Privacy Policy.

1. Introduction

Welcome to RVYO BOQ Builder ("we", "us", "our", or "the Platform"). We are committed to protecting your privacy and ensuring the security of your personal and business data. This Privacy Policy explains how we collect, use, store, share, and protect information when you access or use our RVYO BOQ Builder platform, website, and related services (collectively, the "Services").

RVYO BOQ Builder is a construction technology platform that enables builders, contractors, estimators, architects, and construction professionals to create Bills of Quantities (BOQs), manage project costing, generate proposals, issue invoices, track project activities, and collaborate with clients and team members.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this policy, please do not use our Services.

2. Scope and Application

This Privacy Policy applies to:

Website visitors: Individuals who visit our website.

Registered users: Individuals who create accounts and use the RVYO BOQ Builder platform.

Organisation administrators: Individuals who manage organisational accounts, teams, and subscriptions.

Team members: Individuals invited to join organisations and collaborate on projects.

Clients and external collaborators: Individuals who interact with organisation projects through client portals, proposals, invoices, or approvals.

Prospects and leads: Individuals who request demos, contact our sales team, or subscribe to marketing communications.

Job applicants: Individuals who apply for employment opportunities with RVYO BOQ Builder.

This policy does not apply to:

Customer data processed on behalf of organisations: When organisations use RVYO BOQ Builder to manage their own projects, BOQs, proposals, invoices, and client data, we act as a data processor on behalf of the organisation (the data controller). The organisation's own privacy policy governs how they collect and use personal data. We process such data only in accordance with the organisation's instructions and our Data Processing Agreement (DPA).

Third-party websites and services: Our Services may contain links to third-party websites, integrations, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

3. Information We Collect

We collect and process different categories of information depending on how you interact with our Services.

3.1 Information You Provide Directly

Account and Registration Information

When you create an account or register for our Services, we may collect:

Full name

Email address

Password (encrypted)

Phone number

Job title or role

Company or organisation name

Organisation domain

Billing address

Tax identification number (e.g., GST, VAT)

Profile photograph or avatar

Organisation and Billing Information

When you create or manage an organisational account, we may collect:

Organisation legal name

Organisation domain and website

Organisation address

Contact email and phone number

Billing contact details

Payment method information (processed by payment providers; we do not store full card numbers)

Subscription plan and billing cycle

Invoice and payment history

Tax and compliance information

Project and Business Data

When you use RVYO BOQ Builder to manage projects, BOQs, proposals, invoices, and documents, you may upload or enter:

Project names, descriptions, and details

BOQ items, quantities, rates, and costing data

Material specifications and supplier information

Proposal content, terms, and pricing

Invoice details, payment terms, and client information

Document files (PDFs, images, spreadsheets, drawings)

Task descriptions, assignments, and progress updates

Approval requests, feedback, and client communications

Team member information and role assignments

Client contact details and communication preferences

Important: You are responsible for ensuring that you have the legal right to share any personal data you upload to RVYO BOQ Builder. We act as a data processor for this information and process it only on your instructions.

Communication and Support Information

When you contact our support team, request demos, or communicate with us, we may collect:

Name and contact details

Message content and attachments

Support ticket history

Demo request information

Feedback and survey responses

Email correspondence with our team

Marketing and Preferences

When you subscribe to marketing communications or manage your preferences, we may collect:

Email address

Communication preferences

Subscription status

Marketing interaction data (e.g., email opens, link clicks)

Job Application Information

When you apply for employment opportunities, we may collect:

Resume or CV

Cover letter

Work history and education

References and recommendations

Portfolio or work samples

Interview notes and assessments

3.2 Information Collected Automatically

Usage and Analytics Data

When you access or use our Services, we automatically collect:

IP address and device information

Browser type and version

Operating system

Referring website or source

Pages visited and time spent

Clicks, interactions, and navigation patterns

Features used and frequency of use

Session duration and timestamps

Error logs and crash reports

Performance metrics and load times

Cookies and Similar Technologies

We use cookies, web beacons, pixels, and similar technologies to:

Remember your login session and preferences

Personalise your experience

Analyse usage patterns and improve our Services

Serve relevant marketing communications

Prevent fraud and enhance security

For more information about our use of cookies, please see ourCookie Policy.

