Privacy Policy

Effective October 28, 2026

This policy explains what information Murum, LLC (“MURUM,” “we,” “us”) collects when you use the MURUM web app at app.murum.app, the MURUM mobile apps for iPhone and Android, and the website at murum.app (together, the “Service”), and what we do with it.

Who this covers

MURUM is used by construction companies and the people they work with. A company that subscribes (the “account owner”) decides who to invite: its own staff and field crew and, for free, its subcontractors and clients. This policy covers everyone who uses MURUM, including invited users, and people whose information is entered into MURUM by a user, such as homeowners, suppliers and lien-waiver signers.

If you were invited by a company and have questions about its job records, contact that company first. See “Our role and the account owner’s role” below.

Our role and the account owner’s role

Job data belongs to the account owner. Everything a company and its team put into MURUM for their jobs (projects, estimates, contracts, photos, documents, client and subcontractor details) is processed by us on behalf of that company and under its instructions. The company decides what goes in, who can see it, and how long it stays.

Because of that:

• The account owner is responsible for having the right to put information about its clients, subcontractors, employees and others into MURUM, and for giving them any notice or getting any consent the law requires.
• Requests about job records (for example, a homeowner asking to see or delete information a contractor stored about them) should go to that company. If you send one to us, we’ll pass it to the company, and we’ll help the company respond.
• Information about your own MURUM account (your login, your profile, your support requests) is handled by us directly under this policy.

Our Terms of Service describe these responsibilities in more detail.

What we collect

Information you give us

• Account information: your name, email address, company name, role and password. Passwords are stored only in hashed form; we can’t see them.
• Company and job information: what you and your team enter or upload, such as project details, schedules, estimates, contracts, change orders, invoices, budgets, pay applications, lien waivers, daily logs, RFIs, submittals, punch lists, selections, safety records, time sheets, photos, plans, documents and contact details for clients, subcontractors and suppliers.
• Time sheets: when someone clocks in or out, we record who it is, the job, the date and time, and their hours. Clocking in and out doesn’t record anyone’s location. Time sheets are part of the company’s job records and are visible to the people the account owner allows.
• Messages you send through MURUM: when you email an RFI, estimate, invoice, task reminder or report from MURUM, we send it on your behalf and keep a record of when it was sent and to whom.
• Support requests: what you tell us when you contact us.

Electronic signatures

When someone signs an estimate, contract, change order, sub agreement, lien waiver or punch list sign-off in MURUM, we record the signer’s name and signature, the date and time they signed, the type of device and web browser they used, and the internet (IP) address the signature came from. When a client signs, we also record that they agreed to sign and receive the document electronically, and which version of that disclosure they saw. This record shows who signed what and when. We keep it for as long as the signed document is kept, because it’s part of that document. Signers are often people who don’t have a MURUM account, such as homeowners.

Information from your device and the mobile app

The app asks for permission before using these features, and you can turn them off in your phone’s settings at any time:

• Camera and photo library: to take and upload job photos and documents.
• Photo location: photos taken on a phone often include the GPS location where they were taken, stored in the photo file itself. If your phone saves location in photos, that location is uploaded with the photo and may be visible to anyone who can see that photo in MURUM. You can turn off location for your camera in your phone’s settings. MURUM does not track your location in the background.
• Notifications: if you allow them, we store a device token so we can send you notifications.
• Offline storage: daily logs and other entries made without a signal are saved on your phone until they can be sent to our servers. They stay on your device until they sync or the app is deleted.

Information collected automatically

• Technical data needed to run and secure the Service, such as sign-in times, IP address, device and browser type, app version, and error and crash logs.
• Email delivery data, such as whether an email we sent was delivered or bounced. We do not track whether you open our emails or click links in them.

Cookies and similar technologies

We use only the cookies and local storage needed to keep you signed in, remember your settings and keep the Service secure. We don’t use advertising cookies, cross-site trackers or analytics tools that profile you.

Two outside services load on this website. Our fonts come from Google Fonts, so your browser connects to Google to download them, and Google receives your IP address and browser details when it does. Our how-to videos are hosted on YouTube. A video loads from YouTube’s privacy-enhanced mode only when you press play, and YouTube’s own privacy policy applies from then on.

