Privacy Policy

This Privacy Policy describes how Affected Area Mapping Solutions, Inc., a Delaware corporation doing business as Gamut ("Gamut," "AAMS," "Company," "we," "us," or "our"), collects, uses, stores, shares, and protects information when you use our websites, mobile applications, software platform, artificial intelligence estimating tools, augmented reality capture tools, customer portals, integrations, and related services (collectively, the "Services").

Gamut provides technology for property restoration professionals, carriers, contractors, adjusters, and related users to document affected areas, capture project data, support estimating workflows, and generate restoration-related outputs.

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We collect information in the following categories.

A. Account and Contact Information

• Name
• Company name
• Job title
• Email address
• Phone number
• Billing address
• Business address
• Username, password, and authentication information
• Account preferences
• Customer support communications

B. Project, Claim, Property, and Estimate Information

Because Gamut is used in connection with property restoration and insurance-related workflows, users may upload, capture, or generate information related to a project, claim, property, affected area, estimate, or restoration assignment, including:

• Property address or job site location
• Room names, dimensions, layouts, measurements, and affected areas
• Photographs, videos, scans, augmented-reality capture data, extended-reality capture data, or photogrammetry data
• Materials, finishes, damages, trades, scope notes, line items, sketches, and estimate-related information
• Claim numbers, carrier names, adjuster information, contractor information, and customer information
• Notes, comments, documents, attachments, reports, invoices, and related project records
• Data imported from or exported to third-party platforms, estimating systems, claims systems, or restoration management systems

Users are responsible for ensuring they have the necessary rights and permissions to upload, capture, or process project, claim, property, and customer information through the Services.

C. Images, Video, Spatial, and Device Sensor Data

Certain Gamut features may require access to a device camera, photo library, microphone, LiDAR sensor, motion sensors, AR functionality, or related device features. We may collect or process:

• Photos and videos captured through the app
• Room scans, measurement data, spatial maps, depth data, and object-recognition data
• Metadata associated with photos, videos, or scans
• Audio only where a feature expressly requires it and the user enables it

We use this information to provide documentation, measurement, mapping, estimating, quality control, and related platform functionality.

D. Mobile App Permissions

Depending on the features used, the Gamut mobile application may request access to:

• Camera: to capture property photos, videos, scans, affected areas, room conditions, materials, and restoration documentation.
• Photo Library: to upload or attach existing photos or videos to a project.
• Microphone: if a feature allows voice notes, narrated walkthroughs, video recording, or similar functionality.
• Location Services: to identify or confirm project addresses, job site locations, mapping information, routing, fraud prevention, or field documentation.
• Bluetooth, Wi-Fi, or Local Network Access: if the app connects to external cameras, sensors, scanning equipment, or nearby devices.
• Motion, LiDAR, depth, or AR-related sensors: to measure rooms, map affected areas, identify objects or materials, and support augmented reality or spatial capture features.
• Notifications: to provide project updates, task reminders, account alerts, workflow notices, or service-related communications.

You can manage these permissions through your device settings. Disabling certain permissions may limit the functionality of the Services.

E. Usage, Device, and Technical Information

• IP address
• Device type
• Operating system
• Browser type
• Mobile device identifiers
• App version
• Log data
• Pages or screens viewed
• Features used
• Session duration
• Crash reports
• Diagnostic data
• Approximate location inferred from IP address
• Security and authentication logs

F. Payment and Subscription Information

• Billing contact information
• Subscription plan
• Payment status
• Transaction history
• Limited payment metadata

We do not intentionally store full credit card numbers on our systems. Payment card data is processed by our payment processor.

G. Communications and Support Information

If you contact us, we may collect information you provide through email, phone calls, support tickets, chat or helpdesk tools, product feedback, surveys, sales inquiries, implementation communications, or onboarding communications.

2. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the Services
• Create and manage user accounts
• Capture, process, analyze, and generate project, mapping, estimating, and restoration outputs
• Support artificial intelligence, computer vision, object recognition, augmented reality, measurement, and estimating functionality
• Enable integrations with third-party platforms selected or authorized by customers
• Process subscriptions, billing, renewals, and payments
• Provide onboarding, customer support, training, and troubleshooting
• Monitor platform performance, reliability, security, and availability
• Detect, prevent, and investigate fraud, misuse, security incidents, unauthorized access, or technical issues
• Communicate with users about product updates, support matters, administrative notices, and service changes
• Comply with contractual, legal, regulatory, accounting, and audit obligations
• Develop aggregated, de-identified, or anonymized analytics to improve our products and services

3. Artificial Intelligence and Automated Processing

Gamut uses artificial intelligence, machine learning, computer vision, rules-based logic, and related technologies to support documentation, measurement, object identification, estimating, scoping, and workflow automation.

Information submitted to the Services may be processed by Gamut's AI systems or by authorized service providers that support those systems. AI-generated outputs may include estimates, suggested line items, affected area calculations, scope recommendations, project summaries, quality-control flags, or other restoration-related outputs.

AI-generated outputs are intended to support professional judgment and workflow efficiency. Users remain responsible for reviewing outputs for accuracy, completeness, compliance with applicable estimating standards, carrier requirements, contractual obligations, and applicable law.

Unless otherwise agreed in a written customer agreement, Gamut does not use customer-owned confidential project data to train general-purpose AI models made available to unrelated customers in a way that identifies the customer, end user, property owner, claimant, or project.

4. How We Share Information

We may share information in the following circumstances.

A. With Customer-Authorized Users

If your account is associated with a company, team, contractor, carrier, restoration firm, administrator, or other organization, information may be accessible to authorized users within that organization based on account permissions.

B. With Service Providers

We may share information with vendors that help us operate the Services, including providers of cloud hosting and infrastructure, data storage, security monitoring, authentication, payment processing, analytics, customer support, email delivery, AI infrastructure, machine learning infrastructure, computer vision infrastructure, data processing infrastructure, logging, diagnostics, performance monitoring, professional services, legal, accounting, compliance, and audit support.

This includes AI and cloud service providers that process claim photos, estimate files, and related claim information on our behalf to generate damage analysis and support platform operations. These providers, including OpenAI, are contractually restricted from selling or sharing your information for cross-context behavioral advertising or any purpose other than providing services to us.

We require service providers to use information only as necessary to provide services to us and to protect information using appropriate confidentiality and security safeguards.

C. With Third-Party Integrations

If a customer or user enables an integration, export, API connection, or data transfer to another platform, we may share information with that third-party system as directed by the customer or user. This may include restoration management platforms, estimating platforms, claims systems, carrier systems, CRM systems, accounting systems, or other business software.

D. For Legal, Security, and Compliance Purposes

We may disclose information if we believe it is reasonably necessary to comply with law, regulation, subpoena, court order, or legal process; enforce our agreements or policies; protect the rights, property, safety, or security of Gamut, our users, customers, or others; detect, investigate, or prevent fraud, abuse, unauthorized access, or security incidents; or support audits, compliance reviews, insurance claims, or risk management processes.

E. Business Transactions

If Gamut is involved in a merger, acquisition, financing, corporate reorganization, sale of assets, bankruptcy, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to appropriate confidentiality protections.

5. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, disclosure, alteration, and destruction.

These safeguards may include encryption in transit, encryption at rest where appropriate, access controls, role-based permissions, authentication controls, logging and monitoring, vendor risk management, secure development practices, incident response procedures, backup and recovery processes, employee confidentiality obligations, and periodic review of security controls.

No system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their credentials and for using appropriate security controls within their own organizations.

6. Data Retention

We retain information for as long as reasonably necessary to provide the Services, comply with contractual obligations, support business operations, resolve disputes, maintain security, satisfy legal and accounting obligations, and enforce our agreements.

Retention periods may vary depending on the type of information, the customer agreement, legal requirements, and the purpose for which the information was collected.

When information is no longer required, we will delete, de-identify, aggregate, or securely retain it in accordance with our data retention practices, contractual obligations, and applicable law.

