Privacy Policy

BuildTrack ("we", "us", "our") provides construction management software for contractors and related businesses. This Privacy Policy explains how we handle personal data when you use our website, demo forms and the BuildTrack service (together, the "Service"). We aim to align with the Malaysian Personal Data Protection Act 2010 (PDPA), including later amendments, and good industry practice. Where GDPR or similar laws apply to a subset of data, we apply those rights as well.

We do not sell, rent, trade or otherwise share Customer Data with anyone for their own purposes. That includes the commercial and operational records you keep in BuildTrack — jobs, project values, contract sums, costing, quotations, invoices, progress claims, variation orders, customers, suppliers, team records, files and site notes. We do not use that data for advertising, data broking, benchmarking sold to others, or training third-party or public AI models.

1. Who we are

BuildTrack is operated by the organisation named on your subscription receipt or tax invoice (the "Company", "we", "us", "our"). That organisation is the data user for account, billing and marketing data described below. For privacy questions, email hello@buildtrack.com.my or call 011-2057-8260. We will publish our registered company name, SSM number and registered office on this page when those details are available to list here.

Processing of workspace records is supplemented by our Data Processing Addendum. Technical measures are summarised on our security page. Infrastructure providers are listed on subprocessors.

2. Roles

You are the data user / controller of Customer Data you put in the Service about your workers, customers, suppliers and other people (including time records, GPS clock-ins, photos, payroll accruals you record, and WhatsApp content if you connect WhatsApp Business). You decide why that data is collected. We process it as your processor on your instructions, on the terms of the DPA.

We are the data user / controller of: account and login details; subscription billing; demo, contact and marketing leads you submit to us; coarse product telemetry described below; and marketing-site analytics and advertising described in the cookies section.

Providing account details is needed to create a workspace. Providing Customer Data is needed only to the extent you choose to use those features. You can limit processing by adjusting workspace permissions, disconnecting integrations, or asking us using the contact details above.

3. Data we collect

We may collect:

• Account and profile data — name, email, phone, company name, role, and credentials you provide when registering or using the Service. Sign-in with Google uses the account email Google returns. Some devices allow optional biometric unlock of the mobile app; that biometric stays on the device and is not sent to us.
• Customer Data (your business records) — information you and your authorised users enter into the Service. This includes, without limitation: your own customers and contacts; jobs and project records; project values, contract sums, budgets, costing and margins; quotations, invoices, progress claims and variation orders; schedules; expenses; suppliers; team members; time and attendance; location captured when a user clocks in or out or completes a GPS task; files, photos, notes, payroll accruals and variable-pay records you maintain in the Service (we do not compute EPF, SOCSO, EIS or PCB or store statutory payslips); and WhatsApp messages if you connect a WhatsApp Business account or we send you operational notices. This data belongs to you. It is the most sensitive class of data we hold, and the no-sharing rules in section 4 apply to all of it.
• Technical and usage data — IP address, device and browser type, approximate location, log data, cookies and similar technologies, and how you interact with the Service. For authenticated app use, we store coarse daily activity (for example that you opened Projects or Settings on a given day on web or mobile). We do not store free-form activity logs of individual records you view, and we do not use this telemetry to reconstruct your project values, invoices or customer lists. Vercel Analytics may collect aggregated first-party visit metrics without advertising identifiers.
• Marketing and lead data — information you submit via demo requests, contact forms or similar features on our marketing site, plus first-touch attribution we store in a first-party cookie (UTM parameters and ad click IDs) so we can see which campaign a lead came from. We use this only to respond to your enquiry and measure our own marketing, as described in section 5.
• Payment data — billing details processed by Stripe for our subscription; we do not store full card numbers on our own servers. If you connect CHIP, payers’ payment details are processed by CHIP under your arrangement with CHIP.

4. Customer Data — we do not share it for others' purposes

You retain ownership of Customer Data. BuildTrack is a tool for your organisation to run its own work. We treat Customer Data as confidential and do not share it with third parties for their own use, sale, marketing, research, advertising, product-building or any other purpose of theirs.

In particular, we do not:

• Sell, rent, trade, licence or barter Customer Data;
• Share Customer Data with other customers, competing contractors, advertisers, data brokers, lead-generation firms or market-research companies;
• Disclose project values, contract sums, costing, margins, quotations, invoices, progress claims, variation orders, customer lists or similar commercial records to anyone outside your organisation except as instructed processors below;
• Use Customer Data to train third-party, public or foundation AI models, or to build datasets that leave BuildTrack for those purposes;
• Use Customer Data to target ads, create lookalike audiences, or profile your customers for anyone else;
• Combine your Customer Data with another organisation's data, or publish it in identified or identifiable form.

Customer Data is visible only to authorised users on your BuildTrack account and to BuildTrack staff who need access to operate, secure or support the Service (for example when you open a support request). Staff access is limited to what is necessary for that purpose.

Instructed processors (hosting, database, file storage, email, payments, and optional AI inference) process data only on our instructions so we can run the Service for you. They are named on the subprocessors page. They are not permitted to use Customer Data for their own marketing, product training, advertising or resale.

