Last updated: 25 September 2026

1. Who We Are

BuildersAI is operated by CM Digital Solutions Ltd, a company registered in England and Wales. We provide construction project management software including a mobile app and website.

CM Digital Solutions Ltd
Company No. 16913770
VAT No. GB525687363
82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

For privacy enquiries, contact us at privacy@buildersai.co.uk.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. All our data processing occurs within EU data centres with no international transfers.

2. Information We Collect

Account Information

When you create an account, we collect your email address, full name, and password (which is securely hashed and never stored in plain text). You may optionally provide a phone number, job title, and profile photo.

Project Content

When using our services, you may upload photos, files, documents, floor plans, and drawings. We also store tags, annotations, captions, comments, messages, work items, tasks, and project settings that you create.

AI Interaction Data

When you use our AI assistant features, we collect your questions and the responses generated, along with any feedback you provide (such as ratings or corrections). This helps us improve the quality and accuracy of AI responses.

Usage and Analytics Data

We automatically collect information about how you use our services, including feature usage patterns, session duration, navigation flows, and app performance metrics. On our website, we use Google Analytics to understand traffic sources and user journeys, and Microsoft Clarity to generate heatmaps and session replays that help us improve the user experience.

Technical Data

We collect device information (type, model, operating system), app version, browser type and version (on the website), and screen resolution. IP addresses are anonymised immediately and not stored in identifiable form.

Device Registration

When you use our mobile app, we create a device identifier derived from your device name, model, and operating system version. We also collect your push notification token (to send notifications to your device), device name (e.g., "John's iPhone"), and per-device settings. This allows you to use BuildersAI across multiple devices with separate settings on each.

Location Data (Optional)

With your explicit consent, we may collect GPS coordinates to geotag photos with their capture location. This helps you organise site photos and track where work was documented. When you check in or out of a site, we also take one reading of your location and keep how far from the site you were, not the position itself (see Site Presence below). If you do not allow location access, photos and checking out carry on working without it; checking in needs it.

Site Presence

Checking in and out. When you check in or out of a site, in the mobile app or in a web browser, we take one reading of your location at that moment. We keep how far you were from the site, how accurate the reading was, when it was taken, and the site location it was measured from. We do not keep your position itself. Your project's administrators can see the distance beside the check-in, and a check-in made clearly away from the site is marked as such.

Checking in needs location access while you are using the app, which your device or browser asks you for. It is never used in the background, and we do not follow where you go. Checking out does not need it: without it, a check-out is recorded without a reading. A check-in is never refused because of how far from the site it was made.

Automatic check-in has been withdrawn. Our mobile app used to offer an optional feature that recorded when you arrived at or left a site automatically, using background location. It has been withdrawn, and the app no longer asks for background location. Arrivals and departures it recorded before then remain part of the site's attendance record, kept for the same period as other check-ins.

3. How We Use Your Information

Providing Our Services

We use your information to provide photo and file management, enable team collaboration, process AI chat requests, sync data across your devices, and send transactional notifications such as project invites and updates.

Improving Our Products

We analyse usage patterns to prioritise feature development, review AI interactions to improve response quality, study project workflows to identify pain points, and conduct A/B testing of features and interfaces. This analysis uses aggregated and anonymised data wherever possible.

Safety and Quality

We monitor for misuse, abuse, or terms violations, review flagged content for policy compliance, ensure AI responses are accurate and helpful, and detect and prevent fraudulent activity.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal grounds:

Contract performance: To provide our services, manage your account, and deliver customer support.
Legitimate interests: To improve our products, analyse usage patterns, fix bugs, ensure security, and prevent fraud. This includes cookieless website measurement via Google Analytics Consent Mode (no cookies set, no persistent identifiers, truncated IP only). We balance these interests against your privacy rights.
Consent: For marketing communications, location services (photo geotagging, and the reading taken when you check in or out), optional preview features, and non-essential cookies (including Google Analytics and Microsoft Clarity on our website).
Legal obligation: To comply with tax records retention and respond to lawful requests from authorities.

5. Who We Share Your Data With

We work with trusted third-party service providers to deliver our services, including providers for database hosting, offline sync, AI processing, error tracking, analytics, payments, and email delivery. All processors are GDPR-compliant with Data Processing Agreements in place, and the majority operate within EU data centres. For the full list, see our Sub-processors page.

We never: sell your personal data to third parties, share your data with advertisers, or use your data to train AI models.

6. International Data Transfers

All your data is stored and processed within EU data centres. We do not transfer personal data outside the European Economic Area. Our database is hosted in Ireland, file storage is in the EU, and AI processing occurs in AWS Ireland. This means no Standard Contractual Clauses or additional safeguards are required for international transfers.