7. Account Deletion and Data Deletion Requests

Users may request deletion of their account or personal information by contacting us at privacy@aams.ai or using the information in Section 16. We will respond to verifiable deletion requests within 15 days to the extent required by applicable law.

Where required by Apple or applicable law, users who create an account in the mobile app will be able to initiate account deletion from within the app.

Deletion requests may be subject to limitations where information must be retained for legal, contractual, security, billing, audit, backup, dispute-resolution, fraud-prevention, or legitimate business purposes. If your account is controlled by your employer, contractor, carrier, restoration company, or another customer organization, we may direct certain deletion or access requests to that organization.

8. Customer-Controlled Data

Many users access Gamut through an organization, such as an employer, restoration company, carrier, contractor, or other business customer. In those cases, the organization may control the data submitted to the Services.

If you are an end customer, claimant, homeowner, property owner, insured, tenant, subcontractor, employee, or other individual whose information was submitted to Gamut by one of our customers, you should first contact that customer regarding requests to access, correct, or delete your information. We will support our customers in responding to such requests as required by applicable law and contract.

9. User Choices and Controls

Depending on your account, device, and applicable law, you may have choices regarding accessing or updating account information, managing notification preferences, revoking device permissions, requesting deletion of your account, requesting access to, correction of, or deletion of certain personal information, and opting out of certain marketing communications.

You can manage certain device permissions through your device settings. Disabling permissions may limit functionality of the Services.

10. Location Information

Certain features may use location information, including project address data, job site location, or approximate location inferred from IP address.

We use location information to support project setup, property documentation, mapping, estimating, routing, fraud prevention, security, analytics, and service functionality. We do not sell precise location information.

11. Cookies and Similar Technologies

Our websites and web-based services may use cookies, pixels, local storage, analytics tools, and similar technologies to operate the website, maintain sessions, remember preferences, analyze usage, improve performance, support security, and measure marketing effectiveness.

You may be able to control cookies through your browser settings. Some features may not function properly if cookies are disabled.

12. Marketing Communications

We may send marketing communications about Gamut products, services, updates, events, or educational content. You may opt out of marketing emails by using the unsubscribe link in the email or by contacting us.

We may still send non-marketing communications, such as security notices, support messages, billing notices, account alerts, and service-related updates.

13. Children's Privacy

The Services are intended for business and professional use and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete it.

14. International Users

Gamut is based in the United States. The Services are intended for use within the United States. Information collected through the Services is processed and stored in the United States, including on infrastructure provided by U.S.-based cloud service providers.

If you access the Services from outside the United States, your information will be transferred to and processed in the United States. By using the Services, you understand that U.S. data protection laws may differ from those in your jurisdiction.

15. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may provide you with additional rights regarding your personal information.

Your Rights

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions (such as information we are required to retain by law or contract).
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell your personal information, and we do not share your personal information with third parties for cross-context behavioral advertising purposes.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined under the CPRA, you may have the right to limit its use to purposes permitted by law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

How to Submit a Request

To exercise your California privacy rights, contact us using the information in Section 16. We will respond to verifiable requests within 15 days to the extent required by applicable law. We may need to verify your identity before processing your request. If your account is controlled by a business customer, we may direct certain requests to that organization.

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information (as defined under CCPA):

• Identifiers (name, email, IP address, device identifiers)
• Commercial information (subscription plan, billing, transaction history)
• Internet or network activity (usage logs, session data, diagnostic data)
• Geolocation data (project address, job site location, approximate location from IP)
• Visual and audio information (photos, videos, spatial scans submitted through the Services)
• Professional or employment-related information (company name, job title)
• Inferences drawn from the above to support estimating, scoping, and platform features

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

16. Contact Us

For privacy questions, requests, or concerns, contact us at:

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as appropriate, such as by updating the effective date, posting a notice through the Services, or sending a communication to users or customers.

Your continued use of the Services after an updated Privacy Policy becomes effective means you acknowledge the updated policy.