Privacy Policy

Version 1.0 Effective Date: August 14, 2026

1. Introduction

Road Drafter, Inc. ("Company," "we," "us," or "our") operates the Road Drafter platform ("Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide when you:

(a) Create an account, including:

• Name (first and last)
• Email address
• Job title
• Phone number
• Office or district designation
• Organization name and type

(b) Complete your professional profile, including:

• Professional Engineer (PE) license number, license state, and expiration date (if applicable)

(c) Create or submit traffic control Plans, including:

• Plan inputs (project name, location, road name, speed limit, lane configuration, work zone type, etc.)
• Uploaded documents and attachments
• Notes, comments, and annotations

(d) Communicate with us, including support requests and feedback.

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Log data: IP address, browser type, pages visited, timestamps, and referring URLs
• Device information: Device type, operating system, and browser version
• Session data: Authentication tokens and session identifiers
• Usage data: Features used, actions taken, and time spent in the Service

2.3 Information from Third Parties

We may receive information from:

• Identity providers: When you authenticate using a third-party identity provider (e.g., Microsoft Entra ID, Google Workspace), we receive account information from that provider, including your name, email address, and organizational domain. The identity provider's privacy policy governs information they collect and provide to us.
• Your organization: Your employer or agency may provide your account information or configure your access.

3. How We Use Your Information

We use the information we collect to:

(a) Provide the Service:

• Authenticate your identity and manage your account
• Process and store traffic control Plans
• Compute MUTCD-based values and generate compliance checks
• Generate PDF plan documents
• Route plans for PE review and agency approval

(b) Ensure professional accountability:

• Record Professional Engineer attestations and approvals with timestamp, license data, and a cryptographic hash of the Plan content attested
• Maintain immutable audit logs of plan actions for regulatory and legal purposes

(c) Communicate with you:

• Send notifications about plan status, review assignments, and deadlines
• Respond to support requests
• Send service announcements and updates

(d) Improve the Service:

• Analyze usage patterns to improve features
• Debug technical issues

(e) Comply with legal obligations:

• Respond to lawful requests from government authorities
• Maintain records required by applicable law

4. How We Share Your Information

4.1 Within Your Organization

Information you submit is shared with other members of your agency or organization as needed to facilitate the Plan review and approval workflow. Organization administrators can view all Plans and member activity within their organization.

4.2 With Other Agencies (Submissions)

When a contractor submits a Plan to a receiving agency, that agency's authorized reviewers can access the submitted Plan, your name, and your organization's information.

4.3 Professional Engineer Attestations

When a PE reviews and attests to a Plan, the PE's name, license number, license state, and attestation timestamp are embedded in the generated PDF and stored in our audit logs. This information may be shared with receiving agencies, inspectors, or regulatory bodies as part of the Plan record.

4.4 Service Providers

We share information with third-party service providers who assist in operating the Service, including:

• Cloud infrastructure providers (hosting, storage, and databases)
• Authentication providers
• Email delivery services

All service providers are bound by contractual obligations to protect your information and may only use it to provide services to us.

4.5 Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to:

• Comply with applicable law
• Protect the rights, property, or safety of the Company, our users, or the public
• Detect, prevent, or address fraud or security issues

4.6 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice before your information is transferred.

4.7 With Your Consent

We may share your information for other purposes with your express consent.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may retain certain information for longer periods:

• Plan records and audit logs: Retained for 7 years after the associated Plan is closed, to support regulatory audits and legal proceedings.
• PE attestation records: Retained indefinitely, as they form part of the permanent Plan record.
• Account information: Retained for 7 years after account termination to allow account recovery and comply with legal obligations.

You may request deletion of your account and personal data subject to retention obligations described above.

6. Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS
• Encryption of data at rest
• Access controls limiting employee access to personal data
• Audit logging of access to sensitive records
• Cryptographic integrity verification of Plan documents

No security measure is perfect. We cannot guarantee absolute security of your information.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of personal data, subject to retention obligations
• Portability: Request a machine-readable copy of your personal data
• Objection: Object to certain processing of your personal data

To exercise these rights, contact us at privacy@roaddrafter.com. We will respond within 30 days.

7.1 California Residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, and opt out of the sale or sharing of personal information. To submit a request, contact privacy@roaddrafter.com.

7.2 European Economic Area / United Kingdom Residents

If you are located in the EEA or UK, our processing of your personal data is governed by the General Data Protection Regulation (GDPR) or UK GDPR as applicable. Our lawful bases for processing include contract performance, legitimate interests, and compliance with legal obligations. You may contact our data protection representative at privacy@roaddrafter.com.

8. Cookies and Tracking

We use session cookies to authenticate your identity and maintain your session. We do not use persistent tracking cookies for advertising purposes.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

11. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms to protect your data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the Service or sending an email to your registered address. Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Road Drafter, Inc. Privacy Office 1234 Market Street San Francisco, CA 94102 privacy@roaddrafter.com