Privacy policy

Who this covers

This policy covers [PLACEHOLDER — needs counsel: legal entity name, registration, and registered address for BuildingCX], operating as BuildingCX ("we", "us"): the marketing site at buildingcx.ca, the app at buildingcx.ca/app, and the contractor/owner portal. It applies to CxA firm staff, invited contractors, and owner/PM portal users.

What we collect

• Account data: name, email, password (stored as a bcrypt hash — we never store or can recover your plaintext password), organization membership and role (CxA, Contractor, or Owner/PM).
• Project data you or your team enter: checklists, functional test results, issues, schedule items, uploaded photos and documents, and signatures. This data is scoped to your organization — see "Data ownership" below.
• Contact-form submissions: name, email, firm, role, and message, if you write to us through the site.
• Technical data: request logs and error traces from normal operation of the service (see "Error tracking and analytics" below).

Cookies and tracking

Signing in to the app sets one strictly-necessary session cookie (secure, HTTP-only) that keeps you logged in — it does not track you across other sites and is not used for advertising. The marketing site (buildingcx.ca) sets no cookies.

Error tracking and analytics

We run our own, self-hosted error-tracking (SigNoz) and product-analytics (Openpanel) infrastructure rather than sending this data to a third-party SaaS vendor. Openpanel's tracking script stores no cookie or persistent identifier in your browser — we verified this directly against its source rather than assuming it from its marketing copy.

Who we share data with

We share data with a small number of vendors who process it on our behalf, listed with what each one sees on the Sub-processors page. We do not sell your data, and we do not share project data across organizations — an organization's checklists, issues, and files are visible only to its own members and anyone it has explicitly invited.

Data ownership

Every project record is scoped to the organization that created it. The CxA firm that owns a project is the data controller for that project's data; contractors and owners contribute or view data within the scope they've been given. If your organization's subscription ends, you can request an export of your data before deletion.

Data retention

[PLACEHOLDER — needs counsel: exact retention periods for account data, project data after an organization closes its account, and backup retention windows]

Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data. To exercise any of these, contact us — see below.

International data transfers

[PLACEHOLDER — needs counsel: where the underlying infrastructure is physically located, and what transfer mechanism applies if that differs from where you or your organization are based]

Children's privacy

BuildingCX is a business tool for commissioning professionals and is not directed at, or knowingly used by, children.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, for signed-in users, note it somewhere you'll see it in the app.

Contact

Questions about this page can go through the Contact page, or to hello@buildingcx.com.