Legal
How we collect, use, and protect your data.
Last updated: 25 December 2025
BuildersAI is operated by CM Digital Solutions Ltd, a company registered in England and Wales. We provide construction project management software including a mobile app and website.
CM Digital Solutions Ltd
Company No. 16913770
82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
For privacy enquiries, contact us at privacy@buildersai.co.uk.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. All our data processing occurs within EU data centres with no international transfers.
When you create an account, we collect your email address, full name, and password (which is securely hashed and never stored in plain text). You may optionally provide a phone number, job title, and profile photo.
When using our services, you may upload photos, files, documents, floor plans, and drawings. We also store tags, annotations, captions, comments, messages, work items, tasks, and project settings that you create.
When you use our AI assistant features, we collect your questions and the responses generated, along with any feedback you provide (such as ratings or corrections). This helps us improve the quality and accuracy of AI responses.
We automatically collect information about how you use our services, including feature usage patterns, session duration, navigation flows, and app performance metrics. On our website, we use Google Analytics to understand traffic sources and user journeys, and Microsoft Clarity to generate heatmaps and session replays that help us improve the user experience.
We collect device information (type, model, operating system), app version, browser type and version (on the website), and screen resolution. IP addresses are anonymised immediately and not stored in identifiable form.
When you use our mobile app, we create a device identifier derived from your device name, model, and operating system version. We also collect your push notification token (to send notifications to your device), device name (e.g., "John's iPhone"), and per-device settings such as whether site tracking is enabled. This allows you to use BuildersAI across multiple devices with separate settings on each.
With your explicit consent, we may collect GPS coordinates to geotag photos with their capture location. This helps you organise site photos and track where work was documented. Location is only captured when you choose to add it to a photo.
Our mobile app includes an optional geofencing feature that can automatically record when you arrive at or leave a construction site. This is designed to help with site attendance tracking, health and safety compliance, and time management.
Geofencing is disabled by default and requires three levels of consent to activate:
When enabled, your device monitors for entry and exit from project site boundaries, even when the app is closed. We record timestamped enter/exit events and GPS accuracy data. You can disable geofencing at any time in the app settings or by revoking location permission in your device settings.
We use your information to provide photo and file management, enable team collaboration, process AI chat requests, sync data across your devices, and send transactional notifications such as project invites and updates.
We analyse usage patterns to prioritise feature development, review AI interactions to improve response quality, study project workflows to identify pain points, and conduct A/B testing of features and interfaces. This analysis uses aggregated and anonymised data wherever possible.
We monitor for misuse, abuse, or terms violations, review flagged content for policy compliance, ensure AI responses are accurate and helpful, and detect and prevent fraudulent activity.
Under UK GDPR, we process your personal data on the following legal grounds:
We work with trusted third-party service providers to deliver our services, including providers for database hosting, offline sync, AI processing, error tracking, analytics, payments, and email delivery. All processors are GDPR-compliant with Data Processing Agreements in place, and the majority operate within EU data centres. For the full list, see our Sub-processors page.
We never: sell your personal data to third parties, share your data with advertisers, or use your data to train AI models.
All your data is stored and processed within EU data centres. We do not transfer personal data outside the European Economic Area. Our database is hosted in Ireland, file storage is in the EU, and AI processing occurs in AWS Ireland. This means no Standard Contractual Clauses or additional safeguards are required for international transfers.
We retain your data only as long as necessary for the purposes described in this policy:
When you request deletion, we immediately hide your data (soft delete), provide a 30-day grace period during which you can restore your account, then permanently delete your data. Aggregated statistics are anonymised and retained.
Under UK GDPR, you have the following rights regarding your personal data:
To exercise these rights, contact us at privacy@buildersai.co.uk. We will respond within 30 days (or 60 days for complex requests, with explanation).
We use essential cookies for authentication and session management. These are necessary for the website to function and cannot be disabled.
We use Google Analytics with Consent Mode v2. When you first visit our website, Google Analytics loads immediately but operates in a cookieless mode. No cookies are set on your device and no persistent identifiers are created. In this mode, Google receives limited data (page URL, referrer, browser type, and a truncated IP address used only for country-level geolocation) to provide basic, anonymised measurement such as page view counts and session estimates. Google does not use this data to identify or track you across websites. We rely on legitimate interest (Article 6(1)(f) UK GDPR) as the legal basis for this minimal processing, as no information is stored on or read from your device.
If you click "Accept All" or enable analytics in the cookie settings, Google Analytics upgrades to full cookie-based tracking, which provides more detailed insights such as returning visitor recognition. We also load Microsoft Clarity (heatmaps and session replays) and Meta Pixel only after you give consent. All services are configured to store data in EU data centres, and IP anonymisation is enabled.
If you click "Reject All", no analytics cookies are set. Cookieless measurement via Google Analytics continues as described above. Microsoft Clarity and Meta Pixel do not load.
You can manage your cookie preferences at any time through the cookie banner when you first visit our site, or via the cookie settings link in the footer.
With your consent, we use Meta Pixel and Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. These tools only load after you accept analytics cookies. We do not use third-party ad networks, retargeting, or remarketing technologies.
Our AI assistant features are powered by Claude (developed by Anthropic) via AWS Bedrock. All AI processing occurs in EU data centres (Ireland). When you use AI features, your queries and project context are processed to generate helpful responses.
Important: Your data is NOT used to train AI models. AWS Bedrock guarantees that customer data is not used for model training. We may review AI interactions internally for quality assurance and to improve response accuracy.
AI features are provided as an assistance tool only and should not be relied upon as professional construction, engineering, or legal advice. Always verify important information with qualified professionals.
We implement appropriate technical and organisational measures to protect your data, including encryption at rest (AES-256) and in transit (TLS 1.3), row-level security database policies, secure password hashing, and regular security audits.
In the event of a data breach affecting your personal data, we will notify the ICO within 72 hours (where required) and inform affected users without undue delay.
Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover we have collected data from a child, we will delete it promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect, and update the "Last updated" date at the top of this page. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:
Privacy Enquiries
Email: privacy@buildersai.co.uk
Response time: Within 5 business days
Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.
Website: ico.org.uk
Phone: 0303 123 1113
