Privacy Policy

BuildProof provides a multi-tenant construction-management platform. This policy covers the BuildProof website and application. If your organization was invited onto the platform by a construction manager, owner, bank, architect, or insurance carrier, that organization is the controller of the project records they administer, and their own agreements with you may apply in addition to this policy.

Account information. Name, email address, password credential, organization name and entity details, role, and the projects and organizations you are a member of.

Project content you upload or create. Pay applications and requisitions, schedules of values, lien waivers, certificates of insurance and policy documents, contracts and subcontracts, change orders, certifications, payment confirmations, supporting documents and photographs you choose to upload, and messages sent through the platform. This content frequently contains personal information about third parties — workers, subcontractor personnel, and project participants — which you are responsible for having a lawful basis to provide.

Billing information. Subscription tier, billing period, and subscription status. Card details are collected and stored by Stripe, our payment processor — BuildProof never receives or stores your full card number.

Usage and device information. Log data, IP address, browser and device type, pages viewed, and actions taken in the application, used to operate, secure, and debug the service.

To provide and operate the platform; to run the AI features you invoke (document extraction, compliance review, drafting, and review agents); to authenticate you and enforce access control between tenants; to bill you and manage your subscription; to provide support; to secure the service and investigate abuse; and to comply with legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising beyond the marketing-page tracking described in Section 6.

The platform sends portions of your content to third-party AI providers in order to produce the outputs you request — for example, sending a plan sheet image to a computer-vision service to detect symbols, or sending document text to a large-language-model provider to draft a scope sheet or summarize a policy.

We do not permit these providers to train their foundation models on your content, and we do not train models on one customer's content for the benefit of another. Detection models we train ourselves are trained on drawing sets we have a right to use for that purpose; where that would ever include customer drawings, it is done only with that customer's explicit agreement.

AI output is a draft for professional review. See our Terms of Service, Section 3, for what that means for your reliance on it.

We use the following categories of provider to run the service. Each receives only what it needs for its function:

• Cloud platform and database — hosting, storage, and application runtime for all platform data.
• Large-language-model providers — drafting, summarization, classification, and document reasoning.
• Document intelligence / OCR — reading text and tables from uploaded drawings and documents.
• Computer-vision compute — running our symbol-detection models over plan sheets.
• Stripe — payment processing and subscription billing.
• Voice and messaging providers — outbound calls and SMS, where you enable those features.
• Cloud storage connectors — Google Drive and Dropbox, only when you connect them and only for files you select.
• Email delivery — transactional and notification email.

We will name the specific providers on request. Contact us at the address in Section 12.

We run advertising and conversion tracking from Meta (Facebook), Google Ads, and Reddit on our public marketing pages only — the homepage, audience and pricing pages, and the signup and legal pages. These tools set cookies and report page views and signup conversions so we can measure which advertising works.

They are deliberately not loaded inside the application. Authenticated BuildProof URLs identify projects and other tenant records, and we do not transmit those to advertising networks. When you move from a marketing page into the application, the tracking is switched off before the navigation completes.

You can additionally block this tracking with browser settings, an ad blocker, or the opt-out controls each vendor provides. Blocking it does not affect your use of the platform.

Cookies we set ourselves are limited to what the product needs: session and authentication cookies, and local storage for interface preferences (such as your selected audience view or an expanded navigation section).

The platform exists to share a record between parties to a project. Information you post to a project is visible to the other members of that project according to their role — a bank with an oversight relationship sees draw and lien-waiver information, a carrier sees insurance compliance information, a subcontractor sees their own scope. Internal pricing and margin fields are withheld from roles not entitled to see them.

Every record is scoped to an account, and access is enforced server-side. We do not expose one customer's records to another.

We retain your account and project records for as long as your account is active and for as long afterwards as we need them to meet legal, tax, and dispute-resolution obligations. Construction records commonly need to be retained for the length of the applicable statute of repose, so we do not delete project records automatically on cancellation. You may request deletion under Section 9.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know, to delete, to correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined. Residents of the EEA and UK have rights under the GDPR.

To exercise any of these, contact us at the address in Section 12. Where you are an invited user on a project administered by another organization, we may direct your request to that organization as the controller of those records, and will tell you if we do.

We enforce authentication on every request, scope every record to an account, and enforce access control server-side rather than in the browser. No system is perfectly secure, and we do not warrant that the service cannot be compromised. If a breach affects your information, we will notify you as required by applicable law.

The platform is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

We operate in the United States, and information you provide is processed there. If you access the platform from outside the United States, you understand that your information will be transferred to and processed in the United States.

We may update this policy. Material changes will be reflected in the “last updated” date above, and where required by law we will give you notice.

Questions, requests, and privacy complaints: hello@buildproof.com.