Welcome to Buildary ("we", "our", "us"), a construction management and financial ledger application operated by Buildary Technologies. This Privacy Policy describes what personal data we collect, why we collect it, how we use and protect it, and your rights as a user.

By using Buildary (mobile app, web app, or website), you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the service.

1. Data We Collect

The following table lists every category of personal data Buildary collects, why we collect it, and the legal basis under applicable law (including India's Digital Personal Data Protection Act, 2023).

Data Category	What We Collect	Purpose	Legal Basis
Phone Number	Your mobile number entered during registration	Authentication via OTP (Firebase Authentication)	Contract performance / Consent
Camera Access	Camera used on-device for (a) QR code scanning for worker attendance, (b) capturing photos of laborers and materials	Attendance management and photo documentation. Photos are stored in Firebase Storage and linked to your workspace.	Consent (permission requested before each access)
Photo / File Uploads	Images captured or selected from gallery for laborer profiles and material records	Visual record-keeping for your workspace	Consent
Project & Financial Data	Site names, transaction amounts, labor records, material stock, attendance logs, daily reports entered by you	Core application functionality	Contract performance
Device & Crash Data	Device model, OS version, app version, anonymized crash stack traces (via Firebase Crashlytics)	Diagnosing bugs and improving app stability. No personally identifiable information is included in crash reports.	Legitimate interest
Payment Information	Subscription payment processed via Razorpay. We do not store card numbers or UPI credentials — these are handled exclusively by Razorpay.	Subscription billing	Contract performance
Usage Analytics	Aggregated, anonymized feature-usage events (e.g., screens visited) via Firebase Analytics	Understanding how features are used to improve the product	Legitimate interest
Local Device Storage	Encrypted SQLite database on your device for offline functionality	Offline-first operation — all data available without internet	Contract performance

2. How We Use Your Data

• Authenticate your identity and secure your account via OTP
• Sync your project and financial data across devices in your workspace
• Store and retrieve photos you upload for laborers and materials
• Process subscription payments and verify subscription status
• Diagnose crashes and fix bugs to improve app reliability
• Send transactional notifications (e.g., OTP, subscription renewal reminders)
• Respond to support requests and grievances

We do not use your data for advertising profiling, and we do not sell, rent, or trade your personal data to any third party.

3. Third-Party Data Processors

We use the following trusted third-party services to operate Buildary. Each acts as a data processor on our behalf under appropriate data processing agreements:

Service	Provider	Purpose	Data Shared
Firebase Authentication	Google LLC	OTP-based sign-in	Phone number
Firebase Firestore	Google LLC	Cloud database / sync	Project, financial, and labor data you create
Firebase Storage	Google LLC	Photo and file storage	Images you upload
Firebase Crashlytics	Google LLC	Crash reporting	Anonymized crash logs, device model, OS version
Firebase Remote Config	Google LLC	Feature flags and configuration	No personal data
Razorpay Checkout	Razorpay Software Pvt. Ltd.	Subscription payment processing	Payment amount and transaction reference. Card/UPI details processed directly by Razorpay — Buildary never sees or stores raw payment credentials.

All Google Firebase services are governed by Google's Privacy Policy at policies.google.com/privacy. Razorpay's privacy policy is at razorpay.com/privacy.

4. Data Storage & Security

• On-device: All local data is stored in a SQLCipher-encrypted SQLite database. The encryption key is stored in the Android Keystore / iOS Secure Enclave — it cannot be extracted by other apps.
• In transit: All communications between the app and Firebase services use TLS 1.2+.
• At rest (cloud): Firebase Firestore and Firebase Storage encrypt data at rest using AES-256.
• Authentication pins: MPIN is hashed using PBKDF2-HMAC-SHA256 with 200,000 iterations and a per-user random salt. We never store your MPIN in plaintext.
• Payment credentials: We do not store credit card numbers, CVV, or UPI PINs — these are processed exclusively by Razorpay's PCI-DSS Level 1 certified infrastructure.

5. Data Retention

• Active account data: Retained for as long as your account is active.
• Deleted records: Soft-deleted records (transactions, laborers, etc.) are retained for 90 days for recovery purposes, then permanently purged from cloud storage.
• Account deletion: If you delete your account, all personal data and project records are permanently deleted from our servers within 30 days. Local data on your device is erased immediately upon account deletion in-app.
• Crash logs: Firebase Crashlytics retains anonymized crash data for 90 days.
• Payment records: Transaction references are retained for 7 years as required by Indian tax and financial record-keeping regulations.

6. Your Rights

Under the Digital Personal Data Protection Act, 2023 (India) and other applicable laws, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Request your project and financial data exported in a machine-readable format (CSV/JSON).
• Withdraw Consent: Withdraw consent for optional data processing (e.g., analytics) at any time via Settings → Privacy in the app.
• Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 8) if you believe your data rights have been violated.

To exercise any of these rights, contact us at buildaryapp@gmail.com. We will respond within 30 days.

7. Children's Privacy

Buildary is a professional construction management tool intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with their personal data, please contact us immediately and we will delete it.

8. Grievance Officer (India — DPDP Act 2023)

In accordance with the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer for data-related concerns:

• Name: Buildary Support Team
• Email: buildaryapp@gmail.com
• Response Time: Within 30 days of receiving a complaint

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for significant changes, notify you via an in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact Us

For any questions, data requests, or concerns about this Privacy Policy, please contact us:

• Email: buildaryapp@gmail.com
• Response Time: Within 24–48 hours for general queries; within 30 days for formal data rights requests