1. Our role and your organisation
BuildEngine provides tools for construction professionals. An organisation using BuildEngine generally determines why its project information is collected, who can access it and which integrations are connected. We process that information to provide the service and as permitted by the organisation’s agreement and applicable law. We also handle account administration, website enquiries, security and support information for our own operational purposes.
Your organisation’s notices and agreements may also apply. This policy describes personal-information handling; it does not change ownership or licensing terms in a separate customer agreement, expand rights to use customer data, or remove protections required by law.
2. Information we collect
- Account and project people: name, business email address, organisation, role, project access, sign-in identifiers and session information. Project directories may contain contact names, companies, trades, roles, email addresses and phone numbers entered manually or imported from a workbook. The current pilot does not request access to your phone’s address book.
- Project content: recorded voice notes, transcripts and corrections, typed notes, photos, uploaded files, plans, spreadsheets, action items, assignments, project locations and ZIP codes supplied for weather reports or in content, reports and the supporting evidence you choose to provide. These may include information about clients, employees, subcontractors or other people.
- Connected accounts: when you authorise an integration, account details, access permissions and securely held authorisation tokens, plus email messages, attachments, SharePoint sites, library or folder information and selected files needed for the enabled workflows. Authorised email synchronisation may run while the app is closed; it is not limited to messages you manually open.
- Review and learning records: selected original and corrected text, proposed and accepted work, edits, approvals, rejections, revisions, outcomes, timestamps, account/project references and information about the AI request and model used. These records support traceability, quality checks and learning review.
- Support: feedback and bug reports you submit. The separate optional diagnostics action can include app version, operating system, network availability and queue counts. It does not automatically attach your recordings, photos, documents, email contents or queued work.
- Website and technical information: contact-form details you submit, IP address, browser or device information, access times, request/error records and service delivery or security logs. Infrastructure and sign-in providers also process technical information needed to deliver their services.
Only provide information you are authorised to share. Avoid unnecessary sensitive personal information in recordings, documents, email or support reports.
3. How we use information
We use information to authenticate users; enforce organisation and project access; transcribe and organise your input; prepare actions, answers, reports and communication drafts; run connected email and document workflows; maintain evidence and change history; recover from interrupted operations; answer enquiries and support requests; and protect, maintain and improve the service.
Where applicable law requires a legal basis, this may include performing a contract, legitimate interests in running and securing our business, complying with legal obligations, or consent for a particular use. Where consent is required, we obtain it and provide a way to withdraw it. Withdrawing a permission can prevent the related feature from working.
AI-generated suggestions can be inaccurate. Review is part of the workflow. In the current pilot, proposed construction changes and external email or SharePoint writes require the applicable review and acceptance steps. Connecting an account authorises the enabled read/synchronisation functions; it does not by itself approve a proposed outgoing message or document change.
4. Learning records, product improvement and de-identified data
Private learning records are not automatically de-identified. The current app retains selected before/after records and associated evidence within its account, organisation and project access controls. These records can contain identifiable text. Suggested learnings are reviewed separately; approving a suggested learning does not itself train a model, change app behaviour or publish the record to other customers.
Permitted improvement use. Where supported by the applicable customer agreement, permissions and law, we may use de-identified or aggregated information and appropriately authorised customer contributions to research, evaluate and improve our products, models, workflows and construction insights. A separately agreed development or data licence may specify additional permitted uses and protections. This notice alone is not that licence or any additional consent required for a particular use.
What de-identification means here. Before treating information as de-identified for broader improvement or release, identifying details and combinations that could reasonably identify a person, household, customer or project must be removed or generalised, and re-identification risk must be assessed. Internal IDs, pseudonyms, embeddings or other transformations alone are not sufficient. Until that standard is met, the information remains subject to the protections applicable to identifiable data.
We do not attempt to re-identify information maintained as de-identified, except where applicable law permits controlled testing to assess whether safeguards work. We require recipients of de-identified information to maintain its de-identified form and not attempt re-identification. We do not make identifiable customer project content available to other customers merely because it has been processed or used to derive an insight.
