Privacy Policy

Grievance Officer / Data Protection Contact

In compliance with the India Digital Personal Data Protection Act 2023 (DPDP), EU GDPR Article 27, California CPRA, and the Australian Privacy Act 1988, the following officer handles all data-protection requests, privacy complaints, and grievances:

Name:

Privacy & Compliance Lead

Designation:

Grievance Officer

Email:

privacy@runmybuild.ai

Postal address:

PairOx Pty Ltd (ABN 82 154 477 728), 4 Lorikeet Street, Glenwood, NSW 2768, Australia.

Response SLA:

30 calendar days. Urgent matters (security breach, child safety, imminent harm) are acknowledged within 24 hours and actioned within 72 hours.

You may exercise data-subject rights — access, correction, deletion, portability — by emailing the address above with subject line [DSAR] and your full registered name.

1. Information we collect

We collect the following categories of personal information:

• Account and identity information — your name, email address, phone number, password (stored only as a secure hash), business or trading name, business registration or tax identifiers (such as ABN, NZBN, VAT or GST numbers), professional or licensing details, role, and country or region.
• Project and financial information — the project, contract, budget, progress-claim, drawdown, variation, quote, schedule, valuation, inspection, certification and loan-monitoring data that you or other project participants enter, together with documents, photos and messages you upload or exchange. Some of this may include personal information about third parties that a user provides.
• Payment information — subscription and billing details processed by our payment processor, Stripe. We do not store full card numbers; card data is handled directly by Stripe under its PCI-DSS-compliant environment.
• Usage and device information — log data, IP address, device and browser type, operating system, app version, pages and features used, timestamps, and diagnostic and crash information, collected to keep the Platform secure and working and (where you consent) to understand product usage.
• Communications — the content of messages, support requests and feedback you send us or exchange through the Platform.

2. How we use your information

We use personal information to:

• create and administer your account and provide the Platform and its features to you and the participants you are connected with;
• process subscriptions, payments, usage-based charges, invoices and refunds;
• enable collaboration between project participants, including sharing project, claim, drawdown and certification information with the parties you are connected to on a project;
• provide customer support, respond to enquiries, and send you service and transactional messages (such as security alerts, invitations, claim and drawdown updates, and billing notices);
• operate, secure, maintain, troubleshoot and improve the Platform, including fraud prevention, abuse detection and content moderation;
• where you have consented, understand product usage through analytics and send you optional product or marketing communications; and
• comply with our legal, tax, accounting and regulatory obligations, and establish, exercise or defend legal claims.

3. Legal bases for processing

Where the UK GDPR or a comparable law applies, we rely on the following legal bases: performance of our contract with you (to provide the Platform and process payments); our legitimate interests (to secure, operate and improve the Platform, prevent fraud and abuse, and communicate with users), balanced against your rights; your consent (for optional analytics cookies and optional marketing, which you can withdraw at any time); and compliance with legal obligations (such as tax and record-keeping).

In Australia, New Zealand, Singapore and India we handle personal information in accordance with the applicable privacy principles and, where required, on the basis of your consent or another lawful ground.

4. When and with whom we share information

We do not sell your personal information. We share it only as needed to run the Platform and as described here:

• Other project participants — information you enter for a project is shared with the participants you are connected to on that project (for example, an owner, builder, bank, subcontractor, supplier or certifier), consistent with each participant's role and permissions.
• Service providers (sub-processors) — the trusted vendors listed below who host our infrastructure and provide payments, email, notifications, analytics, AI, monitoring and similar services under contractual confidentiality and data-protection obligations.
• Integrations you enable — where you connect a third-party service such as an accounting tool, the relevant data is exchanged with that service under your direction.
• Legal and safety — regulators, law-enforcement, professional advisers or others where required by law or to protect our rights, users or the public.
• Business transfers — a successor entity in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

5. Our sub-processors

We use the following sub-processors to provide the Platform. Each is engaged under a data-processing agreement (DPA) that requires appropriate security and confidentiality. This list may change as our services evolve; we will keep it current here.

Some sub-processors are located in, or may process data in, the United States, the European Union or other countries. Where AI providers are used, the content we send is processed under commercial or API terms and is not used to train their models. Some sub-processors (for example, SMS and push notifications) are only used when the relevant feature is enabled or configured.

6. International data transfers

The Platform is operated primarily from infrastructure in Australia, but some of our sub-processors are located in, or may process data in, other countries including the United States and the European Union. This means your personal information may be transferred to, and processed in, countries whose data-protection laws differ from those in your country.