Location Data

We may collect approximate location data based on your IP address to:

Provide region-specific features and content

Comply with geographic data residency requirements

Detect and prevent fraudulent activity

We do not collect precise geolocation data unless you explicitly enable it for specific features.

3.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Social media platforms: When you connect or log in via social media accounts (e.g., Google, LinkedIn, Microsoft).

Payment processors: When you make payments or update billing information (e.g., Stripe, Razorpay).

Integration providers: When you connect third-party integrations (e.g., Meta Lead Forms, Google Ads, WhatsApp Business, Zapier).

Marketing and analytics providers: When you interact with our ads or marketing campaigns (e.g., Google Ads, Meta Ads, LinkedIn Ads).

Identity verification services: When we verify your identity or organisation for security or compliance purposes.

Publicly available sources: When we enrich organisational or contact data from public databases or business registries.

4. How We Use Your Information

We use the information we collect for the following purposes, each with a corresponding legal basis under applicable data protection laws (e.g., GDPR, CCPA, PDPA):

4.1 To Provide and Maintain Our Services

Legal Basis: Performance of a Contract (GDPR Art. 6(1)(b))

We use your information to:

Create and manage your account and organisational workspace.

Enable you to create BOQs, manage projects, generate proposals, issue invoices, and collaborate with team members and clients.

Process payments, issue invoices, and manage subscriptions.

Provide customer support and respond to your inquiries.

Send service-related communications (e.g., account verification, password resets, billing notifications, security alerts).

Maintain and improve the functionality, performance, and security of our Services.

4.2 To Communicate With You

Legal Basis: Legitimate Interests (GDPR Art. 6(1)(f)) or Consent (GDPR Art. 6(1)(a))

We use your information to:

Send you updates, announcements, and administrative messages related to your account or our Services.

Respond to your support requests, demo inquiries, or contact form submissions.

Notify you of changes to our Services, terms, or policies.

Invite you to participate in surveys, feedback sessions, or beta programs.

Send marketing communications about new features, products, or promotions (only with your consent where required by law).

You can opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or contacting us at privacy@boqbuilder.com.

4.3 To Improve and Personalise Our Services

Legal Basis: Legitimate Interests (GDPR Art. 6(1)(f))

We use your information to:

Analyse usage patterns and user behaviour to improve our Services.

Personalise your experience based on your preferences, role, and usage history.

Test new features, designs, and functionality.

Conduct research and development to enhance our platform.

Generate aggregated, anonymised insights about platform usage and trends.

4.4 To Ensure Security and Prevent Fraud

Legal Basis: Legitimate Interests (GDPR Art. 6(1)(f)) or Legal Obligation (GDPR Art. 6(1)(c))

We use your information to:

Monitor and detect suspicious activity, unauthorised access, or security incidents.

Verify your identity and organisational affiliation.

Prevent fraud, abuse, spam, and malicious activity.

Enforce our Terms of Service and other policies.

Comply with legal and regulatory obligations related to security and fraud prevention.

4.5 To Comply With Legal Obligations

Legal Basis: Legal Obligation (GDPR Art. 6(1)(c))

We use your information to:

Comply with applicable laws, regulations, and legal processes (e.g., tax, accounting, data protection, employment laws).

Respond to lawful requests from public authorities, courts, or law enforcement.

Maintain records required by law (e.g., invoicing, tax, employment records).

Report and disclose information as required by law or to protect our rights and interests.

4.6 For Marketing and Advertising

Legal Basis: Consent (GDPR Art. 6(1)(a)) or Legitimate Interests (GDPR Art. 6(1)(f))

We use your information to:

Send you marketing communications about our products, services, and promotions (only with your consent where required by law).

