Privacy Policy

Who we are

BrAEC (“we”) is a construction management platform at cpm-soft.vercel.app and braec.build, available on the web and as a mobile app. This policy covers what we collect, why, and the choices you have. Questions: privacy@braec.build.

What we collect

• Account information — your name, email address, company, and role, provided when you or your project team set up access; plus security events (sign-ins, verification steps) kept in an audit log.
• Project records — the content you and your team create: daily logs, RFIs, photos, drawings, punch items, forms, schedules, financial records, and similar construction documentation.
• Email you send to the project — messages and attachments sent or forwarded to your project's intake addresses are filed into the project's communications log and become project records like any other.
• Voice recordings — when you use voice features, the audio is sent to an outside speech-to-text provider to be transcribed (see “How AI features handle your data” below). We keep no copy of dictation audio after it is transcribed; only the text transcript is kept. A meeting’s audio recording is kept with that project’s files only when the general contractor’s team chose to keep it when setting up the meeting; of the companies on the project, only the general contractor’s team has access to it.
• Usage and performance data — page-load and save timings, and errors, collected pseudonymously to keep the platform fast and reliable. We do not use advertising trackers.
• Tag counts — The tags people use are counted, without any name, project, company or date finer than the month, to improve the platform's starter tag lists.
• Device push tokens — only if you enable notifications in the mobile app; used solely to deliver your notifications.

How AI features handle your data

BrAEC uses AI to draft documents (for example, a daily log from your voice note) — a person always reviews and approves before anything becomes a record. To do this, some features send part of your project information — such as a document’s text, a question you ask, or a voice recording — to an outside AI provider, either directly or through a model router (a service that passes each request on to the company that runs the AI model). We send only what the feature needs.

Where the provider or router offers it, we ask on every request that it not store your information (zero data retention) and not use it to train AI models, and we choose providers whose published terms offer both. Once information is sent, that provider’s own terms govern it: we do not control or verify what a provider does with it, and its terms can change. The next paragraph says what happens if this stops being possible.

Sometimes zero-retention options are not available or become impractical, for cost or availability reasons, and a provider may withdraw them. If that happens, we may use providers whose terms let them keep information for a time; each such provider’s terms set how long and govern what it does with the information. When we change the model routers or speech-to-text providers we use, we update the list of service providers in this policy.

What BrAEC itself does, we can guarantee: content in the encrypted Vault is never sent to an outside AI provider or readable by our servers — it is encrypted and decrypted only on your device, and the Vault’s own question tool runs inside your browser — and we keep no copy of dictation audio after it is transcribed. What an outside provider does with information we send it is governed by its own terms (see above).

Who can see your project data

Visibility follows your project’s permissions, enforced at the database layer: your project team sees shared project records; outside companies (subcontractors, designers, inspectors) see only what is shared with their role and what they create themselves. We do not sell your data, share it with advertisers, or use it for any purpose other than operating the platform.

Platform support can look at a customer project only through a read-only seat — never acting on it — and every such look is written into that project’s own activity trail, where your team can see it.

Service providers

We use a small set of processors to run the platform: Supabase (database, authentication, and file storage), Vercel (hosting), Cloudflare (DNS and email routing), Postmark (sending and receiving project email), model routers (OpenRouter and Vercel AI Gateway) and the AI providers the routers send requests to, a speech-to-text provider for voice transcription (Groq or AssemblyAI), OpenStreetMap's geocoding service (which receives job site addresses to resolve coordinates), a weather service (which receives job site coordinates to attach conditions to daily logs), and — for mobile notifications — Google Firebase Cloud Messaging and Apple Push Notification service. Each receives only what its function requires; how we choose the AI providers and what we ask of them is described in “How AI features handle your data” above.

Project email, specifically

Because project email is delivered by an email vendor, message content necessarily passes through that vendor's systems, and the vendor's terms permit it to process messages to operate and improve its service. We treat the project record in BrAEC — not the vendor's copy — as the system of record: messages are ingested into your project at receipt, and the vendor retains its copy only for its operational retention period.

Accounting connections (for example, QuickBooks Online)

If your company connects its accounting system, the connection is authorized by you and revocable by you at any time. Data you explicitly push (for example, issued pay applications) is sent to your accounting system; data read back (for example, actual costs) is stored as part of your project records. BrAEC acts as an independent controller of the data it holds — we do not process your accounting provider's data on the provider's behalf, and the provider's own privacy terms govern what happens inside its systems.

Security

Data is encrypted in transit and at rest. Access is governed by row-level security in the database itself, verified by an automated assertion suite. Vault content uses client-side encryption — we could not read it even if compelled to try.

Retention and deletion

Construction records are legal documents, so contractual histories (issued documents, signatures, audit trails) are kept intact by design while a project exists. A company administrator can permanently delete a project, which purges its records in an audited operation. We keep independent encrypted backups for disaster recovery, pruned on a rolling schedule. To delete your account or exercise other data rights, contact us at the address above.

Children

BrAEC is a workplace tool and is not directed at children under 13.

Changes

If this policy changes materially, we will update the effective date above and notify active users in the app.