Legal

Privacy Policy

Last updated: October 19, 2026

You trust Laboro with your projects, your files and the photos your crews take on site, and we take that seriously. This Privacy Policy explains what information Laboro (“Laboro”, “we”, “us” or “our”), based in New York, NY, collects when you use the Laboro PM app for iPhone and iPad, the web app and website at laboro.nyc, and related pages and links (together, the “Service”); what we do with it; who else sees it; and how long we keep it. We wrote it to be read, not scrolled past. If anything here is unclear, write to us at info@laboro.nyc and we will answer.

Capitalized terms that are not defined in this policy, such as “Account”, “Customer Content” and “Company”, have the meanings given in our Terms of Service.

1. Information we collect

1.1 Account information

When you create an Account we collect your email address and either a hash of your password (never the password itself) or, if you sign in with Google or Apple, the account identifier that provider gives us. If you use Apple’s “Hide My Email”, we receive and use the relay address. We never receive your Google or Apple password. For Sign in with Apple we also keep the token Apple issues to Laboro, solely so that we can revoke Laboro’s access when you delete your Account.

To confirm your email address we send a 6-digit code. We store only a keyed hash of the code until it expires (30 minutes), and the date your address was confirmed. We also record which of your devices are signed in, so that your plan, balance and projects are available on each of them.

1.2 Customer Content

With an Account, the Service stores the Customer Content you save to it. In the app, each project is organized in five sections—Live, Building, Schedule, Field and Contract—and the Service stores:

• Project data — the results of your plan analyses and the state of each project: its buildings and drops; permits, special inspections and submittals; the master schedule, the next two weeks and the weather days you accept; drop inspections, progress marks, photo reports, field reports, the weekly log and notes; the bid form, quantities, change orders, pay applications, estimates and forecast; checklists, measurements and RFI logs; and the project contacts you enter (for example the owner, engineer and inspector: name, company, email address and phone number).
• Files — the plan sets, specifications, site photos, reports, submittals and other documents you upload to a project. With an Account, these files are saved to your Laboro cloud storage so that your iPhone, iPad and the web show the same files. Site photos added in Field also appear in Live.
• Drawings, 3D models and field records — the plan sheets you upload in Building (Plans and Model) and in Field → Inspections, the drawing images rendered from them, the 3D model of the building and its drops built from your drawings (“Build from the drawings”) or uploaded as a file, field-tag and inspection records, the quantities marked in the field, the names you enter for crew members and the photos added through field links.
• People on a project — on a Company project, the members added in People on this project and their role (PM or PM assistant), as described in Section 5.
• Owner-link choices — the layers you allow on the owner link, the site photos you pick for the owner, the short lines you write for the owner (for example what is blocked or what needs a decision) and the owner link’s access code (Section 4).
• Company brand and site people — a Company logo image and chosen colors, plus the names, roles and phone numbers you enter for site personnel such as project managers, superintendents, safety staff and crew foremen, in Account → Company & team. These details are used to identify your company and project contacts in the Service.
• Project weather — the project location and daily public weather information (temperature, wind and gust, and conditions) used to show weather on the project, list possible weather days and help you manage the schedule.

Company brand and site-personnel details are available to the Company team with access to the project. Phone numbers are shown only to that team. A shared owner link may show the company logo and colors, and site people’s names and roles, but never their phone numbers. Project weather and accepted weather days are shown on the owner link. Weather lookups use the project location to request public U.S. government weather data; we do not send Account information with those requests.

Without an Account, your projects and files stay only on the device or browser where you created them, except content you send for AI processing (Section 3), share through a link (Section 4) or include in a problem report (Section 1.6).

1.3 Usage and billing records

For each AI request we record a label, the document type, the number of pages and the price, so that we can quote the price before each analysis, show your monthly usage, warn you as you approach your limit and bill your plan or Credits. For Company members, these records are kept on the Company’s shared balance.

1.4 Payment information

Web payments are processed by our payment processor and in-app purchases by Apple. We receive a confirmation of each purchase, its amount and transaction identifier and, for web payments, a customer identifier. We never receive your full card details.

1.5 Building alerts

If your projects include a building identification number (BIN), we keep the list of BINs and your Account email address in order to send you permit and violation alerts.

1.6 Problem reports and support requests

When you use Report a problem (in the app: Account → Help & feedback → Send feedback; on the web: laboro.nyc/feedback), the report contains your message; the contact email address you enter, if any; your Account email address and Account identifier, if you are signed in; the app version and build; your device and operating system; the screen you were on; the name and BIN of the project open at the time; and the app’s recent error log. The report includes a copy of the project’s synced data only if you tick “Attach a copy of this project”, which is unticked by default. Files and photos are not uploaded with a report. When you email us, we receive your message and any attachments.