Serve you relevant advertisements on our website or third-party platforms.

Measure the effectiveness of our marketing campaigns.

Personalise advertising content based on your interests and behaviour.

You can opt out of marketing communications and targeted advertising at any time by adjusting your preferences in your account settings or contacting us.

4.7 For Employment Purposes

Legal Basis: Consent (GDPR Art. 6(1)(a)) or Legitimate Interests (GDPR Art. 6(1)(f))

We use job application information to:

Evaluate your qualifications and suitability for employment.

Communicate with you about your application and interview process.

Conduct background checks and reference checks (with your consent).

Maintain records of job applications for future opportunities.

5. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following circumstances:

5.1 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing. For example:

When you connect third-party integrations (e.g., Meta Lead Forms, Google Ads, WhatsApp Business, Zapier).

When you choose to share project data or documents with clients, collaborators, or external stakeholders.

When you participate in public forums, communities, or testimonials.

5.2 With Service Providers and Processors

We engage third-party service providers and processors to help us operate, maintain, and improve our Services. These providers may have access to your information only to perform specific tasks on our behalf and are obligated to protect your information in accordance with this Privacy Policy and applicable data protection laws.

Our service providers include:

Cloud hosting and infrastructure: [e.g., AWS, Google Cloud, Microsoft Azure]

Payment processing: [e.g., Stripe, Razorpay, PayPal]

Email and communications: [e.g., SendGrid, Mailgun, Twilio]

Analytics and monitoring: [e.g., Google Analytics, Mixpanel, Sentry]

Customer support: [e.g., Intercom, Zendesk, Freshdesk]

Marketing and advertising: [e.g., Google Ads, Meta Ads, LinkedIn Ads]

Identity verification and security: [e.g., Auth0, Okta, Duo]

Data backup and disaster recovery: [e.g., Backblaze, AWS Backup]

A current list of our subprocessors is available upon request.

5.3 With Organisational Customers (Data Controllers)

When you use RVYO BOQ Builder as part of an organisational account, your information (including project data, BOQs, proposals, invoices, and client details) may be accessible to:

Organisation administrators and team members.

Clients and external collaborators invited by the organisation.

Third-party integrations connected by the organisation.

The organisation (as the data controller) determines how this information is used and shared. We process such information only on behalf of the organisation and in accordance with their instructions and our Data Processing Agreement (DPA).

5.4 For Legal and Compliance Reasons

We may disclose your information if required by law or in response to valid requests from public authorities, courts, or law enforcement. We may also disclose information to:

Comply with legal obligations (e.g., tax, accounting, employment laws).

Protect our rights, property, or safety, or the rights, property, or safety of our users or others.

Prevent fraud, abuse, or illegal activity.

Enforce our Terms of Service or other agreements.

5.5 In Connection with Business Transfers

In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email or prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

5.6 Aggregated and Anonymised Data

We may create aggregated, anonymised, or de-identified data from your information and share it with third parties for research, analytics, marketing, or business development purposes. This data cannot reasonably be used to identify you.

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required by law.

6.1 Account and Organisation Data

Active accounts: Retained for as long as your account or organisational subscription is active.

Inactive accounts: Retained for 90 days after account closure to allow for data export or restoration, then deleted.

Trial accounts: Retained for the duration of the trial period plus 30 days, then deleted if not converted to a paid subscription.

6.2 Project and Business Data

Active projects: Retained for as long as the project is active or the organisation's subscription is active.

Archived projects: Retained for up to 7 years after project completion, or as required by law or organisational policy.

BOQs, proposals, invoices: Retained for up to 7 years after creation, or as required by tax, accounting, or legal obligations.

6.3 Billing and Payment Data

Invoices and payment records: Retained for up to 7 years, or as required by tax and accounting laws.

Payment method information: Retained only as long as necessary to process payments and manage subscriptions. Full card numbers are never stored by us; they are tokenised and stored by payment processors.

