Book a demo
2cm.ai / LegalLEGAL

Privacy Policy

Last updated: June 19, 2026

This Privacy Policy describes how 2cm, LLC ("2cm.ai", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you visit our website at 2cm.ai, join our waitlist, request a demo, communicate with us, or use our countertop quoting and stone fabrication management software and related services (collectively, the "Services").

This policy applies to personal information we process as a "business" or "controller" of that information. Where we process personal information on behalf of our business customers (for example, data your shop enters about its own clients and jobs), we act as a "service provider" or "processor," and our handling of that information is governed by our agreement with the relevant customer. By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Information we collect

We collect the following categories of information:

1.1 Information you provide to us

  • Identity and contact data — your name, business name, job title, email address, phone number, and mailing address.
  • Account data — your username, password (stored in hashed form), and account preferences when you register for the Services.
  • Billing and transaction data — your subscription plan, billing contact details, and a record of purchases. Payment card details are collected and processed directly by our payment processor, Stripe; we do not store full payment card numbers on our systems.
  • Communications and lead data — information you provide when you join our waitlist, request a demo or walkthrough, fill out a form, or contact us, including the content of your messages.
  • Customer content — quotes, takeoffs, drawings, project details, pricing, and other content you submit to the Services in the course of running your business.

1.2 Information we collect automatically

  • Usage data — pages and features you view, links you click, the dates and times of your visits, and how you interact with the Services.
  • Device and technical data — your IP address, browser type and version, operating system, device identifiers, referring and exit pages, and approximate location derived from your IP address.
  • Cookies and similar technologies — we and our analytics partners use cookies, pixels, and similar technologies to operate the Services and understand usage. See our Cookie Policy for details.

1.3 Information from third parties

We may receive information about you from our service providers (such as Stripe and our analytics providers), from publicly available sources, and from partners who refer you to us, consistent with their own privacy policies and applicable law.

2. How we use your information

We use the information we collect for the following purposes:

  • To provide, operate, maintain, secure, and improve the Services;
  • To create and administer your account and process your transactions;
  • To respond to your inquiries, schedule demos and walkthroughs, and provide support;
  • To send administrative and service-related communications, such as updates, security alerts, and billing notices;
  • To send marketing and promotional communications where permitted, from which you may opt out at any time;
  • To understand usage trends and measure the performance of our content and marketing;
  • To detect, investigate, and prevent fraud, security incidents, and other prohibited or illegal activity;
  • To comply with our legal and regulatory obligations and to establish, exercise, or defend legal claims.

3. Legal bases for processing

Where required by applicable law (such as the EU/UK GDPR), we rely on the following legal bases to process your personal information: (a) performance of a contract with you; (b) your consent, which you may withdraw at any time; (c) our legitimate interests in operating and improving our business, provided those interests are not overridden by your rights; and (d) compliance with a legal obligation.

4. How we share your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only in the following circumstances:

  • Service providers (subprocessors). We share information with vendors who perform services on our behalf under contractual obligations to protect it, including Stripe (payment processing), Resend (transactional and notification email delivery), and Google Analytics (website usage analytics).
  • Legal compliance and protection. We may disclose information if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, property, or safety of 2cm.ai, our users, or the public.
  • Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our assets, your information may be transferred as part of that transaction, subject to the protections described in this policy.
  • With your direction or consent. We may share information for other purposes disclosed to you at the time, or with your consent.

5. Cookies and tracking technologies

We use cookies and similar technologies to operate the website, remember your preferences, and analyze traffic. For a detailed description of the cookies we use and how to manage them, please see our Cookie Policy.

6. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to provide the Services, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When information is no longer required, we securely delete or anonymize it. Retention periods vary depending on the type of information and the purpose for which it was collected.

7. Data security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration, including encryption of data in transit and access controls. No method of transmission over the internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security.

8. International data transfers

We are based in the United States, and the information we collect may be processed in the United States and other countries that may have data protection laws different from those in your country. Where required, we implement appropriate safeguards (such as Standard Contractual Clauses) for international transfers of personal information.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

  • The right to access and obtain a copy of the personal information we hold about you;
  • The right to correct inaccurate or incomplete information;
  • The right to request deletion of your personal information;
  • The right to restrict or object to certain processing;
  • The right to data portability;
  • The right to withdraw consent where processing is based on consent;
  • The right to opt out of marketing communications at any time;
  • The right not to receive discriminatory treatment for exercising your rights.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframe required by applicable law and may need to verify your identity before fulfilling your request. You also have the right to lodge a complaint with your local data protection authority.

10. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with rights to know what personal information we collect, to access and delete it, to correct inaccuracies, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law. You may exercise your California rights by contacting us as described below, and you will not be discriminated against for doing so. You may designate an authorized agent to make a request on your behalf.

11. Children's privacy

The Services are intended for businesses and individuals who are at least 18 years old and are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (such as by email or a notice on the Services). Your continued use of the Services after changes take effect constitutes your acceptance of the revised policy.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at:

2cm, LLC
2261 Market Street, San Francisco, CA, United States
Email: tadros@2cm.solutions
Phone: (415) 408-6034

This document is provided for general informational purposes and does not constitute legal advice. For guidance specific to your circumstances, please consult a qualified attorney. If you have any questions about this document, contact us using the details above.