What We Collect

Account information — your name, email address, and whether you are firm staff or a client. Scally enters this when inviting you; the portal has no public sign-up.

Project information you provide — questionnaire answers (which can include household details, lifestyle preferences, and budget), photographs, surveys, existing drawings, and any file you upload or we upload on your behalf.

Signing records — for each proposal you sign: the name you type, the date and time, your IP address, your browser's user-agent string, and a cryptographic fingerprint of the signed document. These exist to make the signature verifiable and are kept with the signed record.

Sign-in and security records — a hashed form of each sign-in code (never the code itself), your session, the time and IP of sign-ins, and an audit log of significant actions taken in the portal.

Billing information — invoice amounts, dates, and status, and the invoice documents themselves. Payment card and bank details are NOT collected or stored by the portal; payments are handled outside it.

What We Do With It

We use this information to run your project and the portal: to show you your project, to perform the design and construction-administration services you engaged us for, to send transactional email (sign-in codes, invitations, new-document notices, signature confirmations), to keep signed agreements verifiable, and to keep the portal secure.

We do not sell personal information, share it with data brokers, or use it for advertising. We do not use your project information to train machine learning models.

Cookies and Tracking

The portal sets one cookie: a session cookie that keeps you signed in. It is httpOnly, restricted to this site, and expires on its own — thirty days for clients, seven for staff — or immediately when you sign out.

There are no advertising cookies, no third-party analytics, and no tracking pixels anywhere in the portal. Portal pages are also marked no-index, so search engines do not list them.

Who Else Sees It

Inside the firm — Scally staff working on the portal and your project can see your project information. Clients see only the projects they belong to, never another client's.

On your project — consultants and contractors working on your project receive what they need to do their part, as your signed agreement contemplates.

Service providers — the portal runs on infrastructure the firm does not own, and each provider processes data only to run the service:

• Netlify (web hosting) and Railway (application hosting)
• MongoDB Atlas (the database)
• Cloudflare R2 (file and document storage)
• The firm's email provider (delivering portal email)

Legal — we disclose information where the law requires it, or to establish or defend legal claims.

How Long We Keep It

Project records are kept while the engagement is active and for a reasonable period afterwards, consistent with the firm's professional and legal obligations. Signed proposals and their signing records are kept indefinitely — they are contracts.

Sign-in codes expire in ten minutes and are destroyed once used. Sessions expire on their own and are deleted when you sign out.

When access merely ends — the firm passes on a project, or a staff member leaves — your account itself is kept, so work you authored or signed keeps its name attached to it. An account can also be deleted outright, at your request or the firm's. Deleting it does not touch a signed proposal: the document and its signing record stand on their own, each signature carrying the name that was typed at signing.

How It Is Protected

Access requires a code sent to your email; there are no passwords to leak. Sign-in codes and session tokens are hashed at rest and never stored or logged in readable form. Traffic is encrypted in transit, project files are served through short-lived links after a membership check, and significant actions are recorded in an audit log.

No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

Your Choices

Write to contact@scallyarchitects.com to:

• Ask what personal information we hold about you
• Correct anything inaccurate
• Request deletion of information we are not required to keep
• Ask for a copy of a document or a signed agreement

We may need to keep records tied to a signed agreement, an invoice, or a legal obligation even after such a request, and will say so if that is the case.

Portal email is transactional — sign-in codes, invitations, document notices — so there is no marketing list to unsubscribe from. Declining the sign-in code email means declining access.

Children

The portal is for the adults engaged on a project. It is not directed to children under 13, and we do not knowingly collect their information. A questionnaire answer may mention a client's children in the course of describing a household; that is treated as the client's project information like anything else here.

Changes to This Policy

This policy is versioned alongside the terms of service. When it changes substantively, you are asked to review and accept the new version the next time you use the portal, and the date and version of your acceptance are recorded on your account.

Contact

Questions about this policy, or about the information we hold:

• Email: contact@scallyarchitects.com
• Mail: Scally Design + Construct, 105 Washington St SE, Suite 201, Huntsville, AL 35801