Privacy Policy

Scope and privacy controller

Buildean is a construction estimating and proposal service provided by Buildean Inc. (“Buildean,” “we,” “us,” or “our”). Buildean Inc. is responsible for personal information under its control and acts as the privacy controller for the Buildean website at buildean.com, the Buildean applications distributed through Apple’s App Store and Google Play, and related support, waitlist, and communications services (collectively, the “Service”).

This policy applies to visitors, waitlist members, account holders, authorized members of a customer workspace, and people whose information a customer enters into Buildean, such as a customer’s clients or project contacts. If your information was entered by a Buildean customer, that customer is responsible for having authority to provide it and may also be a controller of that information. Contact that customer first for requests about its records, or contact us and we will assist as appropriate.

Information we collect

We collect information you provide, information generated when you use the Service, and limited information from platform and infrastructure providers.

Device permissions

Buildean may request access to notifications so we can send account or project updates, and to your camera, photo library, or files only when you choose to upload a logo, document, receipt, or project attachment. You can deny or revoke these permissions in iOS or Android settings. Core manual estimating features remain available where the requested permission is not necessary for the feature you selected.

Information about other people

Do not upload client, employee, subcontractor, or other third-party information unless you have a lawful business reason and all authority or consent required to do so. Do not use Buildean to store government identification numbers, payment-card details, health records, or other information that is unnecessary for estimating and project administration.

Website and waitlist

When you join the Buildean waitlist, we collect your email address together with the submission time, browser user-agent, referring page, and country derived from Cloudflare’s request header. We use this information to manage the waitlist, prevent abuse, understand how people find Buildean, and send the launch and product communications you requested. Each commercial email will include an unsubscribe method.

The website is hosted and protected by Cloudflare. Cloudflare processes IP addresses, routing data, security signals, and request logs to deliver and secure the website. Our web fonts are delivered by Google Fonts, which receives standard browser request data such as your IP address and user-agent. Waitlist submissions are routed through a Google Apps Script endpoint for storage and workflow automation. The current website does not use third-party advertising pixels or browser cookies for behavioural advertising; Cloudflare may use strictly necessary security technologies.

Mobile apps and Firebase

The iOS and Android apps use Google Firebase and related Google Cloud infrastructure. Buildean Inc. controls the customer and app data submitted to these services, while Google generally processes it for us as a service provider. The Firebase components used by a released app version may include:

• Firebase Authentication for sign-in, account identifiers, authentication tokens, and account recovery;
• Cloud Firestore, Realtime Database, Cloud Storage, and Cloud Functions to store, synchronize, process, and back up account, business, project, and attachment data;
• Firebase App Check to evaluate app or device integrity signals and help prevent unauthorized requests;
• Firebase Cloud Messaging to associate an app installation and notification token with messages you choose to receive;
• Firebase Crashlytics and Performance Monitoring to collect installation identifiers, crash traces, device and operating-system details, app version, timestamps, IP-derived country, and performance or network diagnostics;
• Firebase Remote Config to deliver configuration appropriate to an app version; and
• Google Analytics for Firebase to measure aggregate feature use, sessions, and app events. We do not use Firebase data to serve third-party targeted advertisements.

Firebase Authentication is operated from data centres in the United States. Other Firebase services may process information on Google’s global infrastructure. Google’s own processing of service data is described in Privacy and Security in Firebase and the Google Privacy Policy.

Apple and Google separately collect information when you download, update, review, or purchase the app under their own privacy policies. Store privacy disclosures and Google Play Data Safety answers describe the released build and should be read together with this policy.

How and why we use information

We use personal information only for identified and reasonable purposes, including to:

• create and administer accounts, workspaces, roles, and subscriptions;
• save and synchronize project data and generate estimates, reports, and branded proposal files;
• send a document or notification when you direct us to do so;
• authenticate users, protect accounts, investigate abuse, and maintain the availability and integrity of the Service;
• process purchases, validate entitlements, keep tax and accounting records, and provide support;
• diagnose crashes, monitor performance, understand aggregate feature use, and improve the Service;
• operate the waitlist and send requested launch, product, service, security, and legal communications;
• enforce our Terms of Service, establish or defend legal claims, and comply with law; and
• create aggregated or de-identified statistics that do not reasonably identify an individual.

Legal bases

In Canada, we generally rely on your express or implied consent as appropriate to the sensitivity and context, as well as uses permitted or required by law. Where European Economic Area or United Kingdom law applies, our bases are performance of a contract, consent (including optional communications or permissions), compliance with legal obligations, and our legitimate interests in securing, supporting, and improving a business productivity service. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

How we disclose information

We do not sell or rent personal information. We do not share it for cross-context behavioural advertising. We disclose information only as follows:

• At your direction: to clients, colleagues, or other recipients when you share an estimate, PDF, invitation, or project communication;
• Workspace members: to authorized users in the same business workspace according to their roles;
• Infrastructure and operations providers: including Google Firebase and Google Cloud, Google Apps Script, Cloudflare, app stores, email delivery, customer support, and security providers, only for services they perform for us;
• Professional advisers: to accountants, auditors, insurers, lawyers, and consultants under duties of confidentiality;
• Legal and safety reasons: where we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of the Service; and
• Business transactions: in connection with due diligence, financing, reorganization, merger, sale, or transfer, subject to appropriate confidentiality and continued protection.

