BuildCycle.io ("we", "us", "our") respects your privacy and is committed to protecting it. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use BuildCycle (the "Service"), a multi-tenant, cross-platform project management application for architects, engineers, and construction professionals available on web, iOS, and Android.
We do not sell, rent, or monetize your personal data or project files under any circumstances.
Please read this policy carefully. By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Information We Collect
We collect information in three main ways:
A. Information You Provide Directly
- Account information: name, email address, phone number (optional), profile picture, job title, company/organization name.
- Organization data: company details, billing information (if you pay for premium features), addresses, and team member invitations.
- Content you upload: project documents (PDFs, drawings), progress photos, notes, comments, timestamps, and workflow metadata.
- Correspondence: emails or messages you send to our support team.
B. Automatically Collected Information
- Device and usage data: IP address, browser type, operating system, device identifiers, time zone, app version.
- Analytics: how you navigate the app, which features you use, time spent on projects, and crash reports.
- Cookies and similar technologies: We use essential cookies and local storage for authentication and session management. We do not use tracking cookies or third-party advertising pixels.
C. Information from Third-Party Services
- Authentication: We use Supabase Auth (or your chosen identity provider) for login (email/password, Google, Apple, Microsoft, etc.). We only receive basic profile info you authorize.
- Cloudflare & R2: We use Cloudflare for hosting and R2 for file storage. They may collect standard server logs but do not have access to your file contents.
2. How We Use Your Information
We use your data only to operate, improve, and secure the Service:
- Provide core functionality (project tracking, file storage, team collaboration).
- Send important notifications (project updates, invitations, password resets).
- Authenticate users and enforce multi-tenant data separation.
- Debug and fix issues (crash reports, performance monitoring).
- Improve the product (anonymous usage analytics).
- Comply with legal obligations (e.g., tax records if you pay for a subscription).
- Prevent fraud, abuse, or violations of our Terms of Service.
3. Data Sharing and Disclosure
We do not sell, trade, or rent your personal information or project files to third parties.
We only share data in these limited cases:
- With your Organization administrators (they can see files and activity within their tenant).
- With service providers under strict confidentiality:
- Supabase (database & authentication — Ireland/EU or US regions)
- Cloudflare R2 (file storage — global, based on your access patterns)
- Stripe or Paddle (only if you purchase a paid plan — we never see full card details)
- Analytics tools (PostHog self-hosted or Plausible — anonymized only)
- In the event of a merger, acquisition, or sale of assets (your data would remain protected under this policy or a substantially similar one).
- To comply with legal requirements (court orders, government requests) — we will notify you unless prohibited by law.
4. Multi-Tenant Data Separation
Your projects, files, and team data are logically isolated from other organizations. Only users explicitly invited to your Organization (or granted access via shared links you create) can view your content.
5. Data Security
We implement industry-standard security measures:
- All traffic is encrypted in transit (TLS 1.3).
- Files in Cloudflare R2 are encrypted at rest (SSE-S3).
- Database access is restricted and protected by row-level security.
- Regular security audits and penetration testing.
- Two-factor authentication (2FA) is available and strongly recommended.
However, no system is 100% secure. You are responsible for keeping your password safe and using strong access controls within your Organization.
6. Data Retention
- Account data and project files are kept as long as your account is active.
- If you delete a file or project, it is permanently removed from active storage within 30 days (backups may persist up to 90 days).
- If you close your account or an admin removes you, your personal data is deleted or anonymized within 30 days, except where required for legal or billing purposes.
7. Your Rights and Choices (GDPR, CCPA, etc.)
Depending on your location, you may have the right to:
- Access, correct, or delete your personal data.
- Export your project files and data (we provide download tools).
- Object to or restrict certain processing.
- Withdraw consent (where applicable).
- Request deletion ("right to be forgotten").
To exercise these rights, contact us at info@buildcycle.io. We will respond within 30 days (or as required by law).
8. International Data Transfers
Your data is primarily stored in the European Union (Supabase Ireland) or the United States (Cloudflare R2). We rely on Standard Contractual Clauses (SCCs) and other approved mechanisms to ensure adequate protection when data crosses borders.
9. Children's Privacy
The Service is not intended for individuals under 18. We do not knowingly collect data from children.
10. Changes to This Privacy Policy
We may update this policy from time to time. Material changes will be notified via email or in-app notice. Your continued use after changes constitutes acceptance.
11. Contact Us
For any privacy questions or requests:
Thank you for trusting BuildCycle with your projects and data. We're committed to keeping your architecture and engineering work private, secure, and under your control.