5. How we use your data

We use personal data to:

• Provide, operate, host, back up and display the Service to you and your authorised users, including processing Customer Data solely so your organisation can use its own records;
• Authenticate users, enforce security and prevent abuse;
• Communicate with you about the Service, support, and important notices;
• Send marketing about BuildTrack where permitted by law and your preferences — using the contact details you give us for that purpose (for example a demo form). We do not use Customer Data (project values, jobs, invoices, your customers' details, and the like) to market to your customers or to anyone else;
• Meet legal, regulatory and tax obligations;
• Analyse coarse product usage in aggregate or de-identified form to improve the product (for example which screens are used). We do not mine Customer Data — including project values and commercial records — for this purpose.

6. Robin features

When you (or a connected WhatsApp enquiry flow) use Robin parse or write-assist features, the content you submit — such as a quotation document, receipt, delivery invoice, message text or draft wording — is sent to an AI provider so we can suggest structured fields or revised text. That is processing on your instruction to provide the feature, not sharing for the AI provider’s own purposes under section 4. Suggestions are advisory; your users review them before saving. We do not use Customer Data to train public or foundation models. You can refrain from using those features if you do not want that processing.

7. Legal bases (where applicable)

Depending on context, we rely on performance of a contract, legitimate interests (such as securing the Service and measuring our marketing), consent (where required — including certain marketing, non-essential marketing-site cookies, and WhatsApp messages you send to your customers), and legal obligation. We collect personal data for specified purposes and take reasonable steps to keep it accurate for those purposes.

8. Infrastructure processors and legal disclosure

We do not share Customer Data with third parties for their own purposes. The Service is hosted software, so the processors listed on subprocessors process data solely so we can run BuildTrack for you. They may use data only on our instructions, only to provide that infrastructure or feature, and subject to appropriate safeguards.

Google Analytics, Google Ads and the Meta Pixel run on our marketing site (public pages such as the homepage, pricing and demo). They are not loaded in the authenticated product application or on public invoice/quotation pages your customers open. Microsoft Clarity session analytics, when enabled, is likewise limited to the marketing site.

We may disclose data if required by law, court order or a competent authority, or to protect rights, safety and security. Where we legally can, we will challenge overbroad requests and notify you of a demand for your Customer Data.

We do not sell personal data. If we ever were involved in a genuine corporate transaction (for example a merger), Customer Data would remain subject to this policy or an equivalent confidentiality commitment; it would not be treated as an asset to be packaged and sold for other companies to use.

9. International transfers

Your data may be processed in Malaysia and other countries where our infrastructure providers operate, including Singapore (file storage by default) and the United States or other regions used by hosting, database, email, billing and AI providers. We do not currently offer a Malaysia-only data residency product. Cross-border hosting does not change the rule in section 4: those providers process data only to run the Service, and we still do not share Customer Data with third parties for their own purposes. Transfer safeguards are the contracts we have with those processors, as described in the DPA.

10. Retention

We keep personal data only as long as needed for the purposes above, including legal, accounting and dispute resolution. Retention periods depend on the type of data and your relationship with us:

• Customer Data remains in your account until you delete it or the account is closed, then follows the 30-day export window and backup cycle in our Terms of Service.
• Coarse daily product activity facts used for service improvement are retained for up to 24 months.
• Billing records are kept as required for Malaysian tax and accounting rules.
• Marketing and lead data is kept until you ask us to stop or we no longer need it for that enquiry.

The use of raw or derived user data received from Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Security

We implement technical and organisational measures designed to protect personal data and Customer Data, including access controls so one organisation cannot see another's records, encryption in transit, and private object storage for files. Further detail is on our security page. No method of transmission or storage is completely secure; we encourage strong passwords and careful sharing of access within your organisation.

12. Your rights

Subject to applicable law (including the PDPA where it applies), you may have rights to access, correct, limit processing, withdraw consent or object in certain cases, to data portability where the PDPA or other law provides it, and to lodge a concern with the Personal Data Protection Commissioner or another supervisory authority. To exercise rights, email hello@buildtrack.com.my. Authorised users can also export or delete individual records through the Service according to their role (for example PDFs, CSVs and list downloads). We do not currently offer a single archive of an entire workspace as one download.

If we process Customer Data as your processor, we will direct individual requests about that data to you where appropriate, and assist as described in the DPA.

13. Cookies

We use cookies and similar technologies. Cookies are not used to share Customer Data with advertisers or other companies.

• Essential — session and authentication cookies (including the app token used to stay signed in) and the first-party attribution cookie on marketing visits so we can attribute a later demo request to a campaign.
• Analytics (marketing site) — Google Analytics 4 and, when configured, Microsoft Clarity on public marketing pages only.
• Advertising (marketing site) — Google Ads and Meta Pixel on public marketing pages only, to measure campaigns. These tags are not loaded in the signed-in product or on customer-facing invoice/quotation links.
• First-party product analytics — Vercel Analytics for aggregated performance and visit metrics.

You can control cookies through your browser settings; blocking some cookies may affect how the Service works. You can also opt out of marketing emails using the contact address above.

14. Children

The Service is for construction businesses. It is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact us and we will delete it.

15. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and adjust the "Last updated" date. Material changes may be communicated through the Service or by email where appropriate. We will not weaken the Customer Data no-sharing commitments in section 4 without clear notice.