Privacy Policy
Last updated: 17 October 2026
1. Who we are
BuilderView is a multi-tenant construction project-management platform used by home builders and their organisations to manage projects, documents, selections, budgets, invoices, build schedules, and communications with home owners and trades people.
This Platform is operated by Trinity Analysts Pty Ltd (ABN 84 654 694 890) ("BuilderView", "we", "us", "our"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").
If you have any questions about this policy or how we handle your personal information, contact our Privacy Officer at legal@builderview.com.au.
2. About this policy and our role
BuilderView is a software-as-a-service platform. Personal information is handled in two distinct ways:
- Information about our customers and their users (e.g. account holders, builders, organisation administrators, trades people) — we handle this as the responsible entity for the purpose of operating the Platform.
- Information your organisation enters about third parties — for example, when a builder records a home owner’s name, email, phone number, and site address, or uploads project documents containing personal information. For this content, your organisation (the tenant) determines what is collected and why, and BuilderView processes it on that organisation’s behalf under our agreement with them.
If you are a home owner or trades person and want to access, correct, or delete information held about you on the Platform, please contact the builder or organisation managing your project in the first instance; we will assist them as needed.
3. The kinds of personal information we collect
We collect only the information we need to provide the Platform. Depending on how you use it, this may include:
a. Account and identity information
- Name, email address, and password (stored only as a salted bcrypt hash — never in plain text)
- Phone numbers (mobile and landline) and postal/business address
- Business identifiers: company name, ABN/ACN, company logo, profile avatar
- Your role within an organisation (e.g. Organisation Admin, Builder, Site Supervisor, Home Owner, Trades Person)
b. Professional information (for trades people / contractors)
- Trade category, licence number and licence type, hourly rate
c. Authentication and security information
- Two-factor authentication (2FA) data: secret, enabled status, and backup recovery codes
- Password-reset tokens, and session and access/refresh tokens
- IP address and request metadata captured in server, security, and error logs
- Audit records of security-relevant actions, including administrator "View As" (support inspection) events logged with the actor, subject, and time
d. Project and construction information (entered by you or your organisation)
- Project details, site/property addresses, build costs and payment figures
- Uploaded files: documents, floor plans, gallery images (which may include images of properties or people), invoices, and cost estimates
- Selections, supplier and trade-budget information, build-stage tasks and schedules
- Insurance policy and claims information
e. Home owner / client information
- Names, email addresses, phone numbers, and addresses recorded by builders for the home owners and clients associated with a project (see Section 2)
f. Billing and subscription information
- Your subscription plan, status, and usage against plan limits
- We do not collect or store full payment-card numbers. Payments are processed by Stripe; card data is handled directly by Stripe under its own controls and privacy policy (see Section 7)
g. Communications and preferences
- In-app and email notifications we send you, and your notification preferences
- Support requests and any correspondence with us
h. Connected social media accounts (if you use the social-media feature)
- Authorisation tokens and account references needed to publish content to social platforms you connect
i. Limited technical information
- Strictly-necessary session/authentication cookies (see Section 6)
- Server and error logs used to keep the Platform secure and reliable
Apart from the Meta Pixel on our public marketing pages (see Section 6), we do not use advertising or third-party analytics/tracking cookies, and we do not sell your personal information.
4. How we collect personal information
- Directly from you — when you register, set up your profile, configure 2FA, upload files, or contact support.
- From your organisation — administrators and other users in your tenant may create your account or record information about you (for example, a builder adding a home owner or trades person to a project).
- Automatically — your IP address, session tokens, and request metadata are collected as a normal part of operating a secure web application.
Where an organisation provides us with personal information about other individuals (such as home owners), that organisation is responsible for ensuring it is entitled to do so and that those individuals have been made aware of this policy.
5. Why we collect, hold, use, and disclose personal information
We use personal information to:
- Create and administer accounts and organisations, and apply role-based access controls
- Provide the core Platform features (projects, documents, selections, budgets, invoices, scheduling, notifications)
- Authenticate you and keep the Platform and your data secure (including 2FA, session management, rate limiting, audit logging, and fraud/abuse prevention)
- Process subscriptions and billing
- Send you transactional and service communications (e.g. password resets, invitations, project notifications)
- Provide AI-assisted features you request (see Section 5a)
- Provide customer support and respond to your requests
- Maintain, troubleshoot, and improve the Platform
- Comply with our legal obligations and enforce our terms
5a. AI-assisted features and automated processing
BuilderView offers optional AI-assisted features. They run only when you use them, and send the information they need to an AI provider to produce the result you asked for:
- Google (Generative AI / Gemini): AI-generated project descriptions, floor-plan generation, build and trade sequence optimisation, social media content, reading a building contract you upload (to pre-fill a project), and, as an alternative to Anthropic, reading a receipt you photograph or upload. This can include project details and personal information such as a home owner's name, the site address, and names and amounts on a receipt or contract.
