Platform Privacy Notice

This notice explains how Construct Software Ltd handles personal data in our software: Construct Software ID, Start and the apps reached through them (together, the “Services”). It applies from 22 October 2026.

Each app has its own section, its supplement, listing the providers it uses, the cookies it sets and anything particular to it. When you open this notice from an app, its supplement follows this notice. You can read every supplement from the list on this page.

Our Website Privacy and Cookie Notice covers our public websites, and our External Party Notice covers people who use a customer’s portal or link without an account.

1. Who we are

Construct Software Ltd, registered in England and Wales, company number [COMPANY NUMBER]. Registered office: [REGISTERED ADDRESS]. ICO registration number: [ICO NUMBER].

Data protection contact: compliance@constructsoftware.co.uk.

2. Our role: controller and processor

We act in two different roles, depending on the data.

• As a processor for our customers. Organisations that use the Services decide what information they record in them, for example sites, buildings, certificates, test results, contractor documents, applications, photographs and meeting details. For this “customer content” the organisation is the controller, and we process it only on its instructions, under our Data Processing Agreement. If you use the Services on your own, without an organisation, you are the controller of your own content.
• As a controller for our own purposes. We are the controller for the information we need to run the Services and our business: user accounts, sign-in and security records, licences and subscriptions, support requests and correspondence, and billing contacts.

If your personal data appears in customer content, for example your name on a test certificate or in a contractor’s documents, the organisation that recorded it is responsible for it, and questions or requests should go to them first. If you contact us instead, we will pass your request to the organisation concerned and help them respond. People invited to a meeting through MeetingScheduler can ask us directly for a copy of their details or for them to be deleted, as the MeetingScheduler section of our External Party Notice explains.

3. Personal data we process

Account holders

• Name, email address, phone number (if you give one), organisation, job title and role
• Your password (stored only as a secure hash), two-step verification settings, and the apps and licences you have
• If you sign up yourself, the details you give at sign-up and the version of these documents you accepted
• Security and activity records: sign-ins and failed attempts, the actions you take, the date and time, your IP address and browser details
• Support requests and messages you send us, including any attachments
• Your preferences, such as notification settings

Customer content (processed for our customers)

• Details of sites, buildings, systems, projects and contacts
• Uploaded documents, certificates, photographs and drawings, which may contain personal data, and in some apps the location where a photograph was taken
• Names, companies, qualifications and signatures of engineers, testers, inspectors and contractors
• Records of work, tests, inspections, permits, applications and meetings

The Services are not designed to hold special category data (such as health information), and customers should not record it. Photographs may occasionally show people incidentally.

4. How we use personal data and our lawful basis

Where we are the controller, we use personal data as follows:

We process customer content only to provide the Services to the customer that owns it. We do not sell personal data, we do not use customer content for advertising, and we do not use it to train artificial intelligence models. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. Where an app uses automated checks or artificial intelligence to help, its supplement explains this, and a person makes the final decision.

We will not send you marketing you have not asked for.

5. Cookies

The Services use only cookies that are strictly necessary for them to work, such as:

• a session cookie in each app that keeps you signed in while you use it, which expires when you close your browser; and
• shared sign-in cookies (cs_user, cs_token and cs_selector) that keep you signed in across Construct Software services, and remember you if you choose to stay signed in.

Each app’s supplement lists the cookies it sets. We do not use analytics or advertising cookies. If we ever want to, we will update this notice first and only set them with your consent.

6. Who we share personal data with

6.1 We use carefully chosen providers (sub-processors) to run the Services. Each is bound by a written agreement requiring it to protect personal data. Every app uses:

Apps that offer data exports also use Cloudflare, Inc. (Cloudflare R2), in the European Union, to hold an export you have asked for until it is downloaded (see section 9). The export is encrypted by us before upload so that Cloudflare cannot read it, and is deleted when the download link expires.

6.2 Each app’s supplement lists any other providers it uses, such as file storage, SMS, address lookup or artificial intelligence services.

6.3 Within an organisation, other users, and any service provider the organisation has authorised, can see customer content according to the permissions the organisation sets.

6.4 We may share personal data with our professional advisers, with a buyer of our business (under the same protections), and with regulators, courts or law enforcement where the law requires it.

6.5 We will update the relevant supplement, and tell organisation administrators, at least 30 days before we add or replace a provider that handles customer content.

7. International transfers

The Services’ data is stored in the United Kingdom, and in the European Union where an app’s supplement says so or where an export has been made at your request. Some of our providers are part of groups based outside the UK, for example in the United States, and may access data from there, such as to provide support, or process it there where a supplement says so. Where that happens, we rely on appropriate safeguards under UK data protection law, such as UK adequacy regulations (including the UK–US Data Bridge where the provider is certified) or the UK International Data Transfer Agreement or Addendum.

