Privacy Policy

1. Introduction and Scope
This Privacy Policy describes how BuildAspect, Inc. (“BuildAspect,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you access or use our websites, applications, products, software, services, browser extensions, integrations, documentation, and related offerings (collectively, the “Service”). By “you” or “your,” we mean any individual who visits, accesses, or uses the Service in any capacity.

Your use of the Service is also governed by our Terms of Service (available at https://buildaspect.com/terms), which apply to all individual users. If you access the Service through an organization’s subscription, the BuildAspect Customer Agreement between BuildAspect and that organization may also apply. This Privacy Policy is incorporated by reference into both of those agreements. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the Terms of Service or the Customer Agreement, as applicable.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices as described here, please do not use the Service.

2. Information We Collect
We collect personal information that you provide to us, that we receive from third parties, and that is generated automatically when you use the Service. The type and extent of information we collect depends on how you use the Service, and not all of the following categories will apply to every user.

2.1 Information You Provide
When you create an account, accept an invitation, subscribe to a plan, or otherwise interact with the Service, you may provide information such as your name, email address, phone number, company name, job title, billing information, and other profile details.

2.2 Content You Submit
We collect information and content that you submit, share, upload, or create through the Service. This includes, but is not limited to, company information, product details, photos, project details, project costs, project timelines, change orders, invoices, contact details of your suppliers, clients, contractors, and other collaborators, and any other materials you provide through the Service (collectively, “User Content” as defined in the Terms of Service, or “Customer Content” as defined in the Customer Agreement).

2.3 Usage Data
Each time you access the Service, we automatically collect usage, analytics, telemetry, performance, and diagnostic data (“Usage Data”). Usage Data includes:

• your search activity, pages viewed, features used, date and time of visits, and navigation patterns;

• if you use our browser extensions, the content you interact with on third-party sites (for example, saving an image from a third-party site to your BuildAspect account) and how you navigate and interact with those pages;

• browser type, operating system, device type, browser language, IP address, mobile carrier, unique device identifier, and requested and referring URLs; and

• performance logs, error reports, and diagnostic information.

Usage Data is defined and its permitted uses are described in Section 3.4 of the Terms of Service and Section 1.6 of the Customer Agreement. BuildAspect may use Usage Data to provide, maintain, secure, support, improve, and develop the Service. BuildAspect may disclose Usage Data externally only in aggregated or de-identified form that does not identify you or any individual.

2.4 Information from Third Parties
We may receive information about you from third-party sources, such as identity verification services, payment processors, analytics providers, or other users who invite you to the Service. We may combine this information with information we collect directly from you.

2.5 Cookies and Similar Technologies
We use cookies, pixels, local storage, and similar tracking technologies to collect information about your interactions with the Service. These technologies help us authenticate users, remember preferences, analyze usage patterns, and deliver relevant content.

We use the following categories of cookies:

• Essential cookies: Required for the Service to function. These cannot be disabled.

• Analytics cookies: Help us understand how users interact with the Service. These collect aggregated, anonymized information.

• Functional cookies: Enable personalized features such as saved preferences and recent activity.

3. How We Use Your Information
We use the personal information we collect for the purposes described below, along with the legal basis for each use under applicable data protection law.

• To provide and operate the Service. We process your information to deliver the Service, process your communications, store your content, provide customer support, and respond to your inquiries. Legal basis: performance of our contract with you (Terms of Service and/or Customer Agreement).

• To improve and develop the Service. We analyze how users interact with the Service to identify issues, develop new features, and improve functionality and performance. Legal basis: legitimate interest in improving our products and services.

• To personalize your experience. We use your information to tailor the content, features, and support services available to you. Legal basis: legitimate interest in providing a relevant user experience; in some jurisdictions, consent.

• To train and improve AI and machine learning models. As described in Section 4 of this Privacy Policy, we may use Usage Data and Your Content to develop, train, or improve AI or machine learning models used in or for the Service. Legal basis: legitimate interest in developing and improving the Service; contractual authorization under the Terms of Service (Section 3.3) and Customer Agreement (Section 2.3).