- Anthropic (Claude): reading a receipt you photograph or upload (to pre-fill an expense), and AI Take-off, which reads the plan set (PDF drawings) you upload to draft quantities for you to check. A receipt can include the supplier's details, what was bought and the amounts, and sometimes a name or delivery address; a plan set can include the site address and the names of the owner, builder and designer, and anything else printed on the drawings. Anthropic does not use information sent through its API to train its models. Anthropic keeps what it receives through its API only for a limited period (at most 30 days in the ordinary course) and then deletes it, unless it must keep it longer by law or to investigate misuse.
These features assist you; they do not make automated decisions that produce legal or similarly significant effects about any individual. AI-generated content should be reviewed before use. The AI provider processes this data under its own terms and privacy commitments (see Section 7).
5b. Unfinished sign-ups
If you start signing up but don't finish (for example, you leave at the payment page), we keep the details you entered — your name, email address, company, mobile number and chosen plan — so we can see where our sign-up process loses people. We email you about finishing your sign-up only if you ticked the box agreeing to it, and every such email lets you unsubscribe.
6. Cookies and similar technologies
Inside the application, BuilderView uses only strictly-necessary cookies and tokens required to sign you in and keep your session secure (for example, authentication session and refresh tokens). These are essential to operate the Platform and cannot be switched off without breaking core functionality.
On our public marketing pages (such as our home page, pricing, sign-up and contact pages), we use the Meta Pixel to measure the effectiveness of our advertising — for example, to know when a visitor who arrived from one of our ads requests a demo or starts a free trial. When you start a free trial, we also tell Meta about it directly from our servers (the Meta Conversions API), so the trial is counted even if your browser blocks the pixel. With that notice we send your email address, phone number, name, and billing city, state, postcode and country, each turned into a scrambled one-way code (a "hash") before it leaves our systems, together with your IP address, browser type and the Meta cookie identifiers on your browser. Meta uses this to match the trial to an ad you saw; we never send anything about how you use BuilderView. The Meta Pixel does not run inside the BuilderView application: once you sign in, no advertising tracking occurs. You can opt out of personalised advertising through your Meta ad preferences (https://www.facebook.com/adpreferences) or by using browser tracking protection. We do not use any other advertising cookies or marketing pixels, and we do not sell your personal information.
If you arrive through a link from one of our referral partners, we set a cookie (bv_ref) on our own website that remembers which partner sent you, for up to 90 days, so that partner can be credited if your organisation takes out a plan. It holds only the partner's code and is not used for advertising.
To understand aggregate usage and performance, we use privacy-preserving, cookieless analytics provided by Vercel (Web Analytics). These measure anonymised, aggregate traffic metrics; they do not set cookies, do not track you across other websites, and are not used to identify individuals.
7. Who we share personal information with
We share personal information only as needed to run the Platform, and with providers bound to protect it. Our key service providers ("sub-processors") are:
| Provider | Purpose | Data involved |
|---|---|---|
| Neon | Managed PostgreSQL database hosting (Sydney, Australia — ap-southeast-2) | All structured Platform data |
| Vercel | Application hosting and content delivery (compute in Sydney, Australia) | Requests, session data, logs |
| Amazon Web Services (S3) | File/object storage (Sydney, Australia — ap-southeast-2) | Uploaded documents, floor plans, gallery images, invoices, logos, avatars |
| Amazon Web Services (SES) | Sending transactional and notification emails | Recipient email address and email content |
| Stripe | Subscription billing and payment processing | Billing contact and payment details (handled directly by Stripe) |
| AI-assisted features (Generative AI / Gemini), including reading contracts, and receipts as an alternative to Anthropic | Inputs you submit to AI features (see Section 5a) | |
| Anthropic | Reading receipts and AI Take-off (Claude): reading receipts to pre-fill expenses, and plan sets to draft quantities | Receipts you scan and plan sets you upload to AI Take-off, and the details printed on them (see Section 5a) |
| Meta Platforms, Inc. | Advertising measurement (Meta Pixel on public marketing pages, and the Conversions API when a free trial starts); United States | Page views, demo/contact requests and trial starts with pseudonymous browser identifiers; for a trial start, hashed email, phone, name and billing location, plus IP address and browser type |
| Upstash | Cache and security rate-limiting (Sydney, Australia — ap-southeast-2) | Rate-limit counters keyed by IP address / session |
| Sentry | Crash and error diagnostics for the BuilderView mobile app (hosted in the European Union — Germany) | Error details, app version, device model and operating system, and random internal user and organisation identifiers. Email addresses, phone numbers, passwords and access tokens are removed before a report is sent, and app log output is never sent. Your name, email address and organisation name are never attached to a report, though an error message can occasionally include text from the screen where the error happened |
We may also disclose personal information:
- Within your organisation — the Platform is multi-tenant; other users in your organisation may access information according to their role and the access controls configured by your administrators.
