Privacy Policy

Last updated: October 26, 2026

This Privacy Policy explains how Proark Solutions Inc("Buildficient," "we," "us") collects, uses, and shares personal information when you use our construction project management platform, websites, and mobile apps (the "Service"). Where our business customers submit personal information about their own workers or clients, we process that information as a processor on the customer's behalf under our Data Processing Addendum; this Policy describes our practices generally.

1. Information We Collect

• Account information. Name, email address, phone number, company name, role, and password (stored hashed).
• Project and jobsite content. Projects, tasks, schedules, daily logs, notes, invoices, and media you upload, including jobsite photos and videos, which may incidentally include images of people, vehicles, or locations.
• Voice audio and transcripts. When you use voice features, we send your audio to our speech-to-text provider as you speak to turn it into text. We do not keep the audio. We store the transcript and the resulting commands for audit and undo purposes.
• Messages and consent records. Phone numbers, text and WhatsApp messages sent through the Service, and records of who agreed to receive texts or opted out.
• E-signatures. When someone signs a document or selection, the name they type or the signature they draw, the email address the document was sent to, the time, their IP address and browser details, the consent to sign electronically they agreed to (its text and version), and a fingerprint of exactly what was signed. If they decline, the reason they give. We hold these records for the contractor who sent the document.
• Contacts you import. If you choose to import contacts from your phone, the names, phone numbers and email addresses you pick.
• Payment data. Payments are handled by Stripe. We receive subscription status and limited billing metadata (such as card brand and last four digits) but never store full card numbers.
• Usage and device data. Log data, IP address, browser and device type, operating system, feature usage, crash reports, and approximate location derived from IP, plus GPS coordinates you choose to attach to photos or logs.
• Clock-in location. When you clock in on the mobile app and have allowed location access, the app records your GPS location at that moment. It is used for timesheets, and people at your company who can see timesheets, such as admins and managers, can see it there. If you don't allow location access, you can still clock in and no location is recorded.
• Cookies and similar technologies. We use cookies for authentication, preferences, and product analytics. Our website and web app show a cookie banner where you can allow or decline analytics. You can also control cookies through your browser settings.

2. How We Use Information

• Provide, operate, and maintain the Service;
• Power AI features, including speech-to-text transcription, voice command intent parsing, photo analysis, and smart suggestions;
• Provide customer support and respond to requests;
• Process billing, subscriptions, and account management;
• Improve the product, develop features, and analyze usage in aggregate;
• Protect the security and integrity of the Service, prevent fraud and abuse, and comply with legal obligations.

3. Legal Bases (GDPR)

Where the EU or UK GDPR applies, we process personal information on these legal bases: performance of a contract (providing the Service you signed up for), our legitimate interests (securing and improving the Service, communicating with business contacts), and consent (where required, for example for certain cookies or marketing emails, which you may withdraw at any time).

4. Subprocessors and Service Providers

We share personal information with the following providers, each engaged for a specific purpose and bound by contractual data protection obligations. The same list appears in our Data Processing Addendum and on our Security page.

• Supabase: database, sign-in and file storage. Data: all account and project data, uploaded photos and files, sign-in details. Where: United States (AWS us-east-1).
• Vercel: hosting the web app and website. Data: all data passing through the app, IP addresses, request logs. Where: United States, with a global content network.
• Anthropic: Buildficient Assistant, photo and document reading, suggestions. Data: what you type or say to the Assistant, shared photos and documents, related project details. Where: United States.
• OpenAI: backup AI model, and receipt and bill reading. Data: Assistant messages and project details when used as a backup, receipt and bill images. Where: United States.
• Google (Gemini): backup AI model, and receipt and bill reading. Data: Assistant messages and project details when used as a backup, receipt and bill images. Where: United States and other regions.
• OpenRouter: backup AI model routing. Data: Assistant messages and project details when used as a backup. Where: United States; OpenRouter passes requests to the host of the chosen model, which may be in other countries.
• NVIDIA: backup AI model hosting. Data: Assistant messages and project details when used as a backup. Where: United States.
• Deepgram: speech-to-text and the Assistant's spoken replies. Data: voice audio while you speak, and the text of spoken replies. Where: United States.
• Resend: sending email. Data: email addresses, names, and the content of emails we send. Where: United States.
• Sent.dm: sending text and WhatsApp messages. Data: phone numbers, names, message content, delivery and opt-out status. Where: United States.
• Twilio: sending and receiving text messages. Data: phone numbers, message content, delivery and opt-out status. Where: United States.
• Zernio: sending text and WhatsApp messages. Data: phone numbers, names, message content, delivery and opt-out status. Where: United States.
• Meta (WhatsApp): delivering WhatsApp messages. Data: phone numbers and message content. Where: United States and other regions.
• Expo: sending push notifications to the mobile app, and delivering mobile app updates. Data: device push tokens and notification text; device and app version details and IP address when the app checks for updates. Where: United States.
• Apple and Google push services (and your browser's push service): delivering push notifications to phones and browsers. Data: device or browser push identifiers and notification text. Where: United States and other regions.
• Stripe: subscription billing and payments. Data: billing contact details, payment card details (held by Stripe, not us), payment history. Where: United States.
• Sentry: error and crash reports from the web and mobile apps. Data: user ID, IP address, device and browser details, the screen or request that failed. Where: United States.
• PostHog: product analytics, after you allow analytics. Data: user ID, pages and features used, device and browser details, IP address. Where: United States.
• Inngest: running scheduled and background jobs. Data: job details, which can include record IDs, names, email addresses and message content. Where: United States.
• Google Workspace: our own business email. Data: what you send us by email, such as support requests. Where: United States and other regions.