1.7 Device and technical information

We record when each of your devices last synced and which app version it was running, for support and security. If you use Laboro without an Account, the app generates a random identifier on your device that is not linked to your name.

1.8 Website analytics, IP addresses and browser storage

We count visits to laboro.nyc—its home page, guides, owner links and web app—without cookies and without third-party analytics. For each visit we record the page, the referring site and an approximate location (country, state and city) that our hosting provider derives from your IP address, together with a one-way hash of your IP address and browser that changes every day, which lets us count unique visitors. We do not store your IP address or browser details with these counts. We also count how many devices open the app for the first time; for this we keep the date on which each app identifier was first seen. The counts and these dates are kept for 400 days.

We use IP addresses briefly—from a few minutes up to about one day—to limit abuse, such as repeated sign-in attempts. These short-lived records are excluded from our backups. Our hosting providers keep standard request logs under their own terms.

The web app and owner links use your browser’s local storage for your session, your preferences (for example the projects you include in the weekly report), the owner-link access codes you enter, so that a code is asked only once per browser, and the projects kept on that device. We do not use cookies for analytics or advertising.

1.9 Location

We do not collect your device’s location. Cameras can add metadata to a photo (EXIF, XMP or IPTC), including where and when it was taken and with which device. When a photo (JPEG, PNG or HEIC) is uploaded to a project’s cloud files, from any device, our server removes this metadata as soon as it receives the photo, before storing it; the image itself is not re-encoded, and its orientation and color profile are kept. A photo whose metadata cannot be removed this way—for example, a burst or animated image sequence—is not accepted. Photos uploaded through field links also have this metadata removed by our server, and photos sent for AI reading are re-encoded on your device without it. Photos saved to a project before this policy took effect keep the metadata they had; you can delete them and upload them again. The copy of a photo that stays on your device is not changed, and documents such as PDFs are stored as they are.

1.10 Camera and microphone

The app uses your camera only when you take a photo for a project, for example with + Report in Field, and only after you allow it. On the web, the microphone button for notes and photo reports uses your browser’s built-in speech recognition: your browser—and, depending on the browser, its maker’s speech service—handles the audio under its own terms, and Laboro receives only the text you save. We do not record or store audio.

2. How we use information

• To provide the Service, including the plan analyses, permit and inspection lists, schedules, quantities, change orders, estimates and reports you request.
• To build the 3D model of the building from your drawings, show the job at any date in Live, and publish the owner link with the layers you choose.
• To record the weather at the project location and list possible weather days for you to accept or ignore.
• To prepare the weekly reports and other documents you ask for.
• To keep your projects and files in sync across your devices and to publish what you choose to share.
• To meter and bill your plan, Credits and storage, and to show the price before each AI request.
• To send service emails: confirmation and password-reset codes, Company invitations and building alerts.
• To respond to support requests and diagnose the problems you report.
• To secure the Service and prevent abuse.

3. AI processing

Certain features use a third-party AI service provider through its commercial API. In the app these features appear as “Laboro AI” and “Labo”. When you run one of them, the documents or images it needs are sent to that provider together with our instructions, and the result is returned to you. Specifically:

• plan sets and drawings you upload for analysis;
• elevation sheets and facade photos read to build the 3D model (“Read with AI” in Building → Model);
• engineers’ field reports (Field → Reports) and bid forms;
• contractors’ look-ahead schedules (TWLA PDFs) you import, where that option is offered;
• Project Manual sections and plan-detail images used by “Check with Labo” submittal checks (Schedule → Permits → Submittals).

Each of these readings shows its price before it runs and is billed to your plan’s monthly usage or your Credits, as described in Section 4 of our Terms of Service.

Requests are sent under Laboro’s own account with the provider and do not include your name, email address or Account identifier. Under the provider’s commercial terms, content sent through its API is not used to train its models; the provider may retain it for a limited period under those terms, for example for safety and abuse monitoring. We do not use Customer Content to train AI models.

The following features do not send your documents to an AI provider: “Build from the drawings”, the tags engine, Live and the owner link, weather days, quantities and change orders, the weekly report, and the schedules, compliance lists and estimates that the app computes from results already in your project.

