RialtoApp sign-in

Privacy Policy

Review draft · October 20, 2026 · Not yet adopted. This preview describes the reviewed configuration, not a security certification or a promise that proposed controls are already implemented.

Who operates Rialto

Rialto is a construction estimating software brand operated by Tomasz Jezak, an individual. Rialto is not currently an incorporated legal entity. Contact tomasz@userialto.com. Rialto is not a UC San Diego service.

Information we handle

We handle account details such as your name, email, password hash and sign-in records; information you provide about your estimating work; project names, uploaded drawings, specifications, spreadsheets and other bid documents; pricing databases and price-book records supplied to us; chat messages and answers; and generated takeoffs, measurements, estimates, evidence and revision history. Uploaded documents may contain information about other people or businesses. We also process technical usage, error and security records and messages you email us.

Why we use it

We use this information to provide accounts, store and read project originals, run AI-assisted document review and takeoffs, match work to your pricing library, generate and edit estimates, answer questions, provide support and maintain service security and reliability. We do not sell customer project files or pricing data, or use them for advertising.

Improving Rialto and your choice

We may use content you upload and the corrections you make (for example, reviewed takeoff quantities and measurement edits) to improve Rialto, including training and evaluating our own models. Contact tomasz@userialto.com to ask that your project data not be used for this.

AI processing

Third-party AI model providers process document content to generate takeoffs and answers. Relevant chat, document text and images, drawing pages, pricing-library information and tool results may be sent to these providers to deliver document review, takeoff, pricing-library matching and related features. AI processing is not local-only.

We have opted out of model training with our AI model providers where they offer that choice; providers process content under their own terms and may retain it for limited periods, for example for safety and abuse monitoring. These provider opt-outs are separate from Rialto’s own model-improvement use described above. Provider-specific retention periods and exceptions apply. This statement does not guarantee that content is never used by any provider for model improvement, and it is not a zero-retention promise. Deleting a Rialto project does not itself delete provider records. Contact us for current provider details and applicable terms, and to confirm an acceptable processing arrangement before submitting confidential information.

Storage, locations and providers

Cloudflare hosts the app and API and stores original files and processing artifacts in private R2 object storage. The reviewed containers and R2 bucket locations are Western North America. Neon hosts the PostgreSQL database; deployment documentation identifies AWS US West (Oregon). Cloudflare’s network, support systems and AI providers may process information elsewhere; these placements are not a US-only residency guarantee. See the provider list for purposes and location limitations.

Emails you choose to send to us pass through your email service and Rialto’s email infrastructure, which is configured with Microsoft 365 and Proofpoint. The reviewed product build does not enable vendor RFQ/Gmail delivery. Existing stored vendor or RFQ records may remain from earlier versions. Sending an email to support is separate from uploading a file to the app.

Access and safeguards

Accounts are provisioned by the operator. The application uses account-ownership checks and PostgreSQL row-level security in the configured production deployment. The operator and authorized infrastructure administrators can access customer data for operation, support or security; this is not end-to-end encryption. Files are not intentionally published and are accessed using authenticated services or time-limited signed links. Anyone holding a valid signed link may access it until it expires. R2 and Neon publish encryption-at-rest protections; public service connections use HTTPS/TLS. Provider protections do not constitute a Rialto certification, and no system is risk-free.

Retention and deletion

There is no single automatic expiration period for all customer data. Project deletion is designed to remove project-owned database records and associated stored files, but it is not an account-wide erasure tool: account records and account-level pricing libraries, profiles and other retained records may remain. Processing workspaces, provider records, logs, backups and database recovery history are separate and may outlast active project deletion. We have not yet established and verified a complete deletion deadline covering every copy.

Email us to request access, correction, export or deletion of your account, project files, pricing library or other information. Specify the scope; we will verify authority, explain applicable retention exceptions and respond within any legally required period. Do not assume project deletion removes historical database branches, provider records or emailed copies.

Website and browser information

The reviewed marketing-site source contains no third-party advertising or analytics SDK. Cloudflare still receives network/request information to deliver the website; a live dashboard-injected analytics configuration has not been audited. App authentication uses a refresh cookie, and the app may keep local document previews and drafts in browser storage. Log out and avoid shared browser profiles when handling confidential files.

Your choices and changes

Upload only information you are authorized to share with the disclosed providers. Do not submit health records, government IDs, payment-card information, export-controlled material or other specially regulated data without a separate approved agreement. Rialto is intended for adult business users. Depending on applicable law, you may have rights to access, correct, delete or obtain your personal information. We will not penalize you for exercising applicable rights. Contact us with privacy questions. Before adoption, material changes to this draft will be reviewed; an adopted version will identify its effective date and how material changes are communicated.

Needs lawyer review before adoption