If you ask us for help, Buildficient support may view your account through a time-limited support session that is logged. Support sessions are read-only unless a change is needed to fix your problem, and that change is logged too.

We may also disclose information to comply with law, to enforce our agreements, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

5. Voice Recordings and AI Processing

Voice audio is sent to Deepgram to turn it into text, and the text is sent to Anthropic to interpret commands, to deliver the features you use. We also keep a short-lived sample of AI requests to check the quality and cost of the service (see Data Retention). Every request we send to Deepgram opts out of Deepgram's model improvement program, so Deepgram does not use your audio or text to train its models. Under Anthropic's commercial terms, content sent through its API is not used to train its models.

When Anthropic is unavailable, and for reading receipts and bills, some AI features use the backup model providers listed above (OpenAI, Google, OpenRouter and NVIDIA). Those providers process your content under their own terms to deliver the requested feature. OpenRouter passes requests to the company that hosts the chosen model, which may be outside the United States. We do not sell your content, and we do not use it to train our own models.

6. No Sale of Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act as amended by the CPRA.

7. Data Retention

• Active accounts. We retain information for as long as needed to provide the Service and meet legal obligations.
• After cancellation. If a company cancels, its account becomes read-only and we keep its data for 90 days so it can come back. After that, we permanently delete the company's data.
• Delete company. An admin can choose Delete company in Settings. The company becomes read-only right away, and we permanently delete its data 30 days later. An admin can cancel the deletion at any time before then.
• Deleting your own account. When one person deletes their account, we remove their name, email, phone and photo right away and sign them out everywhere. Work they added stays with their company and shows as "Former member".
• What permanently deleted means. Projects, tasks, files and photos, contacts, invoices and estimates, signed documents and their signature records, messages, daily logs, voice transcripts and AI history, and the company's billing customer record at our payment processor.
• Signed documents. Signed documents and their signature records are kept for as long as the contractor's account is open, then deleted on the same schedule as the rest of the company's data (90 days after cancellation, or 30 days after Delete company). When someone signs, we email them a copy if we have their email address.
• What we keep. Records of acceptance of our terms, opt-out (STOP) records so we keep honoring them, and records we must keep by law (for example our own billing and tax records).
• Export. You can export timesheets, invoices, estimates and reports from the app at any time. To get a full copy of your company's data before it is deleted, email support@buildficient.com.
• Backups. We back up our database daily. Deleted data rolls off our backups within 30 days.
• AI request samples. To check quality and cost, we keep a sample of about 1 in 10 AI requests, including the text sent and the reply, for up to 30 days, then delete it. Only our staff can see these samples.
• Provider logs. Service providers listed in Section 4, such as our error reporting provider, keep their own logs for a limited time under their own retention policies. Those logs can outlast the periods above, and we do not control them.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Under the GDPR you also have the right to lodge a complaint with a supervisory authority. Under the CCPA/CPRA, California residents have the rights to know, correct, delete, and opt out of sale or sharing (we do neither), and the right not to be discriminated against for exercising these rights. To exercise any right, email support@buildficient.com from the address associated with your account; we will verify your identity and respond within the time required by law. If your data was submitted to us by a Buildficient customer (for example, your employer), we may direct your request to that customer.

Our privacy contact is support@buildficient.com. If you are in Canada and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

You can also delete your own account in the app, and an admin can delete the company from Settings. Section 7 explains what each one does.

9. International Transfers

We operate from Ontario, Canada. Our database and app hosting are in the United States, so personal information you give us is transferred to and stored in the United States, where it is subject to US law and may be accessed by US courts and authorities. Some of the providers listed in Section 4 may process information in the United States and other regions, as listed there. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or other lawful transfer mechanisms.

10. Security

We use industry-standard safeguards, including encryption in transit and at rest, role-based access controls, a check on every request that limits each user to their own organization's data, least-privilege access for personnel, and logging and monitoring. No system is perfectly secure; please report suspected vulnerabilities to security@buildficient.com.

11. Children

The Service is for business use and is not directed to anyone under 16. We do not knowingly collect personal information from children under 16; if you believe a child has provided us information, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with an updated date above and, for material changes, notify you by email or in-app message before the changes take effect.

13. Text Messages

We send text and WhatsApp messages in two ways. Team members can turn on texts in their notification settings to get alerts about their projects. Contractors can also send messages from the app to their own clients, such as arrival notices, project updates, and reminders. We hold the phone numbers involved, along with the content, time, and delivery status of each message, to send the messages, show them in the app, and keep opt-out records. Contractors enter their clients' numbers and are responsible for having permission to text them, as described in our Terms of Service. The Text message program page describes the program in full.

Our messaging providers, listed in Section 4, process phone numbers, message content, and delivery status so they can deliver the messages. We do not sell phone numbers and we do not use them for our own marketing. Mobile numbers and text opt-in data are not shared with third parties or affiliates for their marketing or promotional purposes.

• Opt out. Every text ends with "Reply STOP to opt out." When you reply STOP, END, CANCEL, UNSUBSCRIBE, QUIT, or STOPALL, Buildficient stops texting that number on every provider we use.
• Opt back in. Reply START to get texts again.
• Help. Reply HELP, or email support@buildficient.com. Our HELP reply reads: "Buildficient: texts about your construction project. Reply STOP to opt out. Help: support@buildficient.com"
• How often. The number of texts varies with project activity. Quiet hours apply.
• Costs. Message and data rates may apply.

14. Contact

Proark Solutions Inc, Ontario, Canada. Privacy contact, questions and rights requests: support@buildficient.com. Security reports: security@buildficient.com.