Privacy Policy

1. Who this Policy applies to

Customers — businesses that subscribe. Users — individuals using the platform under a customer account. Prospects — people whose professional contact details appear in the platform because they are associated with a construction project or a company in a customer’s target market. Prospects did not sign up and are not our customers; Section 12 explains where their information comes from and how to have it removed.

2. What we collect

a. Account and billing

Name, work email, phone, company, trade, revenue band, years in business, website, and LinkedIn and Instagram handles, as given at signup. Passwords are stored only as a salted hash. Billing is handled by Stripe: we receive the subscription status, the last four digits and card brand, and the billing address where sales tax requires it. Raw card numbers never reach our servers.

b. Usage, device and security data

Pages visited, features used, projects opened, credits spent, and the requests your browser makes to our servers. IP addresses are logged automatically for security, abuse and fraud prevention. That logging is necessary to operate the service, so it happens whether or not you accept cookies, and it is not something you can switch off while using the platform. Analytics cookies are separate and require your consent — see Section 8.

c. Connected accounts — read this one

Builtie can connect to a customer’s own LinkedIn account, email mailbox (Gmail, Outlook or Zoho), Instagram account and calendar. Where a customer connects one, we access and store, for as long as the connection exists:

• LinkedIn — the profile, connection and message threads for that account, including the content of messages sent by the people who wrote to it, and the actions we take on the customer’s behalf (invitations, messages, profile views, likes, comments, InMail).
• Mailbox — the email in the connected mailbox that is relevant to outreach, including replies from third parties. Message bodies are stored so replies can be classified, routed and answered.
• Instagram — direct-message threads and the profile details of the people in them. Builtie can only reply to conversations someone else started; it cannot open a cold conversation.
• Calendar — events in the connected calendar, including the names and email addresses of other attendees, so that meetings booked outside our own scheduling flow appear in the customer’s pipeline. Events we judge internal, and events the customer declined, are skipped.

Where a provider supports OAuth (Gmail, Outlook, LinkedIn, Instagram) no password reaches us. Zoho Mail has no OAuth path, so the credentials are entered on our page and forwarded to our connectivity provider without being stored. Disconnecting stops all access and future collection; the history already synced is retained under Section 7 unless deletion is requested.

d. Public project and permit records

Building permit and planning records published by municipal and regional authorities, currently including Toronto, Hamilton, Vancouver, Calgary, New York, Miami-Dade, Austin, Nashville, Chicago and Seattle, together with public development records. These describe properties and projects. Where such a record names an individual — an owner-applicant, for example — it is personal information and is treated as such.

e. Business contact data about decision-makers

Name, job title, employer, work email, work phone, and links to public professional profiles, for people who make or influence buying decisions at companies involved in construction projects. We collect this from: public LinkedIn profiles and LinkedIn Sales Navigator; Hunter.io; Google search results; company websites, which we read automatically; public Instagram business profiles; trade-association and industry directories; and the public records in (d). It is collected and used for business-to-business prospecting only.

3. How we use it

To deliver the service; to match projects and companies to a customer’s stated ideal customer profile; to find and verify decision-maker contact details; to send and receive outreach through a customer’s connected accounts at their instruction; to process payments; to send transactional, service and product messages; to detect fraud and abuse; to keep the service secure; and to meet legal obligations. With your consent we also use analytics to understand which pages are read.

4. Automated processing and AI

Builtie scores and classifies automatically. It assigns lead and fit scores to companies and projects, infers a construction stage from permit records, classifies inbound replies by intent, and uses large language models (Anthropic, OpenAI) to draft outreach copy and generate intelligence reports.

None of this makes a decision that produces a legal effect on an individual or similarly significantly affects them. The scores decide the order in which a salesperson sees projects; a person decides what to do next. Model output is an estimate and can be wrong, which is why it is labelled as generated rather than presented as fact. If an automated score or classification about you concerns you, you may ask us to review it and submit your observations, under Section 11.

AI providers process our prompts under their commercial data-processing terms, which exclude using that content to train their public models. We do not use customer content to train models of our own.

5. Who we share it with

We do not sell personal information, and we do not share it for advertising or cross-context behavioural advertising. We share it with the service providers below, each under contract and only for the purpose listed, and we disclose it where the law requires. A customer’s own team members can see the data in their organisation’s account.

This list is maintained against the software itself. To be told when it changes, write to privacy@builtie.com.

6. Where your data is stored, and transfers outside Canada

The primary database, file storage and backups are hosted in Canada (Supabase, Montreal region). However, several providers in Section 5 operate in the United States and the European Union, so personal information is transferred to and processed in those countries.

While it is held outside Canada it is subject to the laws of that country, including lawful access by courts and government authorities there. We require each provider by contract to protect it to a comparable standard, and we assess that protection before a transfer, as Law 25 requires. If you would like the assessment for a particular provider, ask at privacy@builtie.com.

7. How long we keep it

Account and customer content — for the life of the subscription and 90 days after cancellation, so the account can be exported or reinstated, then deleted. Billing records — 7 years, as Canadian tax law requires. Security and operational logs — up to 12 months. Prospect contact records — kept while the person remains a plausible business contact for a customer, and deleted on request under Section 12. Content synced from connected accounts — kept while the account is connected and for the retention period above; disconnecting stops collection but does not by itself erase history.

