Privacy Policy

Last updated: June 10, 2026

This Privacy Policy explains how Buildficient, Inc. ("Buildficient," "we," "us") collects, uses, and shares personal information when you use our construction project management platform, websites, and mobile apps (the "Service"). Where our business customers submit personal information about their own workers or clients, we process that information as a processor on the customer's behalf under our Data Processing Addendum; this Policy describes our practices generally.

1. Information We Collect

• Account information. Name, email address, phone number, company name, role, and password (stored hashed).
• Project and jobsite content. Projects, tasks, schedules, daily logs, notes, invoices, and media you upload, including jobsite photos and videos, which may incidentally include images of people, vehicles, or locations.
• Voice recordings and transcripts. When you use voice features, we capture audio, generate transcripts, and store both along with the resulting commands for audit and undo purposes.
• Payment data. Payments are handled by Stripe. We receive subscription status and limited billing metadata (such as card brand and last four digits) but never store full card numbers.
• Usage and device data. Log data, IP address, browser and device type, operating system, feature usage, crash reports, and approximate location derived from IP, plus GPS coordinates you choose to attach to photos or logs.
• Cookies and similar technologies. We use cookies for authentication, preferences, and product analytics. You can control cookies through your browser settings.

2. How We Use Information

• Provide, operate, and maintain the Service;
• Power AI features, including speech-to-text transcription, voice command intent parsing, photo analysis, and smart suggestions;
• Provide customer support and respond to requests;
• Process billing, subscriptions, and account management;
• Improve the product, develop features, and analyze usage in aggregate;
• Protect the security and integrity of the Service, prevent fraud and abuse, and comply with legal obligations.

3. Legal Bases (GDPR)

Where the EU or UK GDPR applies, we process personal information on these legal bases: performance of a contract (providing the Service you signed up for), our legitimate interests (securing and improving the Service, communicating with business contacts), and consent (where required, for example for certain cookies or marketing emails, which you may withdraw at any time).

4. Subprocessors and Service Providers

We share personal information with the following providers, each engaged for a specific purpose and bound by contractual data protection obligations:

• Supabase, database, authentication, and file storage;
• Vercel, application hosting and content delivery;
• Stripe, payment processing and billing;
• Deepgram, speech-to-text transcription of voice recordings;
• Anthropic, AI processing for intent parsing, photo analysis, and suggestions;
• Resend, transactional email delivery;
• Google Workspace, business email and internal collaboration;
• Upstash, caching and rate limiting;
• Sentry, error and crash monitoring;
• PostHog, product analytics;
• Inngest, background job processing.

We may also disclose information to comply with law, to enforce our agreements, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).

5. Voice Recordings and AI Processing

Voice recordings are processed by Deepgram to provide transcription and by Anthropic to interpret commands, solely to deliver the features you use. Under our agreements with these providers, your voice recordings and content are not used to train third-party foundation models.

6. No Sale of Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act as amended by the CPRA.

7. Data Retention

• Active accounts. We retain information for as long as needed to provide the Service and meet legal obligations.
• After cancellation. Customer content is retained for 90 days after cancellation so you can export it, then deleted from active systems.
• Backups. Encrypted backups are retained for up to 35 days before rotation.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Under the GDPR you also have the right to lodge a complaint with a supervisory authority. Under the CCPA/CPRA, California residents have the rights to know, correct, delete, and opt out of sale or sharing (we do neither), and the right not to be discriminated against for exercising these rights. To exercise any right, email support@buildficient.com from the address associated with your account; we will verify your identity and respond within the time required by law. If your data was submitted to us by a Buildficient customer (for example, your employer), we may direct your request to that customer.

9. International Transfers

We are based in the United States and process information there. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or other lawful transfer mechanisms.

10. Security

We use industry-standard safeguards, including encryption in transit and at rest, role-based access controls, row-level security in our database, least-privilege access for personnel, logging and monitoring, and vendor security review. No system is perfectly secure; please report suspected vulnerabilities to security@buildficient.com.

11. Children

The Service is for business use and is not directed to anyone under 16. We do not knowingly collect personal information from children under 16; if you believe a child has provided us information, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with an updated date above and, for material changes, notify you by email or in-app message before the changes take effect.

13. Contact

Buildficient, Inc. Privacy questions and rights requests: support@buildficient.com. Security reports: security@buildficient.com.