Privacy Policy

1. Introduction

SHAFT Master Services Company LLC dba ClickDrag ("ClickDrag," "Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the ClickDrag Cost Segregation Platform ("Service").

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, and company/firm name
• Property Information: Property address, purchase price, property type, building specifications, and construction details
• Documents: Construction invoices, AIA documents, job cards, blueprints, site photos, and other property-related files you upload
• Payment Information: Processed securely through our payment processor (Stripe). We do not store your full credit card number.
• Communications: Messages sent through our chat feature, contact forms, or email correspondence

2.2 Information Collected Automatically

The following data is collected as you use our site, even if you do not fill out any form or create an account, unless you click “Decline” on the cookie banner or your browser sends a Global Privacy Control signal (see Section 8). It is not collected on the chat widget embedded on partner sites or on the client document-request pages (including the preparer-branded upload links), which show no cookie banner:

• Pages visited — URLs and timestamps of pages you view
• Steps and buttons — which steps of our forms you reach, which “book a call” button you press, and whether you finish scheduling a call in the calendar shown on our page, recorded against the session identifier below
• Referring URL — the webpage you visited before arriving at our site
• Marketing parameters — UTM source, medium, campaign, term, and content values appended to URLs
• Device & browser — browser type, operating system, and device category (desktop / mobile / tablet) derived from your User-Agent string
• Approximate geolocation — country, region, and city derived from your IP address by our hosting provider (Vercel). In our own visit records we store only a hash of your IP address. Google, LogRocket and Sentry receive your IP address when their tools load; after you decline, our error reports no longer ask Sentry to record it. When you answer our quiz as a tax professional, we also keep a keyed one-way hash of your IP address (not the address itself) for up to two days, only to limit how many alerts one network can trigger.
• Session identifier — a randomly generated UUID stored in your browser's localStorage that associates page views within a visit and across return visits. It is created unless you decline cookies or your browser sends a Global Privacy Control signal, and it is deleted when you click “Decline.”

2.3 Information Extracted from Uploaded Documents

When we process the documents you upload (such as invoices, AIA pay applications, and job cards), our extraction systems capture the information contained in them. This can include business contact information belonging to third parties who appear in those documents — for example, the names, company names, phone numbers, email addresses, and addresses of contractors, architects, vendors, and suppliers.

• Extracted third-party business contact information may be retained in a de-duplicated business directory that we use for service operations and for our own business development and marketing outreach to those businesses.
• This directory contains business contact details only; it is kept separate from your account data and is not used to market to you.
• By uploading documents, you represent that you have the right to share them with us for processing.

2.4 Information Received Through Our API and MCP Server

Our cost segregation API (https://www.clickdragfinance.com/api/agent/v1) and our MCP server (https://www.clickdragfinance.com/api/mcp) let an AI assistant or other software answer cost segregation questions and request a consultation with us for you. This section covers what we receive through them. The assistant or app you use, and the company that runs it, sends us this information and may keep its own record of your conversation under its own privacy policy, which this policy does not cover.

• Quotes, pricing, benchmarks and provider facts: The tools that quote a property, or return our pricing, benchmarks or provider facts, use the property details sent with the request (such as a property type, a price or a date) only to calculate the reply. They do not save those details in our database, and they send no email.
• Consultation requests: When an assistant requests a consultation for you, it sends us your email address and, if it supplies them, your name, your phone number, the property type, the property address, an approximate purchase price or construction cost, the tax year you want the deduction in, any notes you asked the assistant to pass on, and the name the assistant gives for itself. We add a reference code and the date and time of the request.
• Why we use them: To reply to your request for a consultation and to keep a record of it. We record the assistant's name to count how many requests reach us through AI assistants.
• Who receives them: We send the request by email, through our email provider (Resend), to the inbox of ClickDrag Finance's Managing Director, and store it in our database (Supabase), where he and the staff we authorise can also see it in our internal records; if the database save fails, the email is the only copy. The request itself sends no automatic email to the address you give; the Managing Director may write to that address to reply to your request. The scheduling link we return contains none of your details.
• How long we keep them: We do not delete consultation requests automatically. The record in our database and the email in the Managing Director's inbox are kept until you ask us to delete them. A deletion does not reach the copy of that email kept by our email provider or our database backups, which are kept for the periods those services set under our plans with them.
• Your choices: To see, correct or delete a consultation request, email howard@clickdragfinance.com with the email address you gave and, if you have it, the reference code. We reply only to the email address given in the request, and we send its details or change or delete it only after you confirm from that address by replying with the code we send. Section 7 describes your rights and how we respond.
• Your IP address: We use the IP address a request comes from (for an IPv6 address, only its first 64 bits) to limit how many requests one address can make each minute. It is held only in the memory of the server that handles the request and is not written to our database. Once the one-minute limit has passed, it is removed from that memory by a clean-up that runs every 5 minutes while that server is running, and it is gone when that server stops. Our hosting provider (Vercel) also receives your IP address with each request, as it does for every page of this site, and records it in its request logs with the time, the web address requested and the name of the software making the request; it keeps those logs for a limited period under our hosting plan.
• Logs and error reports: Our code does not write the information you send to its logs, apart from the web address of the request, which our hosting provider (Vercel) records as the IP address item above describes and which, for a tool that takes its inputs in the web address, includes those inputs. Any error report or performance sample our error-monitoring service (Sentry) receives from these routes leaves out the body of the request and your IP address.

