Privacy Policy

This policy explains how we handle personal information when you use CoBuild, our plan annotation, collaboration and sign-off product, together with the website at getcobuild.app. It applies wherever you are. Sections 11 and 12 set out the additional rights that apply if you are in Australia, the European Economic Area, the United Kingdom, California, New Zealand or Canada.

We have written it to be read. Where a term has a specific legal meaning we have said so, but we have not hidden anything behind one.

1. Who we are

CoBuild is operated by [LEGAL ENTITY NAME] (ABN [ABN]), of [REGISTERED ADDRESS] ("we", "us", "our"). We are the entity responsible for the personal information described in this policy, except where section 2 says we handle it on a customer's behalf.

For anything to do with privacy, including access, correction, deletion and complaints, write to privacy@getcobuild.app. Under the European and United Kingdom regimes we are the controller of the personal information described in section 3, unless stated otherwise.

2. Our role: customers and recipients

Two different groups of people give us personal information, and our role differs between them.

• Customers. People who hold an account and use CoBuild to mark up plans, invite their team and send plans for review. For their account and business information we decide how and why the information is handled. We are the controller (or, in Australian terms, the APP entity acting for itself).
• Recipients. People who receive a share link from a customer to review, comment on, quote or sign off a plan. A customer supplies the recipient's name, email address or mobile number, and the plan content itself. For that information we act on the customer's instructions as their processor. The customer decides what to send and to whom. If you are a recipient and want information corrected or removed, contact the business that sent you the link. You can also contact us and we will pass the request on, or act on it directly where the law requires us to.

Plans, annotations, notes and quotes uploaded by a customer may contain personal information about other people, for example a homeowner's name and site address. The customer is responsible for having a proper basis to put that information into the product. We handle it for them.

3. What we collect

Information you give us

• Account details. Your name, email address and password. Passwords are stored only as a salted hash, never in a form we can read. If you turn on two-factor authentication we also process the one-time codes we send you.
• Business profile. Company name, ABN, licence number, phone number, business address, and any logo you upload. This is shared with the other members of your workspace and appears on documents you generate.
• Contacts. Names, companies, email addresses, phone numbers and addresses of the clients and trades you add or import, so you can send them plans.
• Project content. The PDF plans you upload and everything you add to them: annotations, stamps, measurements, notes, comments, layers, quantity tables, quotes and the documents generated from them.
• Sign-off information. See section 5.
• Support and feedback. What you tell us when you contact us or submit feedback from inside the product, including any screenshot you choose to attach.

Information we collect automatically

• Technical and usage data. IP address, browser and device type, pages and features used, timestamps, and error diagnostics. We use this to keep the service running, secure and fast.
• Share activity. When a share link is first opened, and when a response is submitted. Customers see this as the status of the plans they have sent. We apply a short delay and filter out automated link scanners so that a preview bot fetching a link is not reported as a person having opened it.
• Essential storage. Cookies and browser storage as described in section 13.

We do not collect sensitive information as defined in the Australian Privacy Act 1988 (Cth), and we do not ask for it. Please do not upload health, biometric or similar information.

4. How we use it, and our legal bases

We use personal information to:

• provide the product: your account, workspace, plans, sharing, review and sign-off;
• send the transactional messages the product depends on, such as share invitations, review reminders, sign-in codes and account notices;
• create and preserve a reliable record of what was approved, and by whom;
• keep the service secure, investigate misuse, and enforce our Terms;
• provide support and act on the feedback you send us;
• improve the product, using aggregate and de-identified information wherever that is enough;
• meet our legal, tax and record-keeping obligations; and
• send product news and marketing, where you have asked for it or where we are otherwise permitted to. Every marketing message has an unsubscribe link, and unsubscribing does not stop the transactional messages above.

If the European or United Kingdom GDPR applies to you, our legal bases are: performance of a contract for providing the product and its transactional messages; legitimate interests for security, product improvement, and marketing to existing business customers, balanced against your rights; consent for the electronic signature consents described in section 5 and for marketing where consent is required, which you may withdraw at any time; and legal obligation for our record-keeping and compliance duties.

5. Electronic signatures and audit trails

When you approve plans through CoBuild we capture, and keep with the signed document:

• the signature image you draw or the name you type;
• the signer's full name and email address;
• the specific consents given, and the exact wording shown at the time;
• the date and time of signing, and the identifier of the document version signed; and
• technical details of the signing session such as IP address and browser, where available.

We collect this because it is what makes an electronic signature reliable and admissible. It supports the requirements of the Australian Electronic Transactions Act 1999 (Cth) and its state and territory equivalents, the United States ESIGN Act and UETA, and simple electronic signatures under the EU and UK eIDAS regimes. Removing part of that record would undermine the document it belongs to, so we keep the audit trail with the document for as long as the document is kept. See section 10.

Signing is voluntary. If you do not want to sign electronically, tell the business that sent you the plans and arrange another method with them.

