Privacy Policy

Who is responsible for your data

BuildTraq (“we”, “us”) provides the software. Our address is:

For questions about this policy or to exercise any right described below, contact privacy@buildtraq.com. We will provide our full postal address on request.

There are two different relationships to be clear about, because they carry different responsibilities:

• For accounts on BuildTraq — the email address and password you sign in with — we are the data controller.
• For the site data a building company puts into its workspace — reports, photos, unit buyers’ names and phone numbers, invoices — that company is the controller and we are its processor. We hold and process that data on their instructions. If you are a buyer of a property and want your details corrected or removed, contact the building company you are dealing with; they control it. You may also contact us and we will pass the request on.

What we collect

Account information

Your email address, an encrypted password, and your display name. If your organisation requires two-factor authentication, we also store the data needed to verify your authentication app.

Work you record in the app

Projects and their locations, daily site reports, issues and snags, milestones, units, invoices and change orders, and the photos you upload. Reports and photos are attributed to the account that created them.

Personal data about third parties that you enter

If you assign a unit to a buyer, you enter their name, and optionally their email address and mobile number, so BuildTraq can send them invoice reminders and give them access to a buyer portal. You are responsible for having a lawful basis to enter someone else’s details.

Photographs

Site photos may show people, vehicles, and identifying details of a property, and image files can carry embedded information such as the time and GPS coordinates of capture. Photos are private to the workspace unless someone marks a photo as visible to the buyer of a unit.

Technical data

When something goes wrong, our error monitoring records the error, the page or request involved, and basic browser or device information. We have configured it not to attach personal identifiers to those reports.

What the mobile app asks for

The Android app asks for these, and only uses them when you act:

• Camera — when you take a site photo.
• Photos and files — when you attach a photo you already have.
• Microphone — only while you hold the button to ask the assistant a spoken question. Recording stops the moment you let go.

It does not ask for your location, your contacts, or your call history, and it does not run in the background or track you across other apps.

When you send a reminder over WhatsApp, the app opens WhatsApp with the phone number already stored against that unit in BuildTraq. It never reads your phone book, and you send the message yourself.

Why we use it, and on what legal basis

BuildTraq is available internationally, so more than one privacy law may apply to you. We apply the standard below to everyone, wherever you are, rather than offering weaker protection outside Europe. Where your local law gives you more, that law wins.

We rely on the following bases:

• Performing our contract with you — running your account, storing your projects, sending the emails the product depends on such as invitations, password resets and invoice reminders.
• Our legitimate interests — keeping the service secure, diagnosing faults, and preventing abuse. We have weighed this against your interests and limited what we collect accordingly.
• Legal obligation — where we must keep records, for example for tax or to respond to a lawful request.

We do not sell personal data. We do not use it for advertising, and we do not build advertising profiles.

Who else processes it

We use the following providers to run BuildTraq. Each processes data only to deliver its part of the service:

Where your data is held

Your data is stored in the European Union. The database holding your account, your projects and every report, and the storage holding your photos, all run in Ireland.

Our servers are in the European Union too. The API that the web and mobile apps talk to runs in Frankfurt, Germany, and the service that sends our email runs in Ireland.

Some processing still happens outside the EU: the assistant, the voice transcription and the error monitoring described above are provided from the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses under our agreements with each provider, and by the EU–US Data Privacy Framework where the provider is certified under it.

If you are somewhere with its own rules on sending data abroad, the same agreements and safeguards apply to your data.

How long we keep it

Workspace data is kept for as long as the workspace is active, because a construction record is only useful if it survives the project. Items you delete in the app are marked as removed and stay visible in the audit history, so a deleted report cannot quietly disappear from a project’s record.

When a company stops using BuildTraq and its workspace is closed, we keep its data for 30 days and then delete it. That window gives you time to change your mind or export your records, so an accidental cancellation does not destroy years of site history in an instant. Ask us and we will delete it sooner.

After that window we may still hold records we are legally required to keep — chiefly invoices and accounting records, which Cypriot law requires us to retain for six years. Those are used for nothing else.

Copies of data may also persist for a short time in our database provider’s snapshots before being overwritten. Those are never used to restore an individual record. Because a copy can briefly outlive a deletion, please also keep your own exports of anything you need — the app lets you export at any time.

Keeping it safe

Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Access is scoped to a workspace, so one company cannot see another’s data, and roles within a workspace limit what each member can see — for instance, billing is restricted to administrators and the buyer it concerns. Administrators can require two-factor authentication. Our support access to a customer workspace is read-only by default, time-limited when raised, and recorded in an audit log.

Your rights

Whoever and wherever you are, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can withdraw consent where we relied on it. We will not treat you worse for asking.

Some places add specific rights. In the European Economic Area and the United Kingdom these come from the GDPR. In California you may also ask what we collected and disclosed and tell us not to sell or share it — we do not sell or share personal data, so there is nothing to opt out of. Other countries, including Brazil, Canada and Australia, grant comparable rights and we honour them the same way.

Email privacy@buildtraq.com and we will respond within one month. If you are unhappy with our response you can complain to your local data protection authority. Ours is the Office of the Commissioner for Personal Data Protection in Cyprus, and you may complain there instead if you prefer.

If the data concerns you as the buyer of a unit, the building company controls it, so please contact them first — but write to us either way and we will make sure your request reaches them.

Children

BuildTraq is a tool for businesses and is not intended for anyone under 16. We do not knowingly collect data about children. If you believe we have, contact us and we will delete it.

Cookies

We use only what is needed to keep you signed in and to keep the service secure. We do not use advertising or tracking cookies.

Changes

If we change this policy we will update the date at the top, and tell account holders by email when a change materially affects them.