This document is a starting template prepared for the BuildMaster app. Have it reviewed by a South African attorney before you publish — POPIA compliance and app-store requirements are your legal responsibility.
BuildMaster ("we", "us", "the app") is a construction-estimating tool for South African builders. This policy explains what personal information we collect, why, who we share it with, and your rights under the Protection of Personal Information Act, 2013 (POPIA).
The responsible party (operator) is:
- BuildMasterSA
- Email: sbuildmaster@gmail.com
1. Information we collect
We collect only what the app needs to work:
- Account details — your email address and password. Passwords are never stored in readable form; they are hashed and managed by our authentication provider (Supabase).
- Business profile — business name, contact person, phone and email that you choose to enter so they can appear on your quotes and bills of quantities.
- Your work — the estimates, bills of quantities, projects and prices you create in the app. This is your data; we store it so it syncs across your devices.
- "Ask the BuildMaster" messages — the questions you type into the in-app assistant are sent to a third-party AI provider (Google) to generate an answer.
- Diagnostic data — if the app crashes, limited technical crash information is sent to our error-monitoring provider (Sentry). We have configured this to exclude personally identifying information by default.
We do not sell your personal information, and we do not use it for advertising.
2. Why we process it (lawful basis)
- To create and secure your account and authenticate you.
- To store, sync and display your estimates and business profile.
- To answer your questions in the assistant feature.
- To diagnose crashes and keep the app reliable.
- To process subscriptions (handled by Apple/Google — see below).
3. Who we share it with (operators / sub-processors)
We use the following service providers, who process data on our behalf:
- Supabase — authentication and database hosting. Data is stored in the European Union (Ireland) region.
- Google (Gemini API) — processes assistant messages to generate replies. Note: messages sent via the free service tier may be used by Google to improve their services. Do not enter confidential client information into the assistant.
- Sentry — crash and error diagnostics.
- Apple App Store / Google Play — process subscription payments. We never see or store your card details.
4. Cross-border transfer
Because our database is hosted in the EU and the AI provider operates internationally, your information may be processed outside South Africa. These providers are bound by data-protection terms that POPIA recognises as providing an adequate level of protection.
5. Security
Your data is protected by row-level security (you can only ever access your own records), encrypted connections (HTTPS/TLS), and on-device session tokens stored in the platform's secure keystore. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
6. Retention
We keep your data for as long as your account is active. If you delete your account, we delete your associated records. Crash diagnostics are retained only for a limited period by our monitoring provider.
7. Your rights under POPIA
You have the right to:
- Access the personal information we hold about you.
- Ask us to correct or delete it.
- Object to processing in certain circumstances.
- Lodge a complaint with the Information Regulator (South Africa) (inforegulator.org.za).
To exercise any of these, email sbuildmaster@gmail.com.
8. Children
BuildMaster is a professional tool intended for adults (18+) and is not directed at children.
9. Changes
We may update this policy. Material changes will be notified in the app. The "Effective date" above shows the latest version.
10. Contact
Questions about this policy or your data: sbuildmaster@gmail.com.