support regulatory audits and legal proceedings.
• PE attestation records: Retained indefinitely, as they form part of the permanent Plan record.
• Billing, invoice, and tax records: Retained for 7 years after the end of the tax year in which the transaction occurred, to meet tax, accounting, and payment-network record requirements and to resolve payment disputes.

You may request deletion of your account and personal data subject to retention obligations described above. Content already used under Section 3(d) before deletion may remain incorporated in models or derived materials, consistent with Section 6.2(e) of the Terms of Service.

6. Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS
• Encryption of data at rest
• Access controls limiting employee access to personal data
• Audit logging of access to sensitive records
• Cryptographic integrity verification of Plan documents

No security measure is perfect. We cannot guarantee absolute security of your information.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of personal data, subject to retention obligations
• Portability: Request a machine-readable copy of your personal data
• Objection: Object to certain processing of your personal data

To exercise these rights, contact us at privacy@roaddrafter.com. We will respond within 30 days.

7.1 California Residents

We are not currently subject to the California Consumer Privacy Act, but we honor the following for all users regardless of residence: we do not sell personal information and do not share it for cross-context behavioral advertising; you may request access to, correction of, or deletion of your personal data; we will not discriminate against you for exercising these rights; you may designate an authorized agent to make a request on your behalf; and we will verify your identity before acting on a request. Submit requests to privacy@roaddrafter.com.

7.2 European Economic Area / United Kingdom Residents

The Service is offered to users in the United States. We do not direct the Service to residents of the European Economic Area or the United Kingdom. If you are located outside the United States, you use the Service on your own initiative and are responsible for compliance with local law.

8. Cookies and Tracking

Analytics. We use Google Analytics 4, provided by Google LLC, on our website and within the Service to understand how the product is used. Google Analytics sets first-party cookies (_ga and _ga_*, retained for up to two years) and receives the pages you visit (including page addresses within the Service), the referring page, your browser and device type, your approximate location, and events about actions in the Service, such as creating a Plan or generating a PDF, with a few attributes of the kind of Plan, such as road category, MUTCD edition, and state. Those attributes describe the kind of Plan, not its contents. We do not send Plan names, project locations, uploaded documents, text you enter, or PE license data to Google Analytics, and we do not use it for advertising. Google Analytics keeps event data for 2 months. You can opt out with Google's browser add-on at https://tools.google.com/dlpage/gaoptout or by blocking cookies in your browser.

Our own usage logs. We also keep our own records of product events and diagnostic data, linked to your account and organization identifiers, to see which screens and features are used and where errors happen. They do not include Plan content or text you enter. They are visible to our platform staff and kept for 13 months. We do not record your screen, and we do not use session-recording, heatmap, or click-tracking tools. The Google opt-out above applies to Google Analytics only; to ask us to delete your usage records, contact privacy@roaddrafter.com (Section 7).

Authentication. We also use session cookies and local storage needed to authenticate you, maintain your session, and remember your interface preferences.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

10. Third-Party Links

The Service may contain links to third-party websites. Payment checkout and billing management take place on pages operated by our payment processor (Section 4.4), which are governed by its own privacy policy. We are not responsible for the privacy practices of other sites.

11. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will post a notice in the Service and send an email to your registered address at least 30 days before the changes take effect, and we may require you to acknowledge the revised Policy before continuing to use the Service. Current and prior versions are available at /legal.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Wallabie, LLC DBA Roaddrafter 2195 South 1000 East Salt Lake City, UT 84106 privacy@roaddrafter.com