We contractually require service providers that process personal information for us to use it only for authorized purposes and to provide protection consistent with this policy and applicable law.

International processing

Buildean Inc. is based in Ontario, Canada. Our providers operate in Canada, the United States, and other countries. As a result, personal information may be processed outside your province, state, or country and may be accessible to courts, law enforcement, or national-security authorities under local law.

We use contractual, organizational, and technical measures appropriate to the transfer. Where required for transfers from the EEA, United Kingdom, or Switzerland, we rely on an adequacy decision or approved contractual safeguards, such as standard contractual clauses. Contact us for information about the safeguards relevant to your data.

Retention and deletion

We keep personal information only as long as needed for the purposes above, taking account of account status, legal requirements, dispute periods, security needs, and backup cycles.

• Account and project content: kept while the account is active. After a verified account-deletion request, we normally remove it from active systems within 30 days. Encrypted backups, fraud-prevention records, and Firebase installation identifiers may persist for up to 180 days before deletion or overwrite.
• Waitlist records: kept until you unsubscribe or for no more than 24 months after your last interaction with a Buildean communication, whichever comes first.
• Crash and performance data: Crashlytics diagnostic records are generally retained for 90 days; Performance Monitoring retains IP-associated events for 30 days and installation-associated data for 60 days. Analytics user-level event data is configured not to exceed 14 months.
• Support and security records: generally kept for up to 24 months after the matter closes, unless needed longer for an active investigation or legal claim.
• Purchase, tax, and accounting records: kept for seven years or the period required by applicable Canadian law.

We may retain a minimal suppression record after an unsubscribe, and may retain information where required by law, legal hold, fraud prevention, or the protection of legal rights. Data that has been irreversibly aggregated or de-identified is not subject to these periods. Copies you exported or sent to another person are controlled by you and that recipient.

Security

We use safeguards appropriate to the sensitivity of the information, including encrypted network transport, provider encryption at rest, access controls, authentication, least-privilege administration, integrity checks, logging, dependency maintenance, and incident response procedures. Access is limited to personnel and providers with a business need and confidentiality obligations.

No storage or transmission method is completely secure. You are responsible for protecting your credentials, maintaining control of devices signed into your account, choosing appropriate workspace roles, and using a secure method when exporting or sending documents. Notify us promptly if you suspect unauthorized access.

Your rights and choices

Subject to applicable law and limited exceptions, you may:

• ask whether we hold personal information about you and request access to it;
• correct inaccurate or incomplete information;
• request a portable copy of information you provided;
• withdraw consent or object to or restrict certain processing;
• unsubscribe from promotional email using the link in any message;
• disable push notifications or optional device permissions in your device settings;
• request deletion of your account and associated personal information; and
• complain to the privacy regulator where you live without retaliation.

Use Settings → Account → Delete Account in the app to initiate deletion. If you cannot access the app, follow the instructions on our Account Deletion page or email [email protected] with “Buildean privacy request” in the subject. We may verify your identity and authority before fulfilling a request. Authorized agents must provide proof of authority. We respond within the period required by applicable law; under PIPEDA this is generally within 30 days, subject to permitted extensions.

Account deletion does not automatically cancel an App Store or Google Play subscription. Cancel the subscription in your Apple or Google account to stop future charges.

Regional disclosures

Canada

You may challenge our compliance with applicable Canadian privacy law by contacting our Privacy Officer. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. We will not charge for an access request unless permitted by law and disclosed in advance.

California and other U.S. states

In the preceding 12 months, we may have collected the categories described above: identifiers; customer records and commercial information; internet or other electronic network activity; approximate geolocation derived from IP address; professional or employment-related information in a business profile; user-provided content; and inferences limited to product preferences or likely feature interests. We collect these categories from you, your organization, devices, service providers, and app stores for the business purposes described in Section 5, and disclose them to the recipient categories in Section 6.

We have not sold personal information or shared it for cross-context behavioural advertising, and we have no actual knowledge that we have sold or shared the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you. Depending on your state and subject to legal exceptions, you may have rights to know, access, correct, delete, or obtain a copy of personal information and to appeal a denied request. Because we do not sell or share personal information for targeted advertising, an opt-out of sale or sharing is not necessary. We do not discriminate for exercising privacy rights.

EEA, United Kingdom, and Switzerland

In addition to the rights above, you may object to processing based on legitimate interests, request restriction, and withdraw consent without affecting earlier lawful processing. You may complain to your local supervisory authority. We do not use solely automated decision-making that produces legal or similarly significant effects about users.

Children

Buildean is a business service for construction professionals and is not directed to anyone under 18. We do not knowingly collect personal information directly from children. If you believe a minor has provided information, contact us so we can investigate and delete it.

Changes and contact

We may update this policy as the Service, providers, or legal requirements change. We will post the revised policy with a new effective date and, when required, provide prominent in-app or email notice before a material change takes effect. We will request new consent where required for a materially different purpose.