How Markor handles your data.

Who we are

Markor builds estimating software for architectural millwork. Markor is the controller of the personal data described here. You can reach us at [email protected].

What we collect

• Account information. Your name, work email address, company, and role, so we can sign you in and show you your company's work.
• Project content you upload. Drawings, specifications, addenda, BIM models, vendor quotes, and the takeoffs, estimates, requests for quotation (RFQs) and requests for information (RFIs) you build from them.
• Usage information. Which features you use and when, error reports, and the browser and device you use, so we can keep the product working.
• Microsoft 365 data when you choose to connect your mailbox. This is described in its own section below.

How we use it

We use your data to run the product: to store your projects, to read the documents you upload and turn them into takeoffs and estimates, to generate the reports, RFQs and RFIs you ask for, to support you, and to keep the service secure. We do not sell personal data, and we do not use your project content or your mail to advertise to you or to anyone else.

The Microsoft 365 connection

Markor can create email drafts in your own Outlook mailbox so an RFQ or RFI you build is ready to send from your address. This is optional, and it only happens after you click Connect Outlook and sign in with Microsoft.

• Permissions we request. Mail.ReadWrite and Mail.Send to create drafts and their attachments in your mailbox, User.Read to know which account you connected, and offline_access so you are not asked to sign in again every session.
• What we do with them. We create drafts, attach the PDF or screen grabs you generated, and place your saved signature and the Markor footer in the body. Markor does not read, index, copy, or store the contents of your inbox or of any message it did not create. We do not send mail on your behalf without you clicking send in Outlook.
• Tokens. The sign-in tokens Microsoft issues are stored encrypted at rest on our servers, are readable only by the server process that creates drafts, and are never sent to your browser or to anyone else. They are refreshed silently while the connection is active.
• Disconnecting. You can disconnect at any time from the RFQ or RFI tab, which deletes the stored tokens. You can also revoke Markor's access from your Microsoft account settings or ask your Microsoft 365 administrator to do so.

Markor's use of information received from Microsoft APIs adheres to the Microsoft APIs Terms of Use.

Who else processes your data

We run on infrastructure providers who process data on our behalf and under contract: Supabase (database, authentication and file storage), Cloudflare (hosting and file storage), Fly.io (document processing), and AI model providers (Anthropic and Google) that read the documents you upload to extract sheets, schedules and specifications. Microsoft processes your mail under its own terms when you connect a mailbox. We do not share your data with anyone else except when the law requires it.

How long we keep it

Project content stays until you delete the job or close your account. Microsoft 365 tokens are deleted when you disconnect. Usage and error logs are kept for a limited period and then removed. If you close your account we delete your personal data within 30 days, except where we must keep a record for legal or accounting reasons.

Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it to run the service. Each company's data is isolated from every other company's.

Your rights

You can ask us to show you the personal data we hold about you, correct it, export it, or delete it. Email [email protected] and we will respond within 30 days.

Changes

If this statement changes in a way that matters, we will tell you inside the product or by email before the change takes effect. The date at the top is always the current version.