- To professional advisers (e.g. lawyers, accountants, auditors) where reasonably necessary.
- Where required or authorised by law, or to protect the rights, safety, or property of BuilderView, our users, or the public.
- In a business transfer — if BuilderView is involved in a merger, acquisition, or sale of assets, personal information may be transferred subject to this policy.
We do not sell personal information. Other than the advertising-measurement pixel described in Section 6, we do not disclose it for third-party advertising.
8. Cross-border disclosure (APP 8)
We host the core database, file storage, and application compute in Australia (Sydney). However, some of our sub-processors may store or process personal information overseas, including in the United States (for example, Stripe, Google, Anthropic and Meta), the European Union (Sentry, for mobile app crash diagnostics) and other locations where those providers operate (for example, content-delivery edge networks). Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they handle it consistently with the APPs and applicable contractual protections.
9. How we keep personal information secure (APP 11)
We take reasonable technical and organisational measures to protect personal information, including:
- Passwords stored only as salted bcrypt hashes (never in plain text)
- Optional two-factor authentication (2FA)
- Session-based authentication with signed tokens and token-version invalidation
- Role-based access control (RBAC) and per-organisation tenant isolation
- Audit logging of security-sensitive and administrative actions
- Encryption of data in transit (HTTPS/TLS)
- Encryption of data at rest (AES-256) across our managed database and file storage, with additional application-level encryption (AES-256-GCM) of especially sensitive data such as two-factor authentication secrets
- Access controls and the use of reputable infrastructure providers
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of an eligible data breach, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
10. How long we keep personal information
We keep personal information for as long as it is needed to provide the Platform to you and your organisation, and afterwards only as required to meet legal, accounting, dispute-resolution, or security obligations. When information is no longer required, we take reasonable steps to delete or de-identify it.
The periods below apply unless a longer period is required by law:
| Information | Retention |
|---|---|
| Account and profile information | For as long as the account is active |
| Project, financial, and construction records | For as long as the organisation's account is active |
| Data belonging to a closed account | Deleted or de-identified within 90 days of closure, except where a longer period applies below |
| Financial and billing records | 7 years from the end of the financial year to which they relate, to meet tax and corporations law obligations |
| Security, authentication, and audit logs | 12 months |
| Backups | Overwritten on a rolling cycle of no more than 35 days |
| Enquiry and marketing contact details | Until you opt out, and for a reasonable period afterwards to honour that opt-out |
| Unfinished sign-ups | Until you finish signing up or ask us to delete them |
Where an organisation closes its account, we retain its data for 30 days so it can be reactivated or exported, then delete or de-identify it in line with the periods above. Where you ask us to delete information we are required to keep, we will restrict its use rather than delete it, and tell you why.
11. Your privacy rights
Under the APPs you may:
- Access the personal information we hold about you
- Request correction of information that is inaccurate, out of date, incomplete, or misleading
- Opt out of non-essential communications (note: we may still send essential service messages such as security and billing notices)
- Make a complaint about how we have handled your personal information
To exercise any of these rights, contact legal@builderview.com.au. We will verify your identity and respond within a reasonable period (and in any event within the timeframes required by law). If your information is held by a builder/organisation on the Platform (see Section 2), we may direct or assist your request through them.
12. Complaints
If you are concerned about how we have handled your personal information, please contact our Privacy Officer at legal@builderview.com.au. We will acknowledge and investigate your complaint and respond within a reasonable time.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au · phone 1300 363 992.
13. Children
The Platform is intended for use by builders, their staff, trades people, and home owners in a business context, and is not directed to children. We do not knowingly collect personal information from anyone under 16 years of age. We recognise that apprentices and trainees in the construction industry may be aged 16 or 17; where such a person is given access by their employer, we treat their information with the same protections as any other user. If you believe we hold information about a child under 16, contact legal@builderview.com.au and we will delete it.
14. International users
If you access the Platform from outside Australia, your personal information will be handled as described in this policy and stored as set out in Section 8. If you are in the European Economic Area or the United Kingdom, additional rights may apply under the GDPR/UK GDPR (including erasure, restriction, portability, and objection). Contact legal@builderview.com.au to exercise these rights.
15. Changes to this policy
We may update this policy from time to time. We will publish the updated version on this page and revise the "Last updated" date. Where changes are significant, we will take reasonable steps to notify you (for example, by email or an in-app notice).
16. Contact us
Trinity Analysts Pty Ltd (ABN 84 654 694 890)
Privacy Officer — legal@builderview.com.au
Sydney NSW 2000, Australia
See also our Terms of Service.