BuildCraft Pro is a construction estimating and project management application operated by Bay Area Realty and Construction Inc., a California corporation ("we", "us"). Our business and privacy contact is:
Bay Area Realty and Construction Inc.
Email: support@buildcraftpro.app
The Service is offered to U.S.-based individuals and businesses. We do not knowingly serve users in the EU, UK, or other regions with separate data-protection regimes at this time.
If you add employees to the Crew & Hours feature, we store the information you enter about them so we can track time and estimate pay. Depending on what you fill in, this can include: name, role, contact info, pay rate and pay type, tax-filing status and deductions, and — if you type it in — a Social Security Number. When your crew clocks in through the self-clock kiosk, we also store, for each punch, the time, an optional selfie photo, and an optional precise GPS location captured by the device. This is sensitive information. Only enter what your business actually needs, and treat SSNs and locations accordingly — you are the employer and controller of this data; we store it on your behalf so you can run the feature.
Subscription payments are processed entirely by Stripe. Stripe receives your card details directly; BuildCraft Pro never sees or stores your card number, CVV, or bank information. We receive only a customer ID and subscription status from Stripe to unlock your paid features.
We share data only with the third-party services that make the app work, and only to the extent required to provide their service:
We do not sell your data, rent it, or share it for advertising.
We keep your data for as long as your account is active. If you delete your account (email us and we will remove it), your project data and settings are deleted from our active database. Backups may retain the data for up to 30 days after deletion.
You can access, correct, export, or delete your data at any time:
If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively "CCPA"), gives you specific rights regarding your personal information.
Notice at collection. The categories of personal information we collect are described in Section 2 above (identifiers, account credentials, business contact and project information, payment metadata, employee/PII you upload to manage your team, technical data, and authentication tokens for third-party integrations). We collect these for the business purposes described in Section 3.
Right to know. You can request that we disclose: (a) the categories of personal information we have collected about you in the past 12 months; (b) the categories of sources; (c) the business or commercial purpose for collecting; (d) the categories of third parties we share with; and (e) the specific pieces of personal information we have collected.
Right to delete. You can request that we delete your personal information, subject to certain exceptions (e.g., information needed to complete a transaction, comply with a legal obligation, detect security incidents, or exercise free speech).
Right to correct. You can request that we correct inaccurate personal information we maintain about you.
Right to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioural advertising. If our practices change, we will update this policy and provide a "Do Not Sell or Share My Personal Information" link as required by law.
Right to limit use of sensitive personal information. The CCPA defines certain categories (e.g., precise geolocation, account credentials, contents of mail/email/text messages) as "sensitive." We use sensitive personal information only as needed to provide the Service you requested and do not use it for inferring characteristics about you.
Right to non-discrimination. We will not deny you the Service, charge different prices, or provide a different level of quality because you exercised any CCPA right.
How to exercise your rights. Email us at support@buildcraftpro.app with the subject line "CCPA Request" and a description of which right you are exercising. We will verify your identity using information already in your account (email + recent activity), respond within 45 days (extendable by 45 days with notice), and confirm in writing what we did or did not do. There is no fee for the first two requests in a 12-month period. You may also designate an authorized agent to make a request on your behalf — we will require written authorization plus identity verification before acting on the agent's request.
Shine the Light (Cal. Civ. Code §1798.83). California residents may request a list of any third parties to whom we disclosed personal information for direct-marketing purposes during the prior calendar year. As of the Effective Date above, we do not share personal information for third-party direct-marketing purposes, so the answer to any such request is "none."
If we experience a security incident that affects your personal information, we will notify you by email in the most expedient time possible and without unreasonable delay, consistent with California Civil Code §1798.82 and other applicable laws (and subject to the legitimate needs of law enforcement or measures necessary to restore the integrity of our systems). The notice will describe the nature of the incident, the categories of information affected, and the steps we are taking to mitigate the impact and help you protect yourself.
We use the following third-party service providers (subprocessors) to operate the Service. Each is contractually bound to protect your data and to process it only on our instructions for the purposes described.
| Subprocessor | Purpose | Location | Compliance |
|---|---|---|---|
| Supabase | Database, authentication, file storage, edge functions | USA | SOC 2 Type II |
| Netlify | Application hosting, CDN, SSL | USA | SOC 2 Type II |
| Stripe | Payment processing, subscription billing, customer portal | USA | PCI DSS Level 1 |
| Anthropic | AI model (Claude) for estimate generation, takeoffs, scope writing | USA | SOC 2 Type II |
| OpenAI | AI model (GPT) for estimate generation (alternative to Anthropic, only if you choose it) | USA | SOC 2 Type II |
| EmailJS | Transactional email (estimates, contract signed notifications) — only if you configure it | USA | GDPR-aligned |
Important: AI subprocessors (Anthropic, OpenAI) process the prompts you submit to generate AI Output. Per their respective enterprise terms, they do not use API content to train their models. We send only the minimum data needed (the user's prompt + relevant project context) — we do not send raw client PII unless you specifically include it in a prompt. Do not paste customer SSNs, credit-card numbers, or other sensitive personal data into AI prompts.
We use a small number of strictly-necessary cookies and browser-storage mechanisms to make the Service work. We do not use advertising cookies or third-party tracking pixels.
You can clear all cookies and local storage from your browser settings at any time, but this will sign you out and force a fresh sync from our servers.
Because we do not track users for advertising and do not sell or share personal information, "Do Not Track" (DNT) and Global Privacy Control (GPC) browser signals have nothing to opt out of — we already do not engage in the "sale" or "sharing" those signals are designed to limit. If our practices ever change so that a GPC signal would be meaningful, we will treat it as a valid opt-out of sale or sharing under the CCPA.
The Service is operated from the United States, and our subprocessors are also based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. By using the Service, you consent to that transfer. We do not currently have data-residency options for users outside the U.S. If you are subject to the EU/UK GDPR or another comprehensive data-protection regime, contact us before signing up so we can confirm whether we can provide an appropriate transfer mechanism (Standard Contractual Clauses, etc.) or if our Service is unsuitable for you at this time.
We may send you transactional emails (account confirmations, billing receipts, subscription renewal reminders, security alerts, contract-signed notifications) that are essential to the Service. We do not currently send marketing emails. If we begin sending marketing emails in the future, every such email will include an unsubscribe link, and you can opt out at any time without affecting your account or transactional notifications.
BuildCraft Pro is a business product and is not directed at children under 13. We do not knowingly collect information from children.
If we change this policy in a material way, we will post the new version here and update the effective date at the top. Continued use of the service after an update means you accept the updated policy.
Bay Area Realty and Construction Inc.
Email: support@buildcraftpro.app