6.4 Communication and Support Data

Support tickets and correspondence: Retained for up to 3 years after resolution, or as needed to provide support and improve our Services.

Demo requests and inquiries: Retained for up to 24 months, or until you withdraw consent.

6.5 Marketing Data

Marketing preferences and subscription status: Retained until you withdraw consent or opt out.

Marketing interaction data: Retained for up to 24 months for analytics and campaign optimisation.

6.6 Job Application Data

Unsuccessful applications: Retained for up to 12 months, or longer with your consent for future opportunities.

Successful applications: Retained as part of your employment records for the duration of employment plus applicable legal retention periods.

6.7 Usage and Analytics Data

Usage logs and analytics: Retained for up to 24 months for analysis, security, and improvement purposes.

Aggregated and anonymised data: May be retained indefinitely for research and business intelligence.

6.8 Deletion and Export

You can request deletion or export of your data at any time by contacting us at privacy@boqbuilder.com or using the data export and deletion features in your account settings. We will respond to your request within 30 days, subject to applicable legal exceptions.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption: Data in transit is encrypted using TLS/SSL. Data at rest is encrypted using industry-standard encryption algorithms.

Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis, with multi-factor authentication and role-based access controls.

Network security: Firewalls, intrusion detection systems, and regular security monitoring to protect our infrastructure.

Application security: Regular security testing, vulnerability assessments, and code reviews to identify and remediate security issues.

Data minimisation: We collect and retain only the data necessary for the purposes described in this policy.

Incident response: Established procedures to detect, respond to, and notify affected parties in the event of a data breach or security incident.

Employee training: Regular training for employees on data protection, security best practices, and privacy obligations.

Third-party assessments: Regular audits and assessments of service providers and subprocessors to ensure compliance with security and privacy requirements.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you and take appropriate steps in the event of a data breach.

8. International Data Transfers

RVYO BOQ Builder operates globally, and your information may be transferred to, stored, and processed in countries other than your own. These countries may have data protection laws that differ from those of your country.

We ensure that appropriate safeguards are in place for international data transfers, including:

Standard Contractual Clauses (SCCs): We use SCCs approved by relevant data protection authorities for transfers from the European Economic Area (EEA) and United Kingdom to countries without adequate data protection laws.

Data Processing Agreements (DPAs): We enter into DPAs with service providers and subprocessors to ensure they protect your data in accordance with applicable laws.

Certification frameworks: Where applicable, we rely on certification frameworks such as the EU-U.S. Data Privacy Framework for transfers to the United States.

Data residency options: For enterprise customers, we may offer data residency options to store data in specific geographic regions.

By using our Services, you consent to the transfer of your information to countries outside your own, including the United States, India, and other jurisdictions where we operate.

9. Your Rights and Choices

Depending on your location and applicable data protection laws, you may have the following rights regarding your personal information:

9.1 Right to Access

You have the right to request a copy of the personal information we hold about you. You can access much of this information directly through your account settings or by contacting us.

9.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information. You can update your information through your account settings or by contacting us.

9.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal information, subject to applicable legal exceptions (e.g., legal obligations, contractual requirements, legitimate interests). You can request deletion through your account settings or by contacting us.

9.4 Right to Restriction of Processing

You have the right to request restriction of processing your personal information in certain circumstances (e.g., if you contest the accuracy of the data, or if processing is unlawful but you oppose erasure).

9.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit that data to another controller. You can export your data through your account settings or by contacting us.

9.6 Right to Object

You have the right to object to processing of your personal information for certain purposes (e.g., direct marketing, profiling). You can opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails or contacting us.

9.7 Right to Withdraw Consent

If we process your information based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection authority if you believe our processing of your personal information violates applicable data protection laws.

9.9 How to Exercise Your Rights

To exercise your rights, please contact us at privacy@boqbuilder.com or write to us at:

RVYO BOQ Builder, Attn: Data Protection Officer

We will respond to your request within 30 days, subject to applicable legal exceptions. We may need to verify your identity before processing your request.

