Privacy policy

Who is responsible?

BuildQuote is operated by To be confirmed before launch. See business details. Contact your BuildQuote contact or in-app Help (public privacy email must be confirmed before launch) about personal information.

For account administration, service security and support, the operator acts as a controller. For customer, workforce and project information entered by a subscribing business, that business generally acts as controller and BuildQuote acts on its instructions as processor. Ask that business about its own privacy notice and lawful basis.

Information and purposes

• Account names, email addresses, password hashes, memberships and session records: signing in, controlling access and administering your account.
• Business and project records: contact details, site addresses, quotes, costs, invoices, messages, drawings, photographs and notes that you choose to enter.
• Support conversations and support-access audit records: investigating and correcting reported problems. Authorised platform support staff can access business data through recorded support sessions.
• Workforce records: assignments, clock events, timesheets and configured labour rates. Location recording is off by default; when enabled, phone coordinates are requested at clock or van check-in actions. An independently connected vehicle tracker can send separate records.
• Technical information: necessary security/session records and infrastructure logs. Hosting providers may process IP addresses and request metadata.

Required registration fields are your name, email, password and business name. Without them we cannot create your account. Avoid uploading health information, identity documents, card details or other sensitive material that is unnecessary for a job.

Lawful bases

For the operator’s controller activities, the proposed bases are performance of a contract where the individual is a contracting party; legitimate interests in administering business contacts, securing the service and resolving support requests; and legal obligations where applicable. A business contract is not automatically a lawful basis for processing every employee’s data. Optional marketing or non-essential tracking, if introduced, needs a separately assessed basis and appropriate choice. Reading this notice is not consent to marketing or employee monitoring.

Subscribing businesses must establish and explain their own bases for customer and workforce processing, provide notices to affected people, and assess monitoring risks before enabling location features.

AI and connected services

When you request an enabled AI feature, relevant prompts, job context and selected files may be sent to OpenAI. AI output can be inaccurate. Check quantities, prices and drawings before using them. Responses API requests disable stored response state; that setting does not promise zero provider retention or remove abuse-monitoring obligations.

If you choose microphone dictation, your browser’s speech-recognition service handles the audio and may process it remotely. You can type instead and review the transcript before sending it to BuildQuote or AI.

Map views request background maps from OpenFreeMap and may fall back to OpenStreetMap. Those services receive the network information needed to deliver maps. Optional address lookup sends the search text to Ideal Postcodes; optional geocoding sends site addresses to Geoapify. Manual address entry remains available.

If your business connects them, Google Analytics reporting, Google Ads, Meta and Xero exchange the data needed for that integration. These server-side reporting connections are distinct from installing advertising trackers in this website. Stripe can process customer invoice payments when connected; card details are entered on Stripe’s checkout.

Render hosts the configured test service. The final provider list, processing contracts and international safeguards must be verified against the live accounts before a paid launch.

Sharing and transfers

Information is available to authorised members of your business according to their permissions, authorised support staff, relevant service providers and authorities where legally required. Shareable quote and invoice links reveal their document to whoever holds the link; share them only with intended recipients.

International transfers and safeguards: To be confirmed before launch

Processor agreement: must be completed with the verified subprocessors before business customer onboarding.

Retention and deletion

The sign-in cookie lasts up to 14 days; the account security cookie lasts one hour. Browser drafts can persist until discarded, sign-out, identity change or browser storage clearance. Location coordinates use a business-selected retention period of 1–90 days (30 days by default); cleanup runs while the service is running and when workforce records are accessed. Timesheets can remain after coordinates are removed. Backup copies require a separate retention schedule.

Account, project, support, security and backup retention: To be confirmed before launch

Clearing your browser does not delete server records. Contact your BuildQuote contact or in-app Help (public privacy email must be confirmed before launch) to request access, correction, deletion or account closure. Where a subscribing business controls the data, we will direct or assist the request through that business.

Your choices and rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where it is the basis used. These rights have legal exceptions. Requests normally receive a response within one month; permitted extensions and any reasons will be explained. We may need proportionate information to verify identity.

You can complain to us and to the Information Commissioner’s Office. You do not need to use the app to exercise your rights. We do not use AI output to make solely automated decisions with legal or similarly significant effects about you. Employers must independently review any use of workforce information for decisions.