Privacy Notice

This Privacy Notice explains how Buildersworkshop ("Buildersworkshop", "we", "us", "our") collects, uses, shares, retains, and protects personal data when you use the Buildersworkshop website and application (the "Service"). Buildersworkshop is the data controller for personal data described here. This page is maintained by Buildersworkshop and should be reviewed and updated as your practices evolve.

By creating an account or using the Service, you acknowledge the practices described in this Notice. If you do not agree, please do not use the Service.

1. Who this Notice applies to

This Notice applies to (a) contractors and other account holders who register and pay for Buildersworkshop, (b) workers invited to a contractor's account, and (c) end clients whose contact and project information a contractor enters into the Service. Contractors are responsible for having a lawful basis to enter their end clients' information into Buildersworkshop and for informing those clients as required by applicable law.

2. Personal data we collect

We collect the categories of personal data listed below. Some are provided directly by you, some are generated automatically, and some are received from third parties such as our payment processor.

• Account data — name, email address, hashed password, company name, trade, address, and profile details you enter.
• Job content — client contact details, job addresses, scope descriptions, uploaded photos, plans and PDFs, line items, quotes, invoices, payment status, wholesaler selections, notes, and time entries.
• Worker and role data — invitations you send, worker email addresses, per-job assignments, and role assignments (owner / worker).
• Payment and subscription data — plan, subscription status, renewal dates, transaction identifiers, and billing country. Card numbers and full payment credentials are collected and stored by our payment processor Paddle; we do not receive or store them.
• Usage and device data — pages viewed, features used, referrer, approximate location derived from IP, IP address, browser type, device type, operating system, session identifiers, and timestamps.
• Support and communications — messages you send us, feedback, bug reports, and correspondence.
• Cookies and similar technologies — as described in section 9.

We do not intentionally collect government identifiers, health data, or other special-category data. Please do not upload such data to the Service.

3. How we use personal data

We use personal data for the following purposes and legal bases (where the GDPR or UK GDPR applies):

• Provide the Service — create and secure your account, store your jobs and files, generate AI-assisted estimates from your text and uploads, produce quotes and invoices, and enable collaboration with workers you invite. Basis: performance of a contract.
• Billing and subscriptions — start, renew, prorate, cancel, and refund your subscription and issue receipts. Basis: performance of a contract; legal obligation for tax and accounting records.
• Service communications — send transactional emails such as email verification, password reset, billing notices, and important product changes. Basis: performance of a contract; legal obligation.
• Support — respond to your questions and troubleshoot issues. Basis: performance of a contract; legitimate interests.
• Security and fraud prevention — detect and prevent abuse, unauthorised access, and payment fraud, and enforce our Terms. Basis: legitimate interests; legal obligation.
• Improve the Service — understand usage patterns, diagnose bugs, and prioritise features. Basis: legitimate interests.
• Marketing — send optional product updates only where you have opted in or where permitted by law. You can unsubscribe at any time. Basis: consent or legitimate interests, depending on jurisdiction.
• Legal compliance — comply with applicable law and respond to lawful requests. Basis: legal obligation.

We do not sell your personal data. We do not use your job content to train third-party AI models beyond what is required to return a response to your own request, and we do not use your data for cross-context behavioural advertising.

4. AI-generated estimates

When you request an AI estimate, the text, photos, plans, and other content you attach to that job are transmitted to our AI provider for the sole purpose of returning suggestions to you. Outputs are estimates, not professional advice, and you remain responsible for reviewing and adjusting them before sending a quote or invoice.

5. How we share personal data

We share personal data only with the categories of recipients listed below, and only to the extent necessary for the purposes described in section 3.

• Paddle — Merchant of Record for Buildersworkshop. Paddle handles checkout, taxes, invoicing, refunds, and payment-related communications.
• Hosting, database, and storage providers — operate the servers, database, and file storage that run the Service under written data processing terms.
• Email delivery providers — send transactional emails on our behalf.
• AI model providers — process the content you submit to generate estimates.
• Map and places providers — power the wholesaler map and address lookups you initiate.
• Analytics and error-monitoring providers — help us understand usage and diagnose issues, where enabled.
• Workers you invite — see the job descriptions, photos, notes, and assignments you grant them access to.
• Professional advisers — legal, accounting, and audit advisers under confidentiality obligations.
• Authorities and successors — where required by law or in connection with a merger, acquisition, or sale of assets, subject to appropriate protections.

6. International transfers

Our providers may process personal data outside your country, including in the United States. Where personal data is transferred out of the UK, EEA, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision. You can request more information about these safeguards through in-app support.

7. Data retention

We keep personal data for as long as your account is active and for a reasonable period afterwards to meet legal, tax, accounting, and dispute-resolution obligations. Illustrative retention practices:

• Account and job content — retained while your account is active. On account deletion, we delete or anonymise this data within a reasonable period, subject to backup rotation.
• Billing and tax records — retained for the period required by applicable tax law (typically up to 7 years) after the relevant transaction.
• Security and audit logs — retained for a limited period sufficient to investigate incidents.
• Support correspondence — retained for a reasonable period after the issue is resolved.

You can request deletion of your account at any time (see section 8).

8. Your rights

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your personal data, subject to legal retention requirements.
• Restriction and objection — ask us to restrict or object to certain uses, including profiling and direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where we rely on consent, you may withdraw it at any time without affecting prior processing.
• Complaint — lodge a complaint with your local data protection authority. In the UK this is the ICO (ico.org.uk); in the EEA it is the supervisory authority in your country of residence.

California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these rights, contact us through in-app support or at the address in section 12. We will respond within the timeframe required by applicable law (typically within one month).

9. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences, and secure the Service. We may use limited first-party analytics to understand aggregate usage. We do not use advertising cookies or third-party trackers for cross-site advertising. You can control cookies through your browser settings; disabling essential cookies may break parts of the Service.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, hashed passwords, access controls, role-based permissions, and row-level security in our database. No online service is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

11. Children

Buildersworkshop is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Contact

For privacy questions, requests, or complaints, contact Buildersworkshop through in-app support, or by email at the address you configure on your billing profile. For billing-related privacy questions, contact Paddle at paddle.net.

13. Changes to this Notice

We may update this Privacy Notice from time to time. When we make material changes, we will update the "Last updated" date above and notify you in-app or by email before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Notice.