• To communicate with you. We may send you service-related notices, security alerts, updates, and marketing communications. You can opt out of marketing communications at any time. Legal basis: performance of contract (service communications); legitimate interest or consent (marketing).

• To ensure security and prevent fraud. We use your information to monitor for suspicious activity, detect abuse, enforce our Terms of Service and Acceptable Use Policy, and protect the rights and safety of BuildAspect, our users, and third parties. Legal basis: legitimate interest in protecting the Service and our users; legal obligation.

• To comply with legal obligations. We process your information as required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests, and to prosecute or defend legal claims. Legal basis: legal obligation; legitimate interest in defending legal claims.

• For business analytics and research. We perform aggregated analysis of usage patterns and trends for internal business planning. Legal basis: legitimate interest in understanding our business performance.

4. AI and Machine Learning
The Service may include AI-assisted or automated features that process Your Content to deliver functionality you or your organization has requested. The contractual terms governing BuildAspect’s AI/ML data usage rights are set forth in Section 3.3 of the Terms of Service and Section 2.3 of the Customer Agreement.

5. How We Share Your Information
We do not sell your personal information. We share your information only in the circumstances described below.

5.1 Service Providers and Subprocessors
We share your information with third-party service providers who help us operate the Service, including providers of data storage, hosting, payment processing, email delivery, customer support, analytics, and information technology infrastructure (collectively, “subprocessors”). These providers are contractually required to use your information only to perform services on our behalf and to maintain appropriate security measures.

If you are a Customer under a Customer Agreement with a data processing addendum, we will provide you with a current list of subprocessors and reasonable advance notice of material changes to the subprocessor list as described in Section 3.2 of the Customer Agreement.

5.2 Your Organization’s Administrators
If you access the Service through an organization’s subscription (for example, as an employee, contractor, or invited collaborator), the Account Administrators designated by that organization may be able to access, monitor, restrict, or remove your account, view your activity and content within the organization’s workspaces, and control your permissions and access levels. Your use of the Service through an organization’s subscription is subject to that organization’s own policies, and you should direct any privacy inquiries related to organizational data practices to your organization’s administrator.

5.3 Other Users and Collaborators
When you submit content to shared workspaces, projects, or collaborative features within the Service, that content is visible to other users and collaborators with access to those workspaces or projects. Content you have shared with others may remain visible to those recipients even after you modify or delete your content, deactivate your account, or terminate your use of the Service. BuildAspect is not responsible for how other users or collaborators use content you have shared with them.

5.4 Business Transfers
If BuildAspect is involved in a merger, acquisition, reorganization, change of control, or sale of all or substantially all of its assets, your information may be transferred to the successor entity. We will provide notice before your information becomes subject to a materially different privacy policy. Until such notice is given, the successor entity will be bound by the terms of this Privacy Policy.

5.5 Legal Requirements and Protection of Rights
We may disclose your information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our agreements, including the Terms of Service and Customer Agreement; to protect the security or integrity of the Service; or to protect the rights, property, or safety of BuildAspect, our users, or the public.

5.6 With Your Consent
We may share your information for other purposes with your consent or at your direction.

6. Data Location and International Transfers
BuildAspect is based in the United States. Your information may be stored and processed in the United States or in other jurisdictions where BuildAspect or its subprocessors maintain facilities. These jurisdictions may have data protection laws that differ from the laws of your jurisdiction.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, and your personal data is transferred to a jurisdiction that has not been deemed to provide an adequate level of data protection, we will implement appropriate safeguards to protect your data, such as the EU Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Addendum, or other transfer mechanisms permitted under applicable law.

If you are a Customer under a Customer Agreement, you may request an appropriate data-transfer mechanism as described in Section 3.4 of the Customer Agreement.

7. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

The following specific retention periods apply:

• Active accounts: We retain your information for as long as your account remains active and you continue to use the Service.