Do Not Track: Because we don’t track you across other websites or apps, we don’t change our practices in response to browser “Do Not Track” signals. We do honor Global Privacy Control signals as an opt-out of any sale or sharing for targeted advertising, which we don’t do in any case.

Payments

MURUM subscriptions are purchased through Apple’s App Store or Google Play. They process your payment, and we receive confirmation of your subscription status, not your card details.

Money never moves through MURUM between contractors and their clients, subcontractors or general contractors. When MURUM shows an estimate fee, change order, invoice or pay application as “paid,” that’s either a status recorded by a user or, for online payments, a confirmation from Stripe.

Online invoice payments: if a company connects its own Stripe account, its clients can pay invoices through a Pay Online link. The client enters card or bank details on Stripe’s secure checkout, and the payment goes straight to the company’s Stripe account. We receive the payment’s amount, status and Stripe reference so we can mark the invoice paid. We never receive or store full card or bank account numbers. Stripe’s own privacy policy applies to the information you give it.

Information from QuickBooks

If your company connects QuickBooks, we receive information from your QuickBooks account. See “QuickBooks integration” below.

Information from your company calendar

If your company connects a calendar from Google, Microsoft Outlook or Apple iCloud, we receive the events on that calendar. See “Company calendar connection” below.

Social Security numbers and other sensitive information

MURUM never asks for Social Security numbers, driver’s license numbers, bank account numbers or similar information, and no MURUM form requires them. Users can still upload documents that contain them, such as W-9 forms, subcontractor agreements, insurance certificates, lien waivers or lender draw packages.

If you upload documents like these:

• We protect them the same way we protect everything in MURUM. They are encrypted in transit and at rest, stored separately from other companies’ data, and visible only to people the account owner has given access to that job or document.
• Upload only what you need. Where you can, use an Employer Identification Number (EIN) instead of a Social Security number, or black out all but the last four digits before uploading.
• Control who can see them. The account owner decides which staff, subcontractors and clients can see each job and document. Before you share a job with a sub or client, check that sensitive documents aren’t visible to them.
• Don’t email them through MURUM. Email is less secure than storage inside MURUM. Some receiving email servers don’t support encryption, so an attachment can travel unencrypted. Share sensitive documents inside MURUM instead of sending them as email attachments.
• You’re responsible for having the right to upload them. The account owner and the user who uploads a document are responsible for having permission to store another person’s sensitive information and for giving any notice the law requires. We don’t review the contents of files you upload.

We don’t use sensitive information in uploaded documents for any purpose other than storing it and showing it to the people you’ve authorized. If a security breach affects this kind of information, we’ll notify the affected account owner and, where the law requires, the affected individuals and government agencies, as required by applicable breach notification laws.

How we use information

• To provide MURUM: store your jobs and files, sync them across your devices and with connected services you choose, and show each person only what their role allows.
• To send email you or your team ask MURUM to send, and account email such as invitations, daily task reminders, sign-in confirmations and password resets.
• To keep MURUM secure, prevent fraud and misuse, and find and fix problems.
• To answer your support requests.
• To tell you about important changes to MURUM, your subscription or these policies.
• To understand how MURUM is used and improve it, using technical data and de-identified or aggregated information (for example, how many daily logs are created each week across all customers). De-identified or aggregated information can’t reasonably be used to identify you, your company, your clients or your jobs, and we won’t try to re-identify it.
• To comply with the law and enforce our Terms.

We don’t use your company’s job content (your estimates, pricing, contracts, client lists, photos or documents) to train AI models.

Your data is never used to compete with you

MURUM was built by a working construction company, and many of our customers are contractors. So we make this commitment:

• No construction company affiliated with MURUM, and none of its owners or employees acting for it, has access to any customer’s data in MURUM.
• MURUM personnel can access a customer’s job data only when needed to provide support the customer asks for, to keep the Service secure, to fix a technical problem, or to comply with the law. That access is limited to the people who need it.
• We will never use a customer’s estimates, pricing, bids, client lists, subcontractor lists or other job data to bid against, compete with or solicit that customer’s clients, subcontractors or business.

