Privacy policy

Who we are

Builtfold is construction project management software provided online as a service (SaaS) to businesses. The website builtfold.com and the application at app.builtfold.com are provided by Builtfold.

For anything about your personal data, write to us at hello@builtfold.com. The Greek version of this policy prevails in case of any difference.

Controller or processor

Our role under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) depends on the data:

• We are the controller for data about visitors to the website, for demo requests and for the basic user account details we need to run the service (sign-in, security, support, invoicing).
• We are a processor for everything a customer business enters in its workspace (projects, invoices, payments, attachments, photos, daily reports and so on). The customer is the controller of that data; we process it only on the customer's instructions and to provide the service.

If you are a user in a company's workspace and want to exercise a right over workspace data, please contact that company first; we help it respond.

What data we process

Visitors to builtfold.com

The website uses no cookies and no statistics, advertising or tracking tools. Like any web server, ours receives your IP address and browser type in order to send you the page; these are used only for the security and proper operation of the server (legitimate interest, Art. 6(1)(f) GDPR).

Demo requests

When you fill in the demo form we keep your name, company, email, phone (if given), company size and message, to contact you and arrange the demo (steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR). To prevent abuse we keep your IP address only as an irreversible cryptographic fingerprint (hash), not the address itself (legitimate interest). We send you a short confirmation email.

User accounts

Name, email, password (stored only as a hash), two-factor authentication settings, your Google identifier if you sign in with Google, your role in each workspace, notification preferences, last sign-in date and an activity log (who changed what and when) for security and accountability. The legal basis is performance of the contract and our legitimate interest in security.

Workspace data

What the customer enters: projects, budgets, invoices, payments, cheques, contracts, documents and attachments, photos, site daily reports (including voice notes), supplier and client contacts, team messages and comments. We process it as a processor, only to provide the service.

myDATA connection (Greek tax authority, AADE)

If the customer connects its myDATA account, we keep its credentials (user name and subscription key) encrypted and use them only to receive documents from and submit documents to AADE on the customer's instruction.

Google Drive (optional)

If the customer connects its Google Drive, the application gets access only to the files and folders needed for the feature it turned on. The connection can be revoked at any time.

Email

We send the emails the service needs (invitations, password resets, notifications and scheduled reports you choose). We do not send marketing messages without your consent.

Artificial intelligence (Google Gemini)

Some features use artificial intelligence: reading incoming invoices and documents, drafting a daily report from a voice note, and questions to Builtfold. When a workspace uses these features, the relevant content (for example an invoice file or the text of a question) is sent for processing to Google's Gemini API.

• We use the paid service, under whose terms Google does not use the content to train its models.
• The result is a suggestion: it is shown for review and is never recorded or submitted anywhere without a user's confirmation.
• No decisions about you are made solely by automated processing.

Where the data is kept

The application, database and files are hosted on servers of Hetzner Online GmbH in Germany, inside the European Union. Backups are encrypted before they leave the server and kept at a second, separate Hetzner location, also in Germany. All traffic to the website and the application is encrypted (HTTPS).

Sub-processors

To run the service we work with the providers below, under written agreements that bind them to process data only on our behalf:

If we add or change a sub-processor, we update this page and, for customers with a data processing agreement, tell them in advance.

Transfers outside the EEA

The main data stays in Germany. Where a provider (Google, Cloudflare) may process data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework, under which they are certified, and on the European Commission's Standard Contractual Clauses.

How long we keep it

• Demo requests: 12 months from sending, unless you become a customer.
• Workspace data: for as long as the contract lasts. After it ends you have 30 days to export it; then it is deleted.
• Backups: daily copies are kept 14 days, weekly 8 weeks and monthly 12 months. Deleted data disappears from the backups as they expire.
• User accounts: while the account is active; details the law requires us to keep (for example tax records for invoicing) are kept as long as the law says.
• Activity log: 365 days.
• Voice note audio: 90 days; the transcript and the report remain.

Cookies

The website builtfold.com uses no cookies and no statistics or advertising tools. The application uses only the cookies strictly necessary for signing in and security. All the details, with the list of cookies, are in the Cookie policy.

Security

• Encrypted connections (HTTPS) everywhere.
• Passwords stored only as hashes; two-factor authentication available to every user.
• Each workspace is kept apart from the others; each user sees only what their role allows.
• Third-party credentials (such as myDATA) are stored encrypted.
• Encrypted backups every night to a second location.

If a breach affecting your data occurs, we inform the customer without undue delay and the data protection authority where required.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy,
• have inaccurate data corrected,
• have your data erased ("right to be forgotten"),
• restrict processing,
• data portability, that is, to receive your data in a machine-readable format,
• object to processing based on legitimate interest,
• withdraw your consent at any time, where processing is based on it.

Write to us at hello@builtfold.com. We reply within one month. We may ask you to confirm your identity.

If you believe the processing breaks the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA, ΑΠΔΠΧ), 1-3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr, or with the authority of the EU country where you live or work.

Data processing agreement (DPA)

For the data we process on behalf of our customers we have a data processing agreement under Art. 28 GDPR. Ask for it at hello@builtfold.com.

Changes to this policy

If anything material changes, we update this page and the date at its top, and email customers before the change takes effect. See also the Terms of use.