BuildCycle, LLC ("we", "us", "our") respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use BuildCycle (the "Service"), a multi-tenant construction administration platform for architects, engineers, and construction professionals, available on web, iOS, and Android.
Please read this policy carefully. By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Information We Collect
We collect information in three main ways:
A. Information You Provide Directly
- Account information: name, email address, phone number (optional), profile picture (optional), and the organization you belong to.
- Organization data: company details, addresses, team member invitations, and billing contact details if you purchase a paid plan.
- Content you upload: project documents (PDFs, drawings), photos, notes, comments, and the workflow history of your records.
- Correspondence: emails you send to our support team.
B. Automatically Collected Information
- Server and security logs: IP address, browser type, operating system, and app version, recorded by our hosting providers when you use the Service.
- Browser storage: we use your browser's local storage to keep you signed in. We do not use analytics tools, tracking cookies, or advertising pixels.
- Payments: the payment page uses Stripe's script, which sets its own cookies to prevent fraud.
C. Information from Third-Party Services
- Sign-in: accounts use an email address and password, managed through Supabase Auth. We do not offer social login or single sign-on.
- Procore: if your organization connects Procore, we import RFIs and submittals from the projects you choose, with their attachments, assignees, and workflow details, using your own Procore sign-in. We send back to Procore only the responses you approve. Disconnecting stops the import.
2. How We Use Your Information
We use your data only to operate and secure the Service:
- Provide core functionality (project records, file storage, team collaboration).
- Send notifications you need (assignments, due dates, invitations, password resets) by email and, where you allow it, push notification.
- Authenticate users and keep each organization's data separate.
- Diagnose and fix problems using server logs.
- Comply with legal obligations (for example, tax records if you pay for a subscription).
- Prevent fraud, abuse, or violations of our Terms of Service.
3. Data Sharing and Disclosure
We do not sell, trade, or rent your personal information or project files to third parties.
We only share data in these limited cases:
- With your Organization administrators (they can see files and activity within their organization).
- With the service providers (subprocessors) that run the Service, under confidentiality obligations. There are four:
- Supabase: database, authentication, and server functions, hosted on Amazon Web Services in the United States (us-east-1).
- Cloudflare: app hosting, content delivery, and file storage (R2).
- Resend: transactional email, such as notifications, invitations, and issued documents.
- Stripe: billing, only if you purchase a paid plan. We never see or store full card details.
- In the event of a merger, acquisition, or sale of assets (your data would remain protected under this policy or a substantially similar one).
- To comply with legal requirements (court orders, government requests). We will notify you unless prohibited by law.
4. Multi-Tenant Data Separation
Your projects, files, and team data are logically isolated from other organizations. Only users invited to your Organization or added to your projects can view your content.
5. Data Security
- Traffic to the app, its database, and file storage is encrypted in transit with TLS 1.2 or higher.
- Data is encrypted at rest (AES-256) by our database and storage providers.
- Row-level security in the database enforces the separation between organizations.
- Production access is limited to one person.
- Every code change passes an automated test suite, and dependencies are scanned for known vulnerabilities weekly.
- Organization administrators control who is invited and can revoke access at any time.
To report a vulnerability, see our security page. No system is completely secure. You are responsible for keeping your password safe.
6. Breach Notification
If we confirm a breach or loss of customer data, we will notify the administrators of each affected organization by email, without undue delay and no later than 72 hours after confirmation.
7. Data Retention
- Account data and project files are kept while your organization's account is active.
- An organization administrator can schedule deletion of the organization. Deletion runs after a 90-day window, during which it can be cancelled and the data exported. Then the organization's files and records are permanently deleted.
- Project records belong to the organization they were created in. When a person leaves, the records they created stay with that organization.
- Deleted data may remain in our providers' routine backups until those backups expire.
8. Your Rights and Choices (GDPR, CCPA, etc.)
Depending on your location, you may have the right to:
- Access, correct, or delete your personal data.
- Export your project files and data (we provide download tools).
- Object to or restrict certain processing.
- Withdraw consent (where applicable).
- Request deletion ("right to be forgotten").
To exercise these rights, contact us at support@buildcycle.io. We will respond within 30 days (or as required by law).
9. Where Your Data Is Stored
Your data is stored and processed in the United States. The database runs on Amazon Web Services in us-east-1 (Virginia). Files are stored in Cloudflare R2 and delivered through Cloudflare's global network. If you use the Service from outside the United States, your information is transferred to and processed in the United States.
10. Children's Privacy
The Service is not intended for individuals under 18. We do not knowingly collect data from children.
11. Changes to This Privacy Policy
We may update this policy from time to time. Material changes will be notified via email or in-app notice. Your continued use after changes constitutes acceptance.
12. Contact Us
For any privacy questions or requests:
- Email: support@buildcycle.io
- Security reports: security@buildcycle.io
- Company: BuildCycle, LLC (an Oklahoma LLC)
Thank you for trusting BuildCycle with your projects and data. We're committed to keeping your architecture and engineering work private, secure, and under your control.