Where we transfer personal information internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law — for example, by using vendors that offer appropriate contractual safeguards (such as standard contractual clauses) and security controls.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Platform, and afterwards only for as long as necessary to meet the purposes described in this Policy, including to comply with legal, tax, accounting and record-keeping obligations, resolve disputes and enforce our agreements.

Retention periods vary by data type and jurisdiction. Financial and transaction records are typically retained for the period required by applicable tax and corporations law (commonly up to seven years). When we no longer need personal information, we delete or de-identify it. You can ask us to delete your account and associated data, subject to the exceptions above.

8. How we protect your information

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit (HTTPS/TLS), encryption of data at rest with our infrastructure providers, hashed passwords, role- and project-based access controls, tenancy isolation between organisations, rate-limiting, audit logging, error monitoring with personal-data scrubbing, and least-privilege access for our team.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You also play a part — keep your credentials confidential, use a strong unique password, and tell us promptly of any suspected compromise.

9. Artificial intelligence and automated processing

Some features use AI to help you — for example, to generate briefings and summaries, extract information from documents you upload, moderate content, or provide in-app assistance. Where AI is used, we send the relevant content to the AI providers listed above under terms that prohibit using your content to train their models.

AI outputs may contain errors and are provided to assist, not replace, your own judgment; you should review them before relying on them. We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.

10. Marketing and communications

We send service and transactional messages that are necessary to operate the Platform (such as security, invitation, claim, drawdown and billing notices); you cannot opt out of these while you hold an account. We will only send you optional product news or marketing where you have opted in or where otherwise permitted by law, and you can unsubscribe at any time using the link in the message or by contacting us.

11. Cookies and similar technologies

We use essential cookies to keep you signed in and the Platform secure, and — only if you accept them in our cookie banner — analytics cookies to understand product usage. Our Cookie Policy explains the categories, the specific cookies, and how to manage your preferences.

12. Children's privacy

The Platform is a business tool and is not intended for, or directed to, children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Your privacy rights

You have rights over your personal information. The exact rights depend on where you are, but generally you can ask us to give you access to the information we hold about you, correct it, delete it, restrict or object to certain processing, and — where applicable — receive a copy in a portable format or withdraw a consent you have given. We will not charge you to exercise these rights except where the law allows, and we will not discriminate against you for exercising them.

• Australia (Privacy Act 1988 and the Australian Privacy Principles): you may request access to and correction of your personal information, and complain about how we handle it.
• New Zealand (Privacy Act 2020): you may request access to and correction of your personal information held by us.
• United Kingdom (UK GDPR and Data Protection Act 2018): you have rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent and to lodge a complaint with the Information Commissioner's Office (ICO).
• Singapore (Personal Data Protection Act 2012): you may request access to and correction of your personal data and withdraw consent to its use.
• India (Digital Personal Data Protection Act 2023): you may request access to, correction and erasure of your personal data, nominate another person to exercise your rights, and raise grievances with our Grievance Officer named above.
• Other regions: we will honour the data-subject rights that apply to you under your local law.

To exercise any of these rights, email privacy@runmybuild.ai (or, for grievances under Indian law, grievance@runmybuild.ai) with enough detail for us to identify your account and your request. We will verify your identity and respond within the timeframe required by applicable law. You may also use tools within the Platform to access, update or export much of your information at any time.

14. Data breach notification

We maintain procedures to detect, investigate and respond to personal-data breaches. If a breach is likely to result in a risk of serious harm to affected individuals, we will notify the relevant regulator and affected individuals as, and within the timeframes, required by applicable law (for example, the Notifiable Data Breaches scheme in Australia, and comparable requirements in the United Kingdom, New Zealand, Singapore and India).

15. Complaints

If you have a concern about how we handle your personal information, please contact us first at privacy@runmybuild.ai (or our Grievance Officer above) so we can try to resolve it. If you are not satisfied, you may complain to your local data-protection authority — for example, the Office of the Australian Information Commissioner (OAIC), the UK Information Commissioner's Office (ICO), the New Zealand Office of the Privacy Commissioner, the Personal Data Protection Commission (PDPC) in Singapore, or the Data Protection Board of India.

16. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the version and date at the top of this page and, where appropriate, notify you by email or an in-app notice. Your continued use of the Platform after the changes take effect means you accept the updated Policy.

17. How to contact us

For any privacy question or request, contact us at privacy@runmybuild.ai. RunMyBuild.ai is operated by PairOx Pty Ltd (ABN 82 154 477 728), 4 Lorikeet Street, Glenwood, NSW 2768, Australia. You can also reach our Grievance Officer using the details above.