Privacy Policy

1. Who We Are

Construway is the Data Controller for personal data collected through our website and demo request forms, and for the account and security data we need to operate the platform. For project content processed within the platform on behalf of your organisation, Construway acts as a Data Processor (operator) and your organisation is the Data Controller.

For questions about this policy or to exercise your rights, write to [email protected] or contact us.

Platform users also see this notice inside the product and accept it by version when they sign in. This page and the in-app notice describe the same processing; the version identifier at the top of this page matches the version recorded against each acceptance.

2. What Data We Collect

We collect data in two distinct contexts: as a Data Controller (website, account registration, and platform security) and as a Data Processor (content you create inside the platform on behalf of your organisation).

Website, account & security data (we are Data Controller)

• Contact data — name, email address, company name, and role, when you submit a contact or demo request form.

• Account data — login credentials, name, email address, role, the company you belong to, and optional profile information such as a profile photo and country.

• Billing data — subscription tier, billing contact, and payment reference (we do not store full card details; payments are handled by our payment processor).

• Security data — login timestamps, IP addresses, and failed login attempts, kept to protect accounts against unauthorised access and fraud.

• Usage data — pages visited, features used, and session activity collected automatically when you use our website or platform.

• Technical data — browser type, device identifiers, and cookies. See our Cookie Settings page for details.

Platform content data (we are Data Processor on your behalf)

When your organisation uses the platform, you control the content you create. This may include personal data about your team members, contractors, and project stakeholders. Categories include:

• Project data — project names, site addresses, schedules, budgets, and scope descriptions.

• Punch list & defect records — item descriptions, locations, assigned responsible parties (names/roles), status updates, resolution notes, and supporting evidence.

• Submittal & document data — uploaded drawings, specifications, submittal packages, review comments, and approval records, which may identify contractors, designers, or reviewers by name.

• Schedule & progress data — work breakdown structures, activity assignments, planned and reported progress, and schedule performance metrics linked to team members or work packages.

• Risk register data — risk descriptions, probability/impact assessments, and risk owners identified by name or role.

• Logistics & material data — supplier names, delivery schedules, material quantities, and logistics contacts.

• Photos & site imagery — photographs uploaded to the platform, which may incidentally include images of people at the job site and may carry EXIF metadata such as timestamps and GPS coordinates of the capture location.

• Team & assignment data — user names, roles, task assignments, approvals, and audit trail entries generated by platform activity.

• Communications & comments — messages, comments, and annotations entered within the platform in connection with project records.

Your organisation, as Data Controller for this content, is responsible for ensuring it has a lawful basis for processing any personal data entered into the platform and for responding to data subject requests relating to that content.

3. How We Use Your Data

• To respond to demo requests and general enquiries.

• To provide and maintain access to the platform under the service contract with your company.

• To protect accounts against fraud and unauthorised access.

• To send transactional communications such as account notifications and billing updates.

• To analyse usage patterns and improve the platform (in anonymised or aggregated form where possible).

• To comply with legal obligations.

4. Legal Basis for Processing

We rely on the following lawful bases, under LGPD Article 7 and GDPR Article 6:

• Contract — account and project data processed to perform the service contract with your company (LGPD art. 7, V; GDPR art. 6(1)(b)).

• Legitimate interests — security logs processed to prevent fraud and unauthorised access, and to respond to enquiries and improve our platform (LGPD art. 7, IX; GDPR art. 6(1)(f)).

• Legal obligation — where we are required to process data to comply with applicable law (LGPD art. 7, II; GDPR art. 6(1)(c)).

5. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law.

• Contact & enquiry data — retained for up to 3 years from your last contact with us.

• Account data — kept while your account is active. When an account is removed, personal identifiers are erased or anonymised; records needed for your company's project history remain in anonymised form.

• Security logs — deleted after 12 months.

6. Sharing with Third Parties

We do not sell your personal data. Data is stored with cloud providers acting as processing operators under strict data processing agreements: application hosting and database in the cloud, photo and document storage on encrypted object storage, and a content-delivery and security layer. We also use service providers for email delivery and analytics. We may disclose data if required by law or to protect the rights and safety of our users.

7. Your Rights

Under LGPD art. 18 you may request confirmation that we process your data, access to it, correction of incomplete or inaccurate data, anonymisation or deletion, portability, and information about who we share it with. Data subjects in the EU/EEA have equivalent rights under the GDPR, including the right to object to or restrict certain processing.

To exercise any of these rights, contact your company administrator or write to [email protected]. We will respond within the legal timeframe, and within 30 days for GDPR requests.

8. International Transfers

Some of our operators process data outside Brazil under their standard contractual safeguards, as permitted by LGPD art. 33. Where personal data originates in the EU/EEA, transfers are made under the safeguards required by GDPR Chapter V.

Construway processes data in compliance with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13.709/2018), overseen by the Autoridade Nacional de Proteção de Dados (ANPD), and with the GDPR where it applies.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encryption at rest and in transit, access controls, and regular security reviews. For more detail, see our Security & Trust page.

10. Cookies

We use cookies to operate our website and platform. Inside the platform we set only cookies necessary to run the service: a session cookie that keeps you signed in (HttpOnly, expiring after 30 minutes of inactivity and discarded when you close the browser), a CSRF token cookie that protects forms against forgery, a language cookie, and — if your company enables the optional remember-this-device step for two-factor sign-in — a cookie storing that choice for up to 7 days. We set no advertising or cross-site tracking cookies in the platform. For full details of the cookies used on this website and how to manage them, see our Cookie Settings page.

11. Changes to This Policy

We may update this policy from time to time. Each revision carries a new version identifier, shown at the top of this page. We will notify you of material changes by email or through the platform, and platform users are asked to accept the new version when they next sign in.

12. Contact

Data controller: Construway. If you have questions about this policy or wish to exercise your data rights, write to [email protected] or contact us. You also have the right to lodge a complaint with the ANPD or your local data protection authority.