BC-Check
Privacy Statement
Last updated: October 26, 2026 (draft).
This statement explains, in plain English, how R T Architectural Design & Consultants LLC ("RTAD," "we," "us") handles information in BC-Check, our automated building-code pre-check tool for architects, engineers and designers. It supplements our general Privacy Policy. If the two conflict for BC-Check, this statement controls.
1. The short version
- You buy a review on Stripe, then upload your files on the BC-Check upload page (email still works if your receipt has not switched to that page yet). We use them only to run your review and email the findings report to the address used at checkout when the review is complete.
- Plan sheets are read with our AI processor (xAI's Grok API) under zero data retention: the provider does not write them to disk or use them for training.
- We use your files only to run your review. We do not use them to train AI models or for marketing unless you opt in in writing.
- Uploaded files are deleted automatically 30 days after they arrive (a bucket lifecycle rule), or sooner if you ask. The same 30-day window is what we aim for on files you email.
- We never see or store your full card number. Payments are handled by Stripe.
- We do not sell your personal information.
2. How a paid review works today
| Paid review (today) | Online upload | |
|---|---|---|
| How you send files | Email after Stripe checkout, if the receipt still says we will email upload instructions | Private upload page linked from the Stripe receipt (/bc-check/upload). The page only opens for a paid BC-Check Checkout Session. |
| Where files are processed | Our systems plus our AI processor (xAI) | Same |
| How you get the report | Emailed when the review is complete | Emailed to the address used at checkout |
| Payment | Stripe Payment Links / Checkout | Stripe |
Everything below about file handling, retention and subprocessors applies to paid reviews today, unless stated otherwise.
3. What we collect
- Account details: name, work email, firm, role, and the states where you practice.
- Project files you send: plan sets, property appraiser cards, product approvals / Notices of Acceptance (NOAs), energy reports and spec sheets, uploaded on the BC-Check page or emailed. These can contain your clients' names, property addresses and parcel data. The upload form also stores the project site address, city, county, state, and any notes you type.
- Review data: what BC-Check extracted from your files, your corrections, and the findings report.
- Billing records: purchases and invoices. Stripe gives us only limited card details (such as card brand, last four digits and expiration date). We never receive the full card number or security code.
- Contact form: what you enter on our website form (name, email, firm, role, states, message, consent). The form name in our systems remains
bc-check-early-access. - Technical data: IP address, browser, timestamps and security logs, used to run and protect the service.
4. Why we use it
- To run the code check you asked for and deliver your report.
- To manage billing and deliver your report.
- To provide support, fix errors and keep the service secure, including preventing abuse.
- To keep records the law requires (for example, tax and accounting records).
- To answer questions or state requests you send through the contact form.
No training, no marketing. We do not use your project files, extracted data or reports to train or improve AI models, or for marketing or case studies, unless you give us separate written opt-in. You can withdraw that opt-in at any time.
5. Where your files go
- Private object storage. Files sent through the upload page are stored in a private Cloudflare R2 or Amazon S3 bucket (the one RTAD configures). The bucket is not public. The browser uploads directly with a short-lived link that works only for that paid checkout. Download links in the internal notice expire. A lifecycle rule deletes objects 30 days after upload.
- Email, when you use it instead. Files you email are stored with our email provider.
- Our AI processor, xAI. To read drawings, BC-Check sends plan sheet images and related text to xAI's Grok API. Our xAI account uses xAI's Zero Data Retention (ZDR) setting: plan sheets and the AI's responses are processed in memory, are never written to disk by xAI, and are never used to train AI models. Because ZDR switches off xAI's file storage and batch-processing features, BC-Check does not use them.
- Nowhere else, except as listed in Section 8 or when the law requires it.
6. How long we keep things
| Data | Default retention |
|---|---|
| Project files you upload or email, and extracted data | Upload bucket: deleted 30 days after the object arrives (lifecycle rule), or sooner on request. Emailed files: we aim for the same 30 days after the review closes, or sooner on request. |
| Findings report | Downloadable until the project files are deleted [confirm: whether a report-only copy is kept longer] |
| AI processor copies (xAI) | None: processed under zero data retention, never written to disk |
| Account and billing records | As long as your account is open, then as required by law (for example, tax records) |
| Contact form entries | Until you ask us to delete them, or after a limited period [confirm schedule] |
| Security logs | A limited period [define, e.g. 90 days] |
Backups can hold deleted data for a short extra period before they rotate out [define backup window].
7. How we protect it
- Per-payment isolation: uploaded objects are stored under that Stripe Checkout Session id. Every upload and download link is checked against a paid BC-Check session. Other customers cannot see your files.
- Encryption: in transit (HTTPS/TLS) and at rest on our storage.
- Least access: only the people who need it to run or support the service can reach customer data, and that access is logged.
- Payments off our servers: card entry happens on Stripe's hosted checkout page.
No system is perfectly secure. If we learn of a breach that affects your information, we will notify you as required by law, including Florida's notice law (Fla. Stat. § 501.171) and Arizona's (A.R.S. § 18-552).
8. Subprocessors
| Provider | What they do | Data involved |
|---|---|---|
| xAI (Grok API) | AI vision reading of plan sheets, under zero data retention | Plan sheet images and related text (not stored) |
| Stripe | Payments | Billing details; card data collected directly by Stripe |
| Netlify | Website hosting and the contact form | Form entries; website visit logs |
| Cloudflare R2 or Amazon S3 (private bucket) | Stores files from the upload page | Plan set, property card, supporting documents, project address, notes |
| Email provider | Receives files you email, and sends the upload confirmation and the findings report | Your email address, project files you attach, and the report |
We will update this list before adding a new subprocessor that handles project files.
9. Your choices and rights
- Delete a project by emailing us. We delete it from our active systems within [X] business days.
- Ask us to delete your contact details and project files, except records we must keep by law.
- Access or correct the personal information we hold about you.
- Withdraw an opt-in for training or marketing at any time.
Your clients' information: you are responsible for having the right to upload your clients' documents. If one of your clients asks us about their information, we will refer them to you and help you respond.
10. Florida and Arizona
BC-Check is offered by a Central Florida business and currently covers Florida statewide, plus Phoenix, Scottsdale, Tucson, Mesa, Chandler, Tempe, Gilbert, Pima County and unincorporated Maricopa County in Arizona (preview). We follow the data-breach notice laws of both states. Parcel and owner information on property appraiser cards is often public record, but we treat everything you send as confidential. [Attorney to confirm whether the Florida Digital Bill of Rights or other state privacy laws apply, and the governing-law clause.]
11. Children
BC-Check is a professional tool for businesses. We do not knowingly collect information from children under 13.
12. Changes
We will post changes here and update the date above. For a material change to how project files are handled, we will tell account holders by email before it takes effect.
13. Contact and security reports
R T Architectural Design & Consultants LLC, Central Florida Thoburn "Chip" Russell, CEO / Architectural Designer Email: rtad@architectural-design-intl.net (privacy requests and security reports; subject line "BC-Check privacy" or "BC-Check security") Phone: (407) 929-1727