1. Overview
BuildLedger Pro ("BuildLedger Pro," "we," "us," or "our") provides project and financial management tools for construction contractors, including a web-based API, a web application, and a companion mobile app. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, create a workspace, or otherwise use our services (collectively, the "Services").
BuildLedger Pro is a product of Aimfox IT Solutions ("Aimfox IT Solutions"), its parent company.
By using the Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Services.
2. Information We Collect
We collect information in the following ways:
- Account information: name, email address, phone number, password (stored hashed), and workspace/company details you provide when registering.
- Two-step verification information: if you turn on two-step verification, we store which methods you set up, the phone number or email address codes are sent to, your authenticator app secret (encrypted), and your recovery codes (stored hashed, so we cannot read them). The one-time codes we send you are stored hashed and expire after a few minutes. Business phone verification stores the date a number was verified.
- Project and financial data you enter: project details, budgets, expenses, wallet transactions, labour contracts and work entries, contractor and supplier details, material quotations and purchases, supplier payments, tags, tasks, and any files or receipts you upload.
- Vendor listing information: if you register as a supplier or service provider, the business profile you create: business name, description, categories, phone and WhatsApp numbers, address and city, service area, and the materials or services (with rates) in your catalogue. This information is shown to builders only if you choose to go live and your listing is approved.
- Location: the app asks for your device's approximate location (Android and iOS location permission) only when you use a location feature, and never in the background. A vendor can save their business location on their profile; we store those coordinates and use them to work out distances, and builders see only a distance (for example “3 km away”) and the address text the vendor chose to publish, not the coordinates. A builder can let the app use their current position to find nearby vendors; that position is sent with the search so distances can be calculated, and is not saved to the builder's account or profile. Location is optional: you can type a city instead, and you can withdraw the permission in your device settings at any time.
- Enquiries and reports: when a builder sends an enquiry to a vendor, we store the message, the business name and the phone number they entered so the vendor can reply. When a user reports a listing, we store the reason they give so we can review it.
- Team and role information: workspace memberships, roles, and permissions assigned to users you invite.
- Device and usage information: IP address, browser or device type, operating system, app version, and general usage patterns (e.g. which features are used) collected automatically to operate and improve the Services.
- Communications: information you provide when you contact us for support or feedback.
We do not intentionally collect sensitive categories of personal data (such as health information, government identifiers, or payment card numbers) unless you choose to include them in files, notes, or fields you upload, in which case you are responsible for ensuring you have the right to store that information.
3. How We Use Information
We use the information we collect to:
- Provide, operate, and maintain the Services, including project, expense, labour, and supplier tracking features;
- Authenticate users, including sending and checking the one-time codes used for two-step verification and for verifying a phone number, and enforce workspace, role, and license-based access controls;
- Review vendor listings before they go live, show approved listings to builders in the Nearby directory sorted by distance, deliver enquiries to vendors, and review reports of misleading or abusive listings;
- Generate project backups and enable file storage and retrieval;
- Respond to support requests and communicate service-related notices;
- Monitor, troubleshoot, and improve the performance, reliability, and security of the Services;
- Detect, investigate, and prevent fraud, abuse, or unauthorized access.
We do not sell your personal data, and we do not use the project or financial data you enter to serve third-party advertising.
4. Legal Basis for Processing
Where applicable data protection law requires a legal basis for processing (such as under the GDPR), we rely on: performance of a contract with you (providing the Services you signed up for), our legitimate interests (such as securing and improving the Services), compliance with legal obligations, and, where applicable, your consent.
5. How We Share Information
We share information only in the following circumstances:
- Within your workspace: data you enter is visible to other members of your workspace according to their assigned role and permissions.
- Vendor directory: an approved vendor listing is visible to signed-in builders, including the business name, description, categories, catalogue, phone and WhatsApp numbers, address text and city. An enquiry a builder sends is delivered to that vendor, together with the business name and phone number the builder entered. A builder can also invite a property owner into their workspace with view-only access; the owner then sees the data of the projects they are invited to.
- Service providers: we share information with vendors who help us operate the Services (e.g. hosting, cloud storage, email delivery), under contractual obligations to protect it and use it only for the purposes we specify.
- Connected third-party accounts: if you connect a third-party account (such as Google Drive) for project backups, the relevant project data is transferred to that account under your authorization; that provider's own privacy policy governs their handling of the data once transferred.
- Legal requirements: if required to comply with applicable law, regulation, legal process, or a valid governmental request.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality arrangements.
6. Third-Party Services
When you verify a phone number or use a text message code for two-step verification, the number and code are handled by our phone verification provider (Google Firebase Authentication) to deliver the message. If WhatsApp codes are turned on for your account and you choose them, the code and your number are sent through WhatsApp (Meta). Codes by email go through our email delivery provider. The Services may also integrate with third-party platforms you choose to connect, such as Google Drive for automatic project backups. When you connect such a service, you authorize us to access and transfer the relevant data on your behalf. We are not responsible for the privacy practices of third-party services; please review their privacy policies before connecting them.
7. Data Storage & Security
We use administrative, technical, and physical safeguards designed to protect your information, including encrypted connections (HTTPS/TLS) for data in transit, access controls scoped by workspace and role, hashed storage of passwords, recovery codes and one-time codes, encrypted storage of authenticator secrets, and optional two-step verification, which is required for administrator accounts. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
8. Data Retention
A vendor can switch their listing off at any time, which removes it from the directory immediately. We retain account and project data for as long as your workspace remains active, or as needed to provide the Services. If you delete a project, contractor, or other record, associated data may be retained for a limited period in backups or logs before being permanently removed. We may retain and use information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.
9. Account Deletion
You can request deletion of your account at any time from within the app (Account Settings) or by contacting us. Submitting a request does not delete anything immediately — your account enters a 30-day grace period first.
- During the 30-day window, your data is untouched and nothing is permanently removed.
- If you log back in at any point during the grace period, the deletion request is automatically cancelled and your account continues normally — no data is lost. You can also cancel the request directly without waiting to log in.
- If the 30 days pass with no cancellation, we permanently delete your user account and every workspace you own, along with all projects, expenses, labour, material, and supplier data scoped to those workspaces.
- If you were only a member of someone else's workspace (not the owner), deleting your account removes your membership and access to it, but does not delete that workspace or its data — it remains the owner's record.
- Project backup files you synced to your own connected Google Drive are not deleted by us as part of this process, since that storage belongs to you; you can remove them directly from your Drive at any time.
Vendor profiles: when a supplier or service provider account is deleted, the listing is removed from the directory straight away. The business profile (name, phone, address, location and catalogue) is kept in an inactive state, hidden from search, so that builders who had added that vendor to their own list still see the vendor's name and contact details in their records. To have a vendor profile permanently removed, contact us at the address below.
We may retain limited information beyond the grace period where required to comply with legal, tax, or accounting obligations, resolve disputes, or enforce our agreements.
10. Your Rights & Choices
Depending on your location, you may have the right to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. You can update most account and profile information, and request or cancel account deletion, directly within the app. For other requests, contact us using the details below and we will respond within a reasonable timeframe.
Workspace owners and administrators are responsible for managing the personal data of members they invite into a workspace, including removing access when appropriate.
11. Children's Privacy
The Services are intended for business use by contractors, project managers, and their teams, and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.
12. International Users
Your information may be processed and stored in countries other than the one in which you reside, including countries whose data protection laws may differ from those of your jurisdiction. Where required, we take steps intended to ensure appropriate safeguards are in place for such transfers.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date above and, for material changes, provide additional notice where appropriate. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.