7. How Long We Keep Your Data

We retain your data only as long as necessary for the purposes described in this policy:

Account data: Until you delete your account, plus 30 days grace period for restoration
Project content: Until deletion, plus up to 30 days for legal backup and team access
AI chat logs: Up to 24 months for quality improvement, or sooner if you request erasure
Usage analytics: Up to 12 months for product improvement, or sooner if you request erasure
Error logs: Up to 90 days for bug fixing, or sooner if you request erasure
Site presence events: Up to 12 months for attendance and health and safety records, or sooner if you request erasure
Site visitor records: The visitor's details are kept 90 days by default. When somebody who is not a BuildersAI user signs in to a construction site, whether the site team signs them in or they sign themselves in from a poster on site, the site keeps their name, why they came, and optionally their company, contact number and who they came to see, with the times they arrived and left, so the site can account for who was present in an emergency and evidence attendance afterwards. For these records the organisation running the site is the controller and BuildersAI processes them on its behalf; the sign-in form names the organisation and the email to contact about them. The organisation can choose a longer period, up to 7 years. When the period ends the visitor's name, company, contact number and note are removed automatically, and the record that a visit happened (when, and why) is kept. Because this is a health and safety record the site is expected to keep, we cannot delete an individual entry on request during that period
Device registration: Until you remove the device or delete your account
Email delivery records: Up to 180 days, recording that a message was sent to an address and what our email provider did with it, so we can answer whether something was delivered
Notification delivery records: Up to 90 days, recording that a notification was sent to you, or the reason it was not, so we can answer whether you should have been told about something. We do not store the content of the message
Support requests: Kept for as long as you have an account. A request you send us through Get help holds what you told us, the screenshots you chose to attach, what your app and device reported at the time, and every reply either of us sent, so that we can look back at a problem you reported before and account for what we said about it. There is no separate timer on it: it is deleted with your account, screenshots included
Subject access exports: 7 days. A copy of your data prepared in response to an access request is available for a short window and is then permanently deleted
Activity records: Up to 24 months, recording who changed what inside your projects, so you can see how a job's record was built and answer questions about it later
Failed sign-in records: Up to 24 months, recording that somebody entered a wrong password or authentication code for your account, when, and how many times, so we can tell you if your account is being targeted. We never record the password or code that was tried
Administrative action records: Up to 24 months, recording changes our support staff make to an account, who made them and why, so we can account for them
Payment records: 7 years as required by UK tax law

When you request deletion, we immediately hide your data (soft delete), provide a 30-day grace period during which you can restore your account, then permanently delete your data. Aggregated statistics are anonymised and retained.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Access: Request a copy of all your personal data
Rectification: Correct any inaccurate information
Erasure: Request deletion of your account and data
Portability: Export your data in a machine-readable format
Restriction: Request we temporarily stop processing your data
Object: Opt out of certain types of processing
Withdraw consent: Remove consent for marketing or analytics at any time

To exercise these rights, contact us at privacy@buildersai.co.uk. We will respond within 30 days (or 60 days for complex requests, with explanation).

9. Cookies and Tracking

Essential Cookies

We use essential cookies for authentication and session management. These are necessary for the website to function and cannot be disabled.

Cookieless Measurement (Google Analytics)

We use Google Analytics with Consent Mode v2. When you first visit our website, Google Analytics loads immediately but operates in a cookieless mode. No cookies are set on your device and no persistent identifiers are created. In this mode, Google receives limited data (page URL, referrer, browser type, and a truncated IP address used only for country-level geolocation) to provide basic, anonymised measurement such as page view counts and session estimates. Google does not use this data to identify or track you across websites. We rely on legitimate interest (Article 6(1)(f) UK GDPR) as the legal basis for this minimal processing, as no information is stored on or read from your device.

Analytics Cookies (Consent Required)

If you click "Accept All" or enable analytics in the cookie settings, Google Analytics upgrades to full cookie-based tracking, which provides more detailed insights such as returning visitor recognition. We also load Microsoft Clarity (heatmaps and session replays) and Meta Pixel only after you give consent. All services are configured to store data in EU data centres, and IP anonymisation is enabled.

If you click "Reject All", no analytics cookies are set. Cookieless measurement via Google Analytics continues as described above. Microsoft Clarity and Meta Pixel do not load.

You can manage your cookie preferences at any time through the cookie banner when you first visit our site, or via the cookie settings link in the footer.

Advertising and Conversion Tracking

With your consent, we use Meta Pixel and Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. These tools only load after you accept analytics cookies. We do not use third-party ad networks, retargeting, or remarketing technologies.

10. AI Features

Our AI assistant features are powered by Claude (developed by Anthropic) via AWS Bedrock. All AI processing occurs in EU data centres (Ireland). When you use AI features, your queries and project context are processed to generate helpful responses.

Important: Your data is NOT used to train AI models. AWS Bedrock guarantees that customer data is not used for model training. We may review AI interactions internally for quality assurance and to improve response accuracy.

AI features are provided as an assistance tool only and should not be relied upon as professional construction, engineering, or legal advice. Always verify important information with qualified professionals.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption at rest (AES-256) and in transit (TLS 1.3), row-level security database policies, secure password hashing, and regular security audits.

In the event of a data breach affecting your personal data, we will notify the ICO within 72 hours (where required) and inform affected users without undue delay.

12. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover we have collected data from a child, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect, and update the "Last updated" date at the top of this page. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Privacy Enquiries
Email: privacy@buildersai.co.uk
Response time: Within 5 business days

Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.
Website: ico.org.uk
Phone: 0303 123 1113