9.10 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You have the right to know what personal information we collect, use, disclose, and sell.

Right to Delete: You have the right to request deletion of your personal information.

Right to Opt-Out of Sale or Sharing: We do not sell your personal information. You can opt out of sharing for targeted advertising by adjusting your preferences.

Right to Correct: You have the right to correct inaccurate personal information.

Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes that require limitation.

Non-Discrimination: You have the right to non-discrimination for exercising your privacy rights.

To exercise your California privacy rights, please contact us at privacy@boqbuilder.com or visit ourCalifornia Privacy Notice.

9.11 European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, you have the rights described above under GDPR. Our legal bases for processing your data include:

Performance of a contract: To provide our Services.

Consent: For marketing and certain optional features.

Legitimate interests: For security, fraud prevention, and service improvement.

Legal obligation: For compliance with tax, accounting, and other laws.

For more information, please see ourEuropean Privacy Notice.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyse usage, and serve relevant content. For detailed information about our use of cookies, please see ourCookie Policy.

10.1 Types of Cookies We Use

Essential cookies: Required for the functioning of our Services (e.g., login session, security).

Functional cookies: Remember your preferences and settings (e.g., language, timezone).

Analytics cookies: Help us understand how you use our Services (e.g., Google Analytics, Mixpanel).

Marketing cookies: Used to serve relevant advertisements and measure campaign effectiveness (e.g., Google Ads, Meta Ads).

10.2 Managing Cookies

You can manage your cookie preferences through your browser settings or our cookie consent banner. Please note that disabling certain cookies may affect the functionality of our Services.

11. Third-Party Integrations and Links

Our Services may integrate with third-party platforms and services (e.g., Meta Lead Forms, Google Ads, WhatsApp Business, Zapier, payment processors). When you connect or use these integrations, your information may be shared with those third parties in accordance with their privacy policies.

We encourage you to review the privacy policies of any third-party services you interact with. We are not responsible for the privacy practices of third parties.

12. Children's Privacy

Our Services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

Posting the updated policy on our website with a new "Last Updated" date.

Sending you an email notification (for registered users).

Displaying a prominent notice on our website or platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

By Email:privacy@boqbuilder.com

By Mail:RVYO BOQ Builder, Attn: Data Protection Officer

Data Protection Officer: privacy@boqbuilder.com

15. Additional Disclosures

15.1 Data Controller and Processor Roles

For website visitors, prospects, and marketing contacts: RVYO BOQ Builder acts as the data controller.

For registered users and organisational accounts: RVYO BOQ Builder acts as the data controller for account, billing, and usage data.

For project, BOQ, proposal, invoice, and client data entered by organisations: RVYO BOQ Builder acts as the data processor on behalf of the organisation (the data controller).

15.2 Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. We may use automated tools for:

Fraud detection and prevention.

Spam filtering and abuse prevention.

Personalisation of user experience (e.g., recommended features, content).

You have the right to opt out of certain automated processing by contacting us.

15.3 Do Not Track Signals

Our Services do not currently respond to "Do Not Track" (DNT) signals from browsers. However, you can manage your tracking preferences through our cookie consent banner and browser settings.

15.4 Financial Incentives

We do not offer financial incentives for the collection, sale, or deletion of personal information. Any discounts or promotions offered are reasonably related to the value of your data.

16. Glossary

Personal Data: Any information that relates to an identified or identifiable individual.

Processing: Any operation performed on personal data, including collection, use, storage, disclosure, and deletion.

Data Controller: The entity that determines the purposes and means of processing personal data.

Data Processor: The entity that processes personal data on behalf of the data controller.

Service Provider: A third-party that processes personal data on our behalf for business purposes.

Subprocessor: A third-party engaged by a service provider to process personal data.

Legitimate Interests: A legal basis for processing personal data when it is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

Thank you for trusting RVYO BOQ Builder with your data. We are committed to protecting your privacy and building a secure, transparent platform for the construction industry.