• Post-termination export period: Following termination of a paid subscription, you (or your organization under a Customer Agreement) have thirty (30) days to export content using the export functionality available through the Service.

• Post-termination retention period: BuildAspect may delete or de-identify Customer Content after 90 days following termination, except to the extent retention is required by law, necessary for financial record-keeping or pending litigation holds, or maintained in backups as necessary for limited business continuity purposes; and

• De-identified and aggregated data: We may retain de-identified or aggregated data indefinitely, as this data cannot be used to identify you.

• Backup copies: Copies of your information may persist in backup systems for a limited period following deletion from primary systems, consistent with our standard backup retention schedules.

Content you have shared with other users or collaborators may remain visible to those recipients after your account is deactivated, deleted, or your content is removed, as described in Section 5.3.

8. Your Rights and Choices
Depending on your location and applicable law, you may have some or all of the following rights with respect to your personal information:

8.1 Rights Under the EU/UK General Data Protection Regulation (GDPR)
If you are located in the EEA, the UK, or Switzerland, you have the following rights:

• Access: You may request a copy of the personal information we hold about you.

• Rectification: You may request that we correct inaccurate or incomplete personal information.

• Erasure: You may request that we delete your personal information, subject to certain legal exceptions.

• Restriction: You may request that we restrict the processing of your personal information in certain circumstances.

• Data portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format.

• Objection: You may object to the processing of your personal information based on our legitimate interests, including objection to automated decision-making and profiling.

• Withdrawal of consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before the withdrawal.

You may also lodge a complaint with your local data protection supervisory authority.

8.2 Rights Under U.S. State Privacy Laws (CCPA/CPRA and Others)
If you are a resident of California or another U.S. state with applicable privacy legislation, you may have the following rights:

• Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we have shared your information.

• Right to delete: You may request that we delete the personal information we have collected about you, subject to certain legal exceptions.

• Right to correct: You may request that we correct inaccurate personal information.

• Right to opt out of sale or sharing: You have the right to opt out of the “sale” or “sharing” of your personal information, as those terms are defined under applicable state law. See Section 9 for more information.

• Right to limit use of sensitive personal information: You may request that we limit the use and disclosure of sensitive personal information to purposes authorized by applicable law.

• Non-discrimination: We will not discriminate against you for exercising any of these rights.

8.3 How to Exercise Your Rights
To exercise any of the rights described above, please contact us at [email protected]. We will respond to your request within the timeframes required by applicable law (generally within 30 days for GDPR requests and 45 days for CCPA requests). We may ask you to verify your identity before fulfilling your request.

If your access to the Service is provided through an organization’s subscription, we may need to refer your request to the organization that administers your account, as that organization may be the data controller with respect to your information within the Service.

9. Do Not Sell or Share
BuildAspect does not sell your personal information. We do not exchange your personal information for monetary or other valuable consideration.

10. Children
The Service is intended for users who are at least 16 years of age (or the age of digital consent in the applicable jurisdiction, if higher). We do not knowingly collect personal information from individuals under this age threshold. If we learn that we have collected personal information from an individual under the applicable age, we will take reasonable steps to delete that information promptly. If you believe that an individual under the applicable age has provided us with personal information, please contact us at [email protected].

11. Information Security
We use reasonable administrative, technical, and organizational measures to protect your personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal information. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training.

Although we take reasonable steps to safeguard personal information, no security practices are 100% secure, and we cannot guarantee the security of your information. You are responsible for maintaining the security of your Access Credentials as described in the Terms of Service.

12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The most current version of this Privacy Policy will govern our use of your information. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the revised Privacy Policy, you should stop using the Service.

We will not make retroactive changes to how we handle previously collected personal information without your consent, except as required by applicable law.

13. Contact Us
If you have questions about this Privacy Policy, wish to exercise your rights, or would like to raise a concern about our data practices, please contact us:

BuildAspect, Inc.
Email: [email protected]

We respond to all requests from individuals wishing to exercise their data protection or privacy rights in accordance with applicable law. We may ask you to verify your identity to help us respond to your request securely and efficiently.