8. How we protect personal data

• All connections to the Services are encrypted (HTTPS).
• Passwords are stored only as secure hashes, accounts are locked after repeated failed sign-ins, and two-step verification is available.
• Uploaded files are encrypted with AES-256 before they are stored, and selected sensitive details are encrypted in our databases. Each app’s supplement says what it encrypts.
• Data exports are encrypted before they are stored, and can be opened only through our download page by someone who signs in as an administrator of the organisation (or as the account holder).
• Each organisation’s data is kept separate, and access within an organisation is controlled by role.
• Significant actions are recorded in audit logs, in the apps that keep them.
• Our staff access personal data only where needed, using individual accounts with role-based permissions, and are bound by confidentiality obligations.

No system is completely secure, but we take appropriate steps to protect the data we hold, and we will tell you and the Information Commissioner if a breach puts you at risk, as the law requires.

9. How long we keep personal data

• Customer content is kept for as long as the organisation chooses, while it uses the Services. Many compliance records must be kept for set periods; that is the organisation’s decision. When a customer deletes a file or record, it is removed from view straight away and permanently deleted within 90 days; a record that it was deleted remains in the audit trail, where the Service keeps one. Some records are kept even when they are deleted, for example as evidence or because other records depend on them; the app’s supplement says which.
• Exports: you can export your content using the export features in each Service while you have access. You can also ask us for a full export of your organisation’s content in a Service, at any time while you use that Service and during the 90 days after your subscription to it ends. We email a download link to the organisation’s administrators (or to you, if you use the Services on your own), normally within 10 working days of your request. The link works for 7 days, and only for someone who signs in as one of those administrators (or as you); we can extend it once on request. We delete our copy of the export when the link expires. A record of each download, with the IP address and browser details it came from, is kept for 2 years.
• Backups: we keep backups so that data can be recovered after an incident. Deleted data remains in our backups for a limited period, normally no more than 90 days, and is then permanently removed: database backups are kept for 60 days, backups of server files and mailboxes for 30 days, and backup copies of files we store with Cloudflare for about 90 days. Backups are used only to restore data. Our hosting provider keeps its backups on separate, isolated backup systems certified to ISO 27001 (information security) and ISO 22301 (business continuity), with an independent SOC 2 Type 2 report.
• When a subscription ends, we keep the organisation’s content in that Service for 90 days from the day we tell its administrators that the subscription has ended, so that it can be exported or the subscription restarted, and then delete it. We remind the administrators 60 days after that first notice and 7 days before the deletion date. We keep the content longer if the law requires it, if the customer asks us to, while a dispute or legal claim about the account is being resolved, or for a short time while we finish an export the customer asked for or make sure its administrators have been told. When an organisation’s last paid subscription has been deleted in this way, the organisation and all its user accounts are closed and deleted as described in the next point; the same applies to an individual account. MeetingScheduler has no subscription; see its supplement.
• User accounts are kept while the account is open. A closed account is switched off and signed out straight away, and deleted 30 days later; until then the closing can be undone, using the link in our email or, for an organisation account, by its administrator. An administrator can also switch an account off without deleting it; a switched-off account is not deleted until an administrator deletes it or the organisation’s account is closed. Names and signatures on records that belong to an organisation, such as certificates and reports, stay with those records after your account is deleted.
• Self-registration requests that are never completed are deleted automatically.
• Security and activity logs are kept for 2 years, unless an app’s supplement says otherwise. Records of requests to our servers are kept for up to 12 weeks, unless needed to investigate a security incident, and logs of our scheduled tasks for no more than about four months.
• Support requests and correspondence are kept for up to 2 years after they close. Feedback you send us is kept for 2 years.
• Billing records are kept for six years, as required for accounting purposes.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal data held about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict how your data is used;
• receive your data in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent, where we rely on it.

You can update most of your account details yourself in Construct Software ID. If you use the Services on your own, you can delete your account from your account settings; if your account belongs to an organisation, ask its administrator to delete it. To exercise any right for data we control, email compliance@constructsoftware.co.uk. We will respond within one month, and there is normally no fee. For customer content, please contact the organisation that recorded it; if you contact us, we will pass your request on and help them respond. People invited to a meeting through MeetingScheduler can ask us directly, as section 2 explains.

11. Complaints

If you have a concern about how your personal data is handled, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk, telephone 0303 123 1113.

12. Children

The Services are business services and are not intended for anyone under 18.

13. Changes to this notice

We may update this notice and its supplements. Each change is published as a new version with the date it took effect, and earlier versions remain available. If a change is significant, we will tell you in advance and may ask you to acknowledge it the next time you sign in.