De-identification does not describe all operational processing. For example, a recording is sent to the transcription provider, and selected project content may be sent to an AI provider, to fulfil a requested feature.
6. Device permissions and connected-account choices
Microphone, camera and photo-library permissions are requested for the features that use them. Recording begins when you choose to capture audio; the app is not an always-listening assistant. You can change device permissions in your operating system settings. The current pilot does not request precise device location. A project ZIP code is optional and supports approximate project-location and weather lookups; a photo, document or typed project address can also contain location information.
Connection controls let you disconnect an email or SharePoint account. Email disconnect removes the local connection’s cached mail and tokens; copies already imported into project records are separate. Disconnecting an integration does not delete the source mailbox or SharePoint files, automatically erase project evidence, or necessarily revoke the provider-side permission. You can also remove BuildEngine’s grant in the provider’s account or organisation settings.
Unsent captures and drafts may remain on your device until submitted, removed or cleared. Signing out is not an account-deletion request and does not by itself erase stored project information. Review local queued work before clearing app data or uninstalling.
7. Retention and deletion
We retain information for as long as needed for the service, the relevant customer relationship, support, evidence and audit history, security, legal obligations and permitted improvement uses. The period depends on the information, the customer agreement and applicable law; there is not one universal deletion period for all records. We review retention needs and handle deletion requests as described below.
Deleting an action is different from erasing personal information. The current Delete action item control removes the item from active work lists while preserving its history and evidence. Discarding a proposal also does not erase its original source. Connected SharePoint rows, previously sent emails and recipients’ copies are not removed by those controls.
When a valid account or personal-data deletion request is completed, we delete or de-identify the relevant information unless retention is required or permitted by law, such as for security, fraud prevention, legal claims or recordkeeping. We explain applicable exceptions when responding. Organisation-controlled shared records may require coordination with your organisation; that does not remove your applicable personal-data rights.
Backup copies are restricted from ordinary use and expire under the relevant backup schedule. If a backup is restored, applicable deletion restrictions must be reapplied. Properly de-identified aggregates and general product improvements may be retained where permitted by law and the governing agreement; retaining identifiable source content requires its own justification.
8. Security and international processing
We use measures including encrypted connections, access controls, project/organisation permission checks, protected credentials and backups. These controls reduce risk but no system can guarantee absolute security. Keep your device and sign-in account secure and tell us promptly if you suspect unauthorised access.
BuildEngine operates from the United States. Information may be processed in the United States, the European Union and other locations where relevant providers operate. Using an EU transcription endpoint does not mean all BuildEngine processing stays in the EU. Where applicable, international processing is subject to the safeguards required by law and the relevant agreements.
10. Request access, correction or account/data deletion
To ask about this policy, request a copy or correction of your personal information, request account deletion and associated data deletion, or exercise another applicable privacy right, email dev@buildengine.ai.
- Use the subject “BuildEngine account/data deletion” for deletion, or “BuildEngine privacy request” for other enquiries.
- Include the email address used for BuildEngine, your organisation name if applicable, and whether you want your account, particular information, or both deleted. You do not need to sign in to submit a request.
- We may verify your identity and authority through an appropriate, proportionate process. We respond within the period required by applicable law and explain any information needed, permitted retention or other limitations.
Depending on your location, rights may include access, correction, deletion, portability, objection, restriction, withdrawal of consent and an appeal or complaint to a relevant supervisory authority. We do not discriminate against you for exercising applicable privacy rights. Where we process records on behalf of your organisation, we may coordinate with it to fulfil the request.
This page is the external request route for the BuildEngine app, including the Mercer pilot. Removing the app, signing out, disconnecting Microsoft or removing an action does not submit this request.
11. Children
BuildEngine is designed for adult construction professionals and is not directed to children under 18. If you believe a child has provided personal information to us, contact us so we can review and address it.
12. Changes to this policy
We may update this policy as the service changes. We publish the revised policy with an updated date and provide additional notice or obtain consent where required. A policy update does not override an existing agreement or make a new data use lawful without the permissions and safeguards it requires.
Contact: BuildEngine LLC · dev@buildengine.ai