4. Sharing you control

Other people see your information only when you or your team share it:

• Owner links. When you publish a project’s owner link from Live → Share, a read-only copy of the project’s Live page is published at that link and can be opened by anyone who has it. It always shows the project’s name, address, permit number and progress, your company logo and colors, site people’s names and roles (never their phone numbers), the weather and accepted weather days, the names of the parties you entered (for example the owner, engineer and inspector) and a site logistics plan if the project has one. It shows the following layers only when you turn them on: 3D (the building, its drops and the schedule over time), Brief (what was done, what is next, what is blocked and what needs the owner’s decision, including the lines you write for the owner and the change orders or pay applications awaiting the owner, identified by number and without amounts), Photos (thumbnails of the site photos you pick or, if you pick none, the most recent ones), Docs (the names and dates of project documents, never the files) and Inspections. New projects start with 3D, Brief and Photos turned on. The owner link never shows the Contract section—the bid, prices, quantities or amounts—nor your notes, phone numbers or internal warnings. You can protect a link with a 4-digit access code, which a viewer enters once per browser; the code is kept with the project so that you can send it, and the server that publishes the link stores only a keyed hash of it. You can take a link offline at any time with Unpublish owner link in Live → Share → Owner link settings; publishing it again uses the same address. Deleting the project also unpublishes its link. Otherwise, a link published while signed in to an Account stays online until you delete your Account—except the owner link of a Company project, which stays with the Company (Section 10.2)—and a link published without an Account stays online until 120 days after its last update.
• Look-ahead links. Where a read-only look-ahead page is published for a project, anyone with the link can view it. These links expire after 90 days, can be revoked earlier and stop working when the Account that created them is deleted.
• Field links. If you create a field link for a foreman, crew member or engineer in Field → Inspections, the person with the link can view the drawings assigned to it and, depending on the link, add marks, photos or a sign-off. Crew links record the name you enter for that person and expire after 30 days by default (up to 90 days). The field links of a project stop working when the project is deleted (Section 10.1).
• Companies. Within a Company, project information is shared as described in Section 5.
• Connected assistants. Where Laboro Connect is available on your plan and you connect an AI assistant of your own to your Account, that assistant can read the projects of your Account and, only with the permissions you grant, make changes, which are recorded on the project (Section 10.1). What the assistant receives is processed by its provider under your own agreement with that provider. You can revoke a connection at any time; write to support@laboro.nyc if you need help.
• Exports. Content you export or send yourself, such as the weekly report, change orders, PDFs, spreadsheets or messages, is handled by the recipients you choose. A weekly report can include contract figures, so review it before you send it.

5. Company accounts

If you join a Company on the company plan:

• The Company owner and the Company’s admins can see your email address and how much of the Company’s shared usage you spent each month.
• Projects created inside the Company belong to the Company. Each one is visible to its creator, the Company owner, the Company’s admins and the people added to it in People on this project as PM or PM assistant, who can see each other’s email addresses on that project.
• The Company’s brand and its list of site people are shared with its members; site people’s phone numbers are shown only to the Company team (Section 1.2).
• To invite a member, the Company owner or an admin enters the member’s email address. We store it with the invitation for 14 days and send an invitation email.
• If you leave the Company, are removed from it or delete your Account, the Company’s projects and their files remain with the Company and you lose access to them.
• If the owner deletes a Company that has no other members and no active paid plan, its projects return to the owner’s personal Account.

6. Service providers and public data

We share information with the following providers as needed to operate the Service. Each processes it under its own terms and privacy commitments.

Public data sources. To look up building records, permits and violations, the Service sends building addresses and BINs—never your Account information—to NYC Open Data (Department of Buildings datasets) and NYC Planning GeoSearch. Some of these requests are made directly from your device or browser, so those services also receive your IP address.

Content delivery services. Some pages and app screens load open-source components and fonts from public content delivery services. Those services receive your IP address and browser information when files are downloaded.

Weather. For a project with a location, we request public weather observations and forecasts from the U.S. government (the National Weather Service) using that project location. We store the returned daily temperature, wind and gust, and condition with the project. We do not send Account information with the request.

7. Access by Laboro personnel

Authorized Laboro personnel can view Account details—email address, plan, usage, last activity, and project names, addresses and sizes—to provide support and operate the Service. Laboro personnel access the contents of a project for support only when you attach the project to a problem report or ask us for help with it. We may use AI-assisted tools to help review and diagnose problem reports.

8. Where information is processed

Laboro is based in New York, NY, and the Service is hosted primarily in the United States: our application hosting, our file server (New York City), our backups (US East) and our AI, payment and email providers process information in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

9. Data retention

Backups. We keep encrypted backups to protect against data loss. Our main database is exported to a backup vault, normally every hour; each export cannot be altered or deleted for 30 days, and it is removed after about 30–36 days. The file server is backed up separately: its daily database snapshots are removed after 30 days, and the backup copy of a file is removed within 31 days after the file is removed from the Service. During these periods backup copies cannot be deleted individually on request. When we restore the main database from a backup, we re-apply the Account and project deletions recorded after that backup was made.