A deletion request is honoured across backups on their normal rotation rather than instantly, because backups are immutable by design.

8. Cookies and similar technologies

We ask for your consent before setting any non-essential cookie, as required by PIPEDA and Law 25. Non-essential cookies stay off until you turn them on, and you can withdraw consent at any time — it takes the same single click that granting it did.

Strictly necessary — always on. Sign-in and session, CSRF protection, account preferences, load balancing, and the record of this cookie choice itself. Automatic IP logging for security sits here too. These are required to deliver the service, so they are lawful without consent and cannot be switched off.

Analytics — off unless you allow it. Google Analytics 4 (_ga, _ga_*, up to 24 months) tells us which pages are read and where visitors arrive from. Until you consent, Google Consent Mode holds analytics_storage at denied and no analytics cookie is written. Withdrawing consent deletes the ones already set.

Advertising — not used. We run no advertising or remarketing tags, no cross-site tracking and no ad-network pixels. Google’s advertising consent signals (ad_storage, ad_user_data, ad_personalization) are sent as denied on every page regardless of what you choose. We do not use your location for ad targeting.

Your choice, the exact wording you were shown and the date are stored in your browser, so we can show what you agreed to rather than assert it. We ask again after 12 months, or sooner if this section changes materially. To review or change it now, use Cookie preferences here or in the footer of any page.

9. Security

TLS 1.2 or better in transit and AES-256 at rest. Row-level security is enabled on every table that holds customer or prospect data, so one organisation’s records are not reachable from another’s session. Administrative access is restricted and audited. Third-party credentials are held by our connectivity provider rather than in our own database wherever the provider supports it. We notify the Privacy Commissioner and affected individuals of a breach that creates a real risk of significant harm, without unreasonable delay.

No system is perfectly secure, and we do not claim otherwise. Report a vulnerability to security@builtie.com.

10. Children

The platform is for business use by adults (18+). We do not knowingly collect information about anyone under 18. Report any to privacy@builtie.com and it will be deleted.

11. Your rights

You may ask us to: give you access to the personal information we hold about you and tell you where we got it; correct it; delete it; give it to you in a portable, structured format (JSON or CSV); withdraw a consent you gave; stop sending you marketing; and review an automated score or classification about you and record your observations on it.

Write to privacy@builtie.com. We respond within 30 days. We may ask you to verify your identity first, and we will say so if a request is refused and why. If you are unsatisfied you may complain to the Office of the Privacy Commissioner of Canada, www.priv.gc.ca, or to the Commission d’accès à l’information du Québec.

12. If you are a prospect, not a customer

If you found this page because you received outreach, or because you were told your details are in Builtie, this section is for you.

We hold your professional details — typically name, job title, employer, work email, work phone and a link to a public professional profile — because your company appeared in a public construction record or an industry source, and because a customer of ours sells to companies like yours. The sources are listed in Section 2e. We do not collect special-category information, we do not build profiles of your personal life, and we do not sell your details.

You can ask us what we hold, correct it, or have it removed, by writing to privacy@builtie.com with the email address or profile in question. Removal requests are actioned within 7 business days and we suppress the record so it is not re-collected from the same source. You do not have to be a customer, and you do not have to give a reason.

13. Quebec — Law 25

Our Privacy Officer is reachable at privacy@builtie.com. Quebec residents have the rights in Section 11, including data portability and de-indexing, plus the right to be informed of automated processing (Section 4) and of transfers outside Quebec (Section 6). Our confidentiality settings are the ones described in this Policy: nothing is shared for advertising, and non-essential cookies are off by default.

14. United States residents

Builtie operates across North America from Canada, and Canadian law governs this Policy. Where a US state privacy law gives you rights to know, delete, correct or port your personal information, or to opt out of sale or of targeted advertising, we honour those requests through Section 11 or Section 12 on the same terms and in the same timeframe. As stated above, we do not sell personal information and we do not process it for targeted advertising, so there is nothing to opt out of on that front.

15. CASL and commercial messages

Messages we send you about your own account are transactional. Marketing from us carries an unsubscribe link that we honour.

Outreach sent through Builtie is sent by our customer, not by us. The customer is the sender for CASL purposes and is responsible for having a lawful basis, identifying themselves and honouring unsubscribes within 10 business days — including where they have bought our Custom plan and our team operates their accounts on their written instruction. See fightspam.gc.ca. If you received a message you believe breaches CASL, tell us at privacy@builtie.com and we will act on it and pass it to the sender.

16. Changes to this Policy

The date at the top always reflects the current version. We give customers at least 14 days’ notice by email before a material change takes effect, and we ask for cookie consent again when the cookie section changes materially.

17. Contact

Brinalle Inc., operating as Builtie · Ontario, Canada
Privacy and data requests: privacy@builtie.com
Security: security@builtie.com
General: hello@builtie.com · builtie.com
Office of the Privacy Commissioner of Canada · 1-800-282-1376 · www.priv.gc.ca