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Service
• Process and generate cost segregation studies for your properties
• Process payments and send transaction-related communications
• Send you updates about your report processing status, including step-by-step progress notifications for studies you purchase
• Contact you through the communication channels you provide (such as email and phone) with service, administrative, and — with the ability to opt out — marketing communications, which may be sent individually or to groups of users
• Maintain a business directory of third-party contact information extracted from uploaded documents, used for service operations and our own business development and marketing outreach (see Section 2.3)
• Respond to your inquiries and provide customer support
• Improve our AI analysis accuracy and service quality
• Keep de-identified study records (with names, contact details, addresses, entity names, documents, signer identities and branding removed) to maintain and improve the Service, including after an account is closed or its data is deleted, as described in Sections 8.4 and 8.5 of our Terms of Use
• Comply with legal obligations and enforce our Terms of Use
• Detect, prevent, and address technical issues or fraudulent activity

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Service Providers: Third-party services that help us operate the Service (cloud hosting, payment processing, email delivery, AI/ML providers for document analysis)
• Professional Reviewers: Qualified professionals or CPAs who may review your study for quality assurance
• Legal Requirements: When required by law, subpoena, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure cloud infrastructure with access controls
• Regular security assessments and monitoring
• Role-based access control for internal staff
• Secure document storage with automatic expiration policies

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

6.1 Standard Retention Period

Uploaded source documents — AIA pay applications, invoices, blueprints, site photographs, and other files you upload for processing — are retained for up to seven (7) years from the date of upload and are then permanently and automatically deleted from our cloud storage and database. Generated deliverables — cost segregation study PDFs and Excel workbooks — are retained for at least seven (7) years from the date of generation and are not deleted automatically. Seven years is longer than the general three-year period for IRS assessment under IRC §6501(a), but a longer period applies in some cases (for example, six years under IRC §6501(e) for a substantial omission of income), so keep your own copies for as long as your tax position requires. A partner firm's data follows Section 8.4 of our Terms of Use instead.

6.2 Advance Notice of Scheduled Deletion

When any document in your account is within 90 days of its scheduled deletion date, we will send an email notification to the account administrator. This notice is sent automatically on the 1st of each month for any qualifying documents. It is for your awareness only — no action is required to proceed with deletion. You may download any document before its deletion date via your account dashboard.

6.3 Early Deletion (User Request)

You may request early deletion of your uploaded source documents at any time through your account Settings page (Data & Privacy tab). Upon submission, a 24-hour grace period applies during which you may cancel the request. After the 24-hour grace period, source documents are permanently deleted at the next nightly run.

Exception — generated study reports: Cost segregation study PDFs and Excel deliverables are retained for at least seven years regardless of early deletion requests, so that a copy remains available if the IRS examines a return that relies on them, and cannot be deleted early. By submitting an early deletion request, you acknowledge and accept this limitation.

6.4 Account Deletion

If you close your account, your profile and contact information are deleted immediately. Your uploaded source documents and generated study reports follow the retention schedule in §6.1 and §6.3 above — they are not deleted solely because your account is closed.