AI features

On plans that include AI tools, when you ask MURUM to review a photo, draft an estimate from plans or photos, build a schedule or check a budget, the images, documents and text needed for that request are sent to our AI provider, Anthropic, to produce the result.

• Content is sent only when you or your team use an AI feature, never in the background.
• Under Anthropic’s commercial terms, it processes that content only to return the result to us and does not use it to train its models. It deletes that content within 30 days, unless it’s flagged for a usage-policy violation or the law requires keeping it longer.
• AI photo review looks at what’s in a job photo, such as materials, progress or conditions. It does not identify people or create face prints or other biometric identifiers, even if people appear in the photo.
• AI results are drafts. You’re responsible for checking any estimate, schedule or budget before you rely on it or send it to anyone.

QuickBooks integration

An account owner can choose to connect its company’s QuickBooks Online account to MURUM. When it does:

• What we receive from QuickBooks: your customer list, so each job can be matched to the right QuickBooks customer, and the payment status of invoices MURUM created, so MURUM shows which ones are paid.
• What we send to QuickBooks: invoices you choose to send from MURUM, with the customer, line items, amounts and dates. If you delete one of those invoices in MURUM, we delete it in QuickBooks too.
• How we connect: you sign in to QuickBooks and approve the connection on Intuit’s own screen. We never see your QuickBooks password. We store the access tokens Intuit gives us in encrypted form and use them only to sync your data.
• Who can see it: QuickBooks data in MURUM follows the same access rules as other job data. Your costs and budgets stay hidden from subcontractors and clients.
• How to disconnect: the account owner can disconnect QuickBooks in MURUM’s settings at any time, or from within QuickBooks. When you disconnect, we stop syncing and delete the access tokens. Information already synced stays in your MURUM account until you delete it or close your account.

We use QuickBooks data only to provide the sync and related MURUM features. We don’t sell it or use it for advertising. Intuit’s handling of your data is governed by Intuit’s own privacy statement.

Company calendar connection

An account owner or admin can choose to connect one of its company’s calendars from Google Calendar, Microsoft Outlook or Apple iCloud, so appointments booked there show up in MURUM. When it does:

• How we connect: the owner or admin pastes the calendar’s private calendar link, which the calendar provider supplies (Google calls it the secret address in iCal format, Outlook a published ICS link, and Apple a public calendar link). We store that link where only MURUM’s servers can read it. It isn’t shown in the app or sent to anyone else. MURUM can only read the calendar; it can’t add, change or delete events.
• What we receive: events on that calendar from today through the next two weeks: each event’s title, date and time, location and description. Repeating events and events added from MURUM are skipped.
• How we use it: each event becomes an appointment in the company’s MURUM account, shown on its EOD summary to the people the company chooses. Calendar data follows the same access rules as other company data.
• How to disconnect: an owner or admin can disconnect the calendar in Company settings at any time, and we delete the saved link. Resetting or unpublishing the link with your calendar provider also stops MURUM from reading it. Appointments already added stay in your MURUM account until you delete them or close your account.

We use calendar data only to show your appointments in MURUM. We don’t sell it or use it for advertising.

Who we share it with

We don’t sell personal information, and we don’t share it for targeted advertising. We share information only as needed to run MURUM:

• Service providers that host and operate MURUM for us under written contracts that limit their use of your information to providing their services to us:

• Intuit (QuickBooks), only if your account owner connects QuickBooks, as described above.
• Stripe, only if your company connects a Stripe account for online invoice payments, as described under “Payments.”
• People in your company and on your jobs, according to the access the account owner gives them. For example, a subcontractor sees only the items for their own work, and a client sees only what the builder shares with them.
• Recipients of emails and documents you send through MURUM.
• When required by law, such as in response to a valid subpoena or court order, or to protect the rights, safety and property of our users, the public or MURUM. Where the law allows, we’ll tell the affected account owner before handing over its data.
• In a business transfer, such as a merger, acquisition or sale of assets. The buyer would have to honor this policy for information collected under it.

We don’t share customer data with any construction company affiliated with MURUM.

