Privacy Policy

EstiBuild AI

Last updated: [INSERT DATE WHEN PUBLISHED]

1. Who We Are

[YOUR COMPANY LEGAL NAME] (“EstiBuild AI,” “we,” “us,” or “our”) operates the EstiBuild AI construction estimation platform (the “Service”). For the purposes of Bangladesh’s Personal Data Protection Ordinance 2025 and applicable data protection law, we act as the data fiduciary (data controller) for the personal data described in this policy.

Contact for privacy matters: [PRIVACY CONTACT EMAIL]

2. What Data We Collect

Account and profile data: your name, email address, and password (stored as a irreversible hash, never in plain text), and the role(s) you hold within your company’s workspace.

Company data: company name, address, logo, default currency/tax settings, and subscription/billing status.

Client data you enter: names, contact details, and billing addresses of your own clients, which you provide to generate invoices and reports – this is data you control as a fiduciary yourself with respect to your clients, and we process it on your behalf as described in Section 4.

Project and estimation data: building/floor/structural details, pricing data, generated Bills of Quantities, budgets, and any project files or descriptions you enter, including free-text messages sent to the AI Assistant feature (if enabled).

Payment data: we do not store your full payment card or mobile wallet credentials. Payments are processed by bKash (and, in future, Nagad/SSLCommerz) directly; we retain only transaction status, amount, and a provider-issued reference ID needed for billing records.

Usage and log data: IP address, browser/device information, timestamps, and activity logs (e.g., “user X created project Y”) used for security, auditing, and in-app activity history features.

Communications: if you email us for support, we retain that correspondence to help resolve your request and improve the Service.

3. How We Use Your Data (Purpose Limitation)

We only use personal data for purposes that are necessary and disclosed to you, specifically to:

Create and manage your account and company workspace.
Provide the core Service: estimation calculations, report generation, invoicing, notifications, and version history.
Process payments and manage your subscription.
Send essential transactional emails (welcome, team invitations, password resets, payment confirmations).
Send optional product updates, if you have not opted out.
Monitor for security issues, fraud, and abuse, and maintain activity logs for accountability.
Improve the Service, including analyzing aggregated, non-identifying usage patterns.
Comply with legal obligations, including tax and financial recordkeeping requirements under Bangladeshi law.

We do not sell your personal data to third parties.

We rely on your consent (given when you create an account and agree to these terms) as the primary basis for processing your personal data, along with the necessity of processing to perform our contract with you (providing the Service you signed up for) and to comply with our own legal obligations (e.g., tax recordkeeping).

Where you enter your own clients’ data into the Service, you are acting as the data fiduciary for that data, and you are responsible for having a lawful basis (e.g., your client’s consent or your contractual relationship with them) to process it. We act as a data processor on your behalf for that specific data.

5. Data Retention

We retain personal data only for as long as necessary for the purposes described above:

Account data is retained for as long as your account is active, and for a reasonable period after closure (currently planned as [90 DAYS]) to allow account recovery, after which it is deleted or anonymized, unless a longer period is required by law (e.g., financial/tax records).
Processing records (logs of what data was processed and why) are retained for a minimum of five years, in line with recordkeeping obligations under the Personal Data Protection Ordinance 2025.
Activity logs are retained for [12 MONTHS] for security and audit purposes, then archived or deleted.
You may request earlier deletion of your personal data at any time, subject to Section 7 below and any legal retention obligations we must still meet (e.g., unresolved invoices, tax records).

6. Where Your Data Is Stored

The Service is hosted on cloud infrastructure (currently a DigitalOcean droplet). Depending on the data center region you or we select, your data may be processed on servers outside Bangladesh.

Under the Personal Data Protection Ordinance 2025 (as amended in 2026), a mandatory requirement to keep a real-time local copy of data within Bangladesh applies only to “restricted personal data” (relating to national security, public order, or critical infrastructure) and data processed by designated Critical Information Infrastructure. The ordinary business, project, and account data handled by EstiBuild AI does not fall into those categories, so no mandatory in-country copy is currently required – however, we will keep this policy updated if implementing regulations change this.

Where we transfer data internationally (e.g., to our hosting provider, our email provider, or Anthropic for the AI Assistant feature), we do so only with providers that maintain appropriate security and confidentiality standards, consistent with our obligations under applicable law.

7. Your Rights

Subject to applicable law (including the Personal Data Protection Ordinance 2025), you have the right to:

Access a copy of the personal data we hold about you, in an intelligible format.
Correct inaccurate or incomplete personal data.
Port your data to another service, where technically feasible.
Withdraw consent and request deletion/erasure of your personal data, subject to our legal retention obligations (e.g., financial records we must keep for tax purposes).
Restrict or object to certain processing, including any use of automated decision-making that materially affects you (the Service does not currently use automated decision-making that produces legal or similarly significant effects on users without human review).

To exercise any of these rights, contact us at [PRIVACY CONTACT EMAIL]. We will respond within a reasonable time, consistent with legal requirements once implementing regulations are finalized.

8. Children’s Data

The Service is not directed at, and is not intended for use by, individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will take steps to delete it.

9. Security

We take reasonable technical and organizational measures to protect your data, including: encrypted password storage (never plain text), HTTPS/TLS for data in transit, rate limiting and security headers on our API, role-based access control within company workspaces, and restricted, audited access to production systems. No system is perfectly secure, and we cannot guarantee absolute security, but we are committed to promptly investigating and, where required by law, notifying affected users and the relevant authority of any significant data breach.

10. Third-Party Processors

We share limited data with the following categories of third-party services, solely as needed to provide the Service:

Payment processors (bKash, and in future Nagad/SSLCommerz) – to process subscription payments.
Email delivery provider (SMTP service) – to send transactional emails (verification, invitations, password resets).
AI provider (Anthropic’s Claude API, only if the AI Assistant feature is enabled) – to process natural-language project descriptions you choose to submit through that feature. We do not send your full project database to this provider, only the conversation content you submit through the AI Assistant.
Cloud hosting provider (DigitalOcean) – to host the application and database.

These providers are only permitted to use the data we share with them to provide their service to us, not for their own independent purposes.

11. Cookies and Similar Technologies

The Service uses your browser’s local storage to keep you logged in (storing your session token) and to remember your language preference (English/Bangla). We do not currently use third-party advertising or tracking cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time, particularly as Bangladesh’s data protection regulations are finalized. We will notify you of material changes by email or in-app notice before they take effect.

13. Contact Us

For any question about this Privacy Policy or to exercise your data rights, contact:

[YOUR COMPANY LEGAL NAME] [PRIVACY CONTACT EMAIL] [YOUR BUSINESS ADDRESS]