10. Deleting projects and your Account

10.1 Projects

When you delete a project while signed in to your Account, whether or not it was synced—or, in a Company, when its creator or the Company owner deletes it for everyone—it is removed from your Account and from your other devices, and:

• its owner link is unpublished and its look-ahead links are turned off; both stop working immediately;
• the record Labo keeps of the changes it made to the project, with the before and after of each change, is deleted;
• its cloud files and its drawings, plan sets, 3D models, field photos and field records (Building and Field → Inspections) are permanently deleted from the Service, normally within one day, and its field links stop working. Files uploaded to the project after the deletion from a device that has not yet received it are removed by a second deletion pass, normally within two days. A 3D model file uploaded before this policy took effect is not linked to a project and is deleted with your Account;
• backup copies are removed as described in Section 9.

We keep a small marker—the project’s internal identifier and deletion date, with no project content—so that your other devices remove it too. A Company member who removes a Company project from their own list only loses access to it; the project remains for the others. A project kept without an Account exists only on your device or browser; deleting it there while you are online also unpublishes its owner link.

10.2 Your Account

You can delete your Account at any time in the app on iPhone, iPad or the web: open Account → Profile and select Delete account (under Advanced). Deletion starts immediately and is normally completed within one day. It erases:

• your Account: email address, password hash and the link to Google or Apple (for Apple we also revoke Laboro’s Sign in with Apple access);
• your balance—remaining Credits are forfeited and cannot be restored;
• the projects synced to your Account, including the record Labo keeps of the changes it made to them, and their cloud files, and the drawings, 3D models and field records of your projects in Building and Field → Inspections (field links stop working);
• your building alerts, including the email address they are sent to;
• the owner links and look-ahead links published from your Account, which stop working. The owner link of a Company project is not erased: it passes to the Company and stays online, and the people with access to that project can unpublish it. Owner links published without an Account belong to the device that published them and stay online until 120 days after their last update;
• your usage counters, confirmation and password-reset codes, and app activity records;
• the personal details in your problem reports: your email addresses, Account identifier, device, app version, screen, error log and any attached project copy. We keep only the text of each report, its type and its date, which are no longer linked to you.

Projects you created inside a Company remain with the Company. Projects saved on your device or in your browser remain there until you delete them in the app or remove the app.

After deletion we keep, for accounting, refunds and fraud prevention: transaction records (transaction identifier, amount and a one-way hash of your email address) for up to 400 days; a marker, keyed to the same hash, that prevents claiming welcome credits again, for up to 400 days; and a deletion marker for 31 days. Anonymized problem reports are kept as described in Section 9, and backups expire as described there. Apple, Google and our payment processor keep their own records under their privacy policies.

11. Your choices and rights

• You can stop using the Service at any time, delete individual projects, and delete your Account from Account → Profile → Delete account.
• You can ask us for a copy of the information associated with your Account, or ask us to correct or delete it, by writing to info@laboro.nyc from the email address on your Account. We may need to verify your identity before acting on a request.
• You can ask us at info@laboro.nyc to delete your problem reports before their 12 months are up.
• Depending on where you live, state privacy laws may give you additional rights: to know what personal information we hold about you, to correct or delete it, to receive a copy in a portable format, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be treated differently for exercising those rights. We do not sell personal information and do not use it for targeted advertising. To exercise any of these rights, write to info@laboro.nyc from the email address on your Account; we will respond within the time the applicable law allows, and if we decline a request you may appeal by replying to our response.
• You can choose what an owner link shows, and unpublish it yourself, in Live → Share (Section 4).
• If you use Laboro without an Account, your projects stay on your device or browser, and you can remove them by deleting them in the app or removing the app. For questions about information tied to your app identifier, contact us and include the Support code shown in Account → Help & feedback.

12. Security

We protect information with measures appropriate to the Service, including:

• encryption in transit (HTTPS) between your device and the Service;
• passwords stored only as salted hashes (scrypt), confirmation codes stored only as keyed hashes, and owner-link access codes checked against a keyed hash on the server that publishes the link;
• sessions that expire after 30 days, and a password reset that signs your Account out of your other devices;
• private, encrypted backups;
• access to production systems limited to authorized personnel, and rate limits on sign-in and other sensitive requests.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your sign-in credentials confidential and tell us at support@laboro.nyc if you believe your Account has been compromised.

13. Children

The Service is intended for construction professionals and is not directed to children. Accounts are for people 18 and older (Terms of Service, Section 3), and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to info@laboro.nyc and we will delete it.

14. What we do not do

• We do not sell your information.
• We do not use your documents or projects for advertising.
• We do not use Customer Content to train AI models.

15. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page, and for material changes we will make reasonable efforts to notify Account holders in the app or by email.

16. Contact

Laboro, New York, NY
Privacy questions and requests: info@laboro.nyc
Help with the Service: support@laboro.nyc

See also our Terms of Service and Support page.