6. AI features

Some features use a third-party AI provider: the in-product assistant, and automated analysis of plans such as detecting drawing scale or generating an icon. When you use these, the relevant content (your question, and the plan or project context needed to answer it) is sent to that provider to produce a response.

Our AI provider processes that content only to return a result to us. It does not use it to train its models. We do not use your plans or content to train our own models.

7. Who we share it with

We do not sell personal information, and we do not share it for advertising. We disclose it only:

• to the people a customer shares a plan with, which is the point of the product;
• to other members of your workspace, according to the access their role gives them;
• to the service providers listed below, who act on our instructions;
• to professional advisers, or to an acquirer if the business is sold, in which case this policy continues to apply until you are told otherwise; and
• where the law requires it, or to establish or defend a legal claim.

We keep this list current. If you would like to be told when it changes, email privacy@getcobuild.app.

8. Where your information is held

Your account, plans and files are stored in Australia, in the Sydney region of our hosting provider. Some of the providers listed in section 7 operate from the United States, so limited information (for example an email address in order to send a share invitation) is disclosed overseas.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with Australian Privacy Principle 8. For transfers out of the European Economic Area or the United Kingdom we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum or International Data Transfer Agreement, together with the additional safeguards our providers offer. A copy of the relevant terms is available on request.

9. Security

Information is encrypted in transit and at rest. Access to project data is enforced at the database level by row-level security, so a request can only ever return the projects and layers the requester has been granted. Passwords are hashed. Two-factor authentication is available on every account and we recommend turning it on. Access to production systems is restricted to those who need it.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and, where the GDPR applies, the relevant supervisory authority within 72 hours of becoming aware of it.

10. How long we keep it

• Account and business information: while your account is open, and for up to 12 months after it is closed, so it can be restored if the closure was a mistake.
• Projects, plans and annotations: until you delete them, or until your account is closed and the period above expires.
• Signed documents and their audit trails: seven years from the date of signing. These are evidence of an agreement, and both parties may need them long after the project ends.
• Technical logs: generally up to 12 months.
• Records we must keep by law, such as tax records: for the period the law requires.

You can delete your account at any time from Settings, which removes your personal account data on the timeline above. Content you contributed to another business's project may remain in that business's records, as it is their record of the transaction.

11. Your rights and choices

Wherever you are, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it if it is wrong or out of date;
• delete it, subject to the retention rules in section 10;
• stop sending you marketing; and
• explain a decision we have made about your information.

Email privacy@getcobuild.app. We will verify who you are, respond within 30 days, and tell you if we need longer or cannot do what you have asked, and why. We do not charge for a request unless it is manifestly unfounded or excessive.

If your request concerns a plan or a review that a business sent you, that business decides what happens to it. We will tell you who they are and pass your request on.

12. Regional information

Australia

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may access and correct your information under APP 12 and APP 13 as described above. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner: oaic.gov.au, or 1300 363 992. We ask that you raise it with us first so we have a chance to fix it.

European Economic Area and United Kingdom

In addition to the rights in section 11 you have the right to restrict processing, to object to processing based on legitimate interests, to data portability in a machine-readable format, and to withdraw consent at any time without affecting processing already carried out. You have the right to lodge a complaint with your local supervisory authority, or with the Information Commissioner's Office in the United Kingdom (ico.org.uk). We do not make decisions producing legal or similarly significant effects about you by automated means alone.

Where we act as a processor for a customer, that customer is the controller and we handle personal information only on their documented instructions. A data processing addendum incorporating the Standard Contractual Clauses is available at privacy@getcobuild.app.

California

Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to not be discriminated against for exercising those rights. The categories we collect, our purposes and the categories of recipients are set out in sections 3, 4 and 7.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. Because of that there is no opt-out to offer. You may use an authorised agent to make a request, and we will ask for proof of their authority.

New Zealand and Canada

If you are in New Zealand, we handle personal information in accordance with the Information Privacy Principles in the Privacy Act 2020, and you may complain to the Office of the Privacy Commissioner. If you are in Canada, we handle it in accordance with PIPEDA, and you may complain to the Office of the Privacy Commissioner of Canada.

13. Cookies and similar technologies

We use only what the product needs to work. That is a cookie holding your signed-in session, and browser storage holding preferences such as your theme and the last workspace you had open, plus a local cache of plan files so the app is usable on a poor connection.

We do not use advertising cookies, third-party analytics or tracking pixels, on this website or in the product. There is nothing to opt out of, which is why you are not being asked to dismiss a banner.

14. Children

CoBuild is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

15. Changes to this policy

We update this policy as the product changes. The date at the top shows when it last changed. If a change materially affects how we handle your personal information we will tell you by email or in the product before it takes effect.

16. Contact and complaints

Privacy enquiries, requests and complaints: privacy@getcobuild.app. Everything else: hello@getcobuild.app. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].

We will acknowledge a complaint within five business days and give you a decision within 30 days. If you are not satisfied you can take it to the regulator for your region, named in section 12.