Privacy policy

Who we are

Daryl Edwards trading as Buildflow (Buildflow) provides customer relationship and project management software to building contractors. Registered address: Unit 36, 23 King Street, Cambridge CB1 1AH, United Kingdom. For privacy questions contact privacy@buildflow.builders.

Our role

For your own account details and billing we are the data controller. For the client and project data you enter into your workspace, you are the controller and we act as your processor, handling that data only on your instructions.

What we collect

• Account data: name, work email address, role and workspace membership.
• Security data: sign-in timestamps, outcome and rate-limiting records.
• Content you enter: leads, contacts, site visits, quotations, costs, contracts, documents and photos.
• Connected services, only if you enable them: Gmail messages you allow us to scan for enquiries (pilot workspaces), Google Calendar events and Google Drive documents you choose to sync. Accounting connections (Xero, Sage) are planned and are not connected today.
• Technical data: IP address and browser information in server logs.

Why we use it

To provide and secure the service (performance of our contract with you), to prevent abuse and investigate security incidents (legitimate interests), and to meet legal and accounting obligations. We do not sell personal data and we do not use your client data to train shared AI models.

AI features

Some features send the specific content you select — for example a drawing, quotation or enquiry email — to a third-party AI provider to produce an analysis. Only the content needed for that request is sent, it is processed for that request alone, and results are returned to your workspace. AI outputs are suggestions and must be reviewed by a competent person before use.

Sharing

We share data with the sub-processors named on our versioned sub-processors list, which states what each provider processes and where. Each is bound by a written agreement, and our standard data processing agreement is available to download.

Where your data is stored

The Buildflow application database and file storage are hosted in the UK/EU. That claim covers the application database and the documents and photos you upload — it does not mean every service involved in running Buildflow is UK/EU-only. Several necessarily process outside that region: the site is served through a global edge network, workspace outbound email is sent through your connected Google account where that optional route is enabled, and optional SMS alerts are sent from the United States. In addition, if you connect Google (Gmail, Calendar, Drive), Google processes that data under its own terms and infrastructure, and the AI features described above send the selected content to third-party AI providers whose processing may take place outside the UK or EEA — currently in the United States. Those transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses with the relevant provider. Choosing not to connect Google and not to use the AI features reduces those optional transfers, but it does not remove all international processing: core infrastructure and security providers may still process data outside the UK or EEA under the safeguards described above. The current provider list and transfer safeguards are published on our sub-processors page.

Retention

Workspace content is kept for as long as your subscription is active. After cancellation you can export your data for 30 days, after which the workspace and its contents are deleted. Security and billing records are kept for up to six years where required by law.

Your rights

Under UK GDPR you may request access, correction, deletion, restriction, portability or object to processing. Email privacy@buildflow.builders and we will respond within one month. If a request relates to data held in a customer’s workspace we will pass it to that customer. You may also complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and analytics

Strictly necessary cookies and local storage keep you signed in and remember interface preferences. These cannot be switched off.

On our public pages we also measure visits for statistical purposes only. If you agree, we store a visitor identifier in local storage and a session identifier that lasts until you close the tab, and we record the page viewed, the referring site, browser information and a coarse location derived from your IP address. We do not use advertising cookies, we do not build profiles and we do not share this data with advertisers.

Nothing statistical is collected until you choose “Allow analytics” on the cookie notice. You can object at any time, free of charge and in one click, using the control below — we then stop collecting and delete the identifiers stored in your browser.