How we protect it

Your data is encrypted in transit and at rest. Every company’s data is kept separate, and database rules control what each person can see and change, so access is enforced on our servers, not just hidden on the screen. Access by MURUM personnel is limited to the people who need it. No system is perfectly secure, but we work to protect your information. If a breach affects your information, we’ll notify you as the law requires.

You can help by using a strong, unique password, signing out of shared devices, and removing access for people who leave your company or finish work on your jobs.

Where your data is stored

MURUM is operated from the United States, and your data is stored on servers in the United States. If you use MURUM from outside the U.S., your information will be transferred to and processed in the U.S.

How long we keep it

• Active accounts: we keep your information while your company’s account is active.
• Ended subscriptions: if a subscription ends and isn’t renewed, the account owner can still sign in and export its data for 90 days. After that, we delete the company’s job data.
• Deleted accounts: if the only owner of a company deletes their account, we delete that company’s job data right away, as described in Deleting your account.
• Free trials that don’t convert: we delete the trial company’s data 90 days after the trial ends.
• Other users: if your company has another owner, or you were invited to a company, and you delete your account, we delete your login and profile. Job records you created stay with that company.
• Email and technical logs: kept for up to 12 months, then deleted.
• Backups: deleted data may remain in encrypted backups for up to 30 days until those backups are overwritten. We don’t restore deleted data from backups except to recover from a system failure.
• Records we must keep: we may keep limited records longer where needed for legal, tax, billing, dispute or security reasons, such as a record that an account was closed.

Your choices and rights

Wherever you live, you can ask us to:

• See the personal information we have about you, and get a copy in a portable format.
• Correct information that’s wrong. You can edit most of it yourself in MURUM.
• Delete your information, as described below.

Some state laws give their residents these and other rights. We extend these rights to everyone, but we do so voluntarily. That doesn’t mean any particular law applies to MURUM.

How to ask: email privacy@murum.app from the address you sign in with. We may need to confirm your identity before acting on a request. We’ll respond within 45 days and tell you if we need more time. If someone is asking on your behalf, we’ll need proof that you authorized them.

If we say no: we’ll explain why. You can appeal by replying to our answer with “Appeal” in the subject line. We’ll respond to your appeal within 45 days.

We won’t treat you differently or charge you more for exercising these rights.

If your request is about job records a company stored in MURUM, such as a contractor’s records about your home project, we’ll forward it to that company, which controls those records.

Deleting your account

In MURUM: sign in at app.murum.app or in the MURUM app, tap Account, then Delete Account. Before anything changes, MURUM shows you exactly what will be removed. To confirm, enter your password and type DELETE. Deletion happens right away and can’t be undone.

If you can’t sign in: email privacy@murum.app from the address you sign in with and ask us to delete your account. We’ll confirm the request and let you know when it’s done.

What happens next:

• If you’re the only owner of a company, that company’s MURUM account is deleted along with your login, including its jobs, records, settings and files, and everyone you invited loses access. Export anything you want to keep first, or add another owner if the company should keep going without you.
• If your company has another owner, or you were invited to a company, we delete your login and profile and remove you from the company. Job records you created stay with that company.
• Deleting your account doesn’t cancel your subscription. Subscriptions are billed by Apple or Google, so cancel in your App Store or Google Play subscription settings to stop future charges.
• We may keep limited records as described in “How long we keep it.”

Email from us

Account emails, such as invitations, security alerts and password resets, are needed to use MURUM. The account owner chooses whether task reminder emails go out right away, once a day, or not at all, in MURUM’s company settings. We don’t send marketing email unless you opt in, and every marketing email has an unsubscribe link.

Children

MURUM is a business tool and isn’t meant for anyone under 16. We don’t knowingly collect information from children. If you believe a child has given us information, contact privacy@murum.app and we’ll delete it.

Changes to this policy

If we make material changes, we’ll post the new policy here, update the effective date, and tell users by email or in the app before the change takes effect. We won’t use information we already have in a materially different way without your consent.

Contact us

Murum, LLC

• Privacy questions and requests: privacy@murum.app
• Everything else: info@murum.app