Short version: we collect only what we need to run Construction OS for you — your account details, what you do inside the platform, and support conversations. We don't sell your data. Your content is hosted in Latin America and kept for up to 1 year after you leave. You can ask us to see, correct, or delete your data any time at /data-request.
1. Who we are
Construction OS Digital Technologies LTD (“Construction OS”, “we”, “us”) is the data controller for personal data processed through the Construction OS platform (the “Service”), except where we act as a data processor on behalf of a customer organisation (see our Data Processing Addendum).
2. What data we collect
2.1 Account data
Name, email address, hashed authentication credentials, workspace membership, assigned role, and profile metadata you provide.
2.2 Workspace content
Records you create in the Service (projects, contracts, purchase orders, RFIs, assets, uploaded documents, etc.). Where you upload documents containing personal data of third parties, you are the controller and we are the processor for that content.
2.3 Usage and telemetry
Log data (IP address, user agent, timestamps), authentication events, audit-log entries, and application error reports used to secure and operate the Service.
2.4 Cookies
Strictly necessary cookies for session management and preferences. See our Cookie Notice.
3. Why we process your data (purposes & legal bases)
- Provide the Service — performance of a contract with you or your organisation.
- Secure the Service (audit logging, abuse detection) — legitimate interests and legal obligation.
- Communicate with you about account, security and service changes — performance of a contract.
- Comply with law — legal obligation.
4. Who we share data with
We share personal data with vetted subprocessors that help us run the Service. See the current list at /subprocessors. We do not sell personal data and we do not use it for third-party advertising.
5. Hosting & international transfers
Production customer data is hosted in a managed cloud region in Latin America. Data may be processed by our subprocessors from other regions to the extent necessary to deliver the Service (see /subprocessors). The Service is not currently offered to data subjects located in the European Union or United Kingdom; if that changes, we will update this policy and put in place the appropriate transfer mechanism (such as Standard Contractual Clauses).
6. How long we keep data
We retain account and workspace data for as long as your account is active. On account closure or workspace deletion, active data is removed within 30 days and residual copies (including backups and audit-log entries) are purged within one (1) year, except where a longer period is required by law.
7. Your rights
Under the Jamaica Data Protection Act, 2020, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. You may also lodge a complaint with the Office of the Information Commissioner of Jamaica.
The quickest way to exercise a right is to submit a Data Rights Request. You can also email oracle@inifye.tech. We respond within 30 days (extendable once by up to 60 days for complex requests, with notice).
8. Security
We use row-level security, workspace isolation, role-based access control, encrypted transport (TLS) and encrypted storage at rest for customer data. See our Security & Vulnerability Disclosure page.
9. Children
The Service is not directed to individuals under 16 and we do not knowingly collect personal data from children.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the Service or by email at least 14 days before they take effect.
11. Contact
Construction OS Digital Technologies LTD, #56 Hope Road, Kingston, Jamaica W.I.
Email: oracle@inifye.tech