6.5 Data Summary

7. Your Rights

Depending on your jurisdiction, you may have the following rights. To exercise any of them, use the Data & Privacy tab in your account Settings or contact us at howard@clickdragfinance.com. We will respond within 30 days.

• Access: Request a copy of the personal data we hold about you, including your profile, uploaded documents list, and generated reports.
• Correction: Request correction of inaccurate personal data (name, email, contact information) through the Profile tab in Settings or by contacting us.
• Deletion: Request deletion of your uploaded source documents through the Data & Privacy tab in Settings, or request full account deletion. Generated study reports are retained for at least seven years under Section 6.3 and cannot be deleted early.
• Portability: Request a structured export of your data (property information, report metadata, and uploaded document list). Contact howard@clickdragfinance.com for a data export.
• Objection / Opt-out: Opt out of non-essential communications at any time via the Notifications tab in Settings or by emailing us.
• Withdraw consent: You may decline analytics and advertising cookies at any time by clicking “Decline” on the cookie banner, or by choosing “Cookie settings” (below in Section 8, and in the site footer on pages that show it) and then “Decline.” You can also clear your browser's cookies and site data.

8. Cookies

We use first-party cookies and browser storage, and we load measurement tools from Google (Google Analytics, Google Ads and Google Tag Manager) and LogRocket, and error monitoring from Sentry. Google's tools can set advertising and measurement cookies, including _gcl_* conversion cookies used to measure our Google Ads. Google's tools and LogRocket load unless you click “Decline” on the cookie banner. Sentry error monitoring always loads; its session replay and performance tracing do not run if you decline. If your browser sends a Global Privacy Control signal, we treat that as a decline unless you then click “Accept” in Cookie settings. If your browser blocks storage, we treat that as a decline.

What “Decline” does and does not do

• When you decline, the next time a page is fully loaded we do not load Google Analytics, Google Ads, Google Tag Manager or LogRocket; we also stop our own visit tracking and experiment events, stop saving ad-source information, and turn off Sentry Session Replay and performance tracing. We delete the cookies and browser-storage entries (localStorage and sessionStorage) named cd_visitor_id, cd_attribution, _ga, _ga_*, _gac_*, _gcl_* and _lr_*, and we repeat that whenever a page loads and your choice is a decline.
• On the page where you click it, Google Tag Manager and the Google tag stay in memory until the page is fully reloaded or closed; moving between pages of our site does not always reload it. We tell them you declined (Google's consent signals) and switch off Google Analytics sending, but until then Google may still receive cookieless signals. Google Ads has no separate off switch, so for it we rely on that declined signal. We cannot recall data already captured before you clicked.
• Declining does not stop error reports to Sentry, which we use to find and fix bugs, or cookies the Service needs to work, such as the sign-in session.
• To change your choice, use Cookie settings here, or in the site footer on pages that show it.

Session recording

Recording starts when you visit the calculator, qualifier, estimate or start pages and continues on the pages you view afterwards until the page is reloaded or closed. LogRocket records pages viewed, clicks, scrolls and the page content shown. Typed input is masked and the bodies of requests and responses are not recorded. It also records the web addresses of requests your browser makes, browser console messages and your IP address. Information you typed is recorded if a page later displays it. Sentry may record a sampled replay of a session, and of sessions in which an error occurs, using Sentry's default masking of text and form input.

You can also configure your browser to refuse cookies, but some features (login, document upload) require session cookies to function.

9. Third-Party Services

The Service integrates with third-party services for document processing, AI analysis, payment processing, email delivery, site analytics, advertising measurement, session recording, error monitoring, and appointment scheduling. These services have their own privacy policies, and we encourage you to review them. Key third-party services include:

• Supabase (database and authentication)
• Stripe (payment processing)
• Resend (email delivery)
• Vercel (hosting)
• Google Analytics, Google Ads and Google Tag Manager (site analytics, advertising measurement and tag management; not loaded if you decline)
• LogRocket (session recording on the calculator, qualifier, estimate and start pages; not loaded if you decline)
• Sentry (error monitoring; session replay and performance tracing are off if you decline)
• Calendly (appointment scheduling, loaded when you open the scheduling panel to pick a time)

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service with a revised effective date. Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: