Legal

Privacy Policy

Last updated

Truvect Ltd (“Truvect”, “we”, “our”, or “us”) operates the Truvect construction intelligence platform — the website at truvect.build, the web application at app.truvect.build, and the Truvect iOS and Android apps (together, the “Service”).

This policy explains how we collect, use, hold, and disclose personal information. We currently offer the Service to organisations in New Zealand, and we handle personal information in accordance with the New Zealand Privacy Act 2020 (the “Privacy Act”), including its information privacy principles and notifiable privacy breach rules.

If you have questions, or want to access or correct personal information we hold, email contact@truvect.build. That address reaches our privacy officer.

1. Who this policy covers

The Service is used by people on a construction project — main contractors, builders, subcontractors, consultants, clients, and their staff.

Two different relationships matter:

  • Your organisation’s project data. When a customer (typically the head contractor) puts project information into Truvect — programmes, claims, photos, timesheets, health-and-safety records, messages — that organisation is the agency collecting that information for its own project purposes. We hold and process it to provide the Service to them.
  • Information we collect ourselves. Account details, support emails, and requests sent through this website are collected by Truvect Ltd as the agency.

If you use Truvect because your employer or a contractor invited you, their privacy policy and your employment or subcontract terms also apply.

2. Information we collect

2.1 Website enquiries

The “Request access” form on this website collects:

  • Full name
  • Work email address
  • Company name
  • Role and number of active projects (if you provide them)
  • Any message you write

The form is sent through Web3Forms, which emails the request to us. We use this only to respond to your enquiry and to assess founding-partner access.

2.2 Account information

When an account is created (by you, or by an administrator who invites you), we collect:

  • Name
  • Email address
  • Password (stored hashed; we cannot read it)
  • Organisation and the role you hold on each project
  • Session tokens so you stay signed in

We do not currently offer social or Google sign-in, and we do not process card payments inside the Service.

2.3 Project information

The core of the Service is the project record. Depending on how the customer uses Truvect, this can include:

  • Identity and role information for people on the job (name, organisation, trade, contact details)
  • Programmes, tasks, and progress
  • Contract administration records — payment claims, variations, RFIs, contract instructions, purchase orders, invoices
  • Site diaries, timesheets, and labour allocation
  • Documents, drawings, and correspondence
  • Messages and notifications
  • Defects, photos, and related comments
  • Health and safety records — sign-in, toolbox talks, hazards, SSSPs, and incidents (which may include information about injuries, witnesses, or people involved)

Some of this is commercially sensitive as well as personal. Access is restricted by the contract-boundary permission model: each person sees the slice of the project their role is entitled to. Financial fields and internal notes are stripped server-side for roles that must not see them.

2.4 Photos, files, and voice

The mobile app may ask for:

  • Camera and photo library — to capture or attach site photos, defects, and similar records. Photos you upload become part of the project record.
  • Microphone — for spoken updates. Where speech recognition runs on the device, the audio does not leave the phone for that step. If you save a voice note or diary entry to the project, the resulting text (and any audio you choose to upload) is stored as project information.

We do not use the device’s location permission to track you. Location text on records (for example “Level 2 · Unit 204”) is whatever someone types or selects in the app.

2.5 Device and technical information

We automatically collect:

  • IP address, used for security (rate limiting, abuse prevention) and to operate the Service
  • Device and app information (operating system, app version)
  • Crash and error logs
  • Push-notification tokens on mobile, so we can deliver notifications you are entitled to receive

2.6 Cookies

The marketing site does not use advertising or analytics cookies.

The web application uses essential cookies (and equivalent tokens on mobile) to keep you signed in and to operate the Service. The Service will not work without them.

2.7 Information from other people

We also receive personal information from the customer organisation that invited you — for example when an administrator adds your name and email to a project, assigns you a defect, or records you on a timesheet or incident.

3. How we use personal information

We use personal information to:

  • Provide, maintain, and secure the Service
  • Authenticate users and enforce access controls
  • Deliver notifications (email and, on mobile, push)
  • Generate answers and summaries in Truvect AI, using only the project context the asking user is already allowed to see
  • Index documents so they can be searched and retrieved
  • Respond to access requests, support questions, and founding-partner enquiries
  • Monitor reliability and investigate abuse or security incidents
  • Meet legal obligations

We do not sell personal information. We do not use it for advertising.

Your data is not used to train shared AI models

We do not use customer project data, documents, photos, messages, or chat with Truvect AI to train general-purpose or shared models. AI features run against the permission-filtered context of the user who asked. Cross-customer training or mining of project data is not how Truvect works.

4. Who we share information with

We share personal information only as follows.

4.1 The people on your project

Other users on the same project see what their role allows — that is the point of the product. A labourer, a subcontractor, a consultant, and a client assessor are not shown the same record, and are never shown another customer’s projects.

4.2 Service providers

We use processors to run the Service. They may hold personal information only to provide that service to us:

Provider What they do Where
Fly.io Application and database hosting Sydney, Australia
Tigris (via Fly.io) Document and photo storage Same hosting environment
Cloudflare DNS, CDN, and edge security Global network
Mailgun Transactional email (invites, resets, notifications) United States
Web3Forms Delivers the website access-request form to our inbox United States
OpenRouter, Google, Anthropic, OpenAI Truvect AI reasoning, document analysis, and search embeddings United States
Expo, Google, and Apple Deliver mobile push notifications United States
Xero Accounting sync, only if a customer connects it Australia

Each provider is bound by its own terms and, where applicable, a data-processing arrangement. They are not permitted to use customer data for their own purposes beyond providing the service to us.

We may disclose information if required by New Zealand law, a court, or a competent regulator, or to protect people from serious harm.

4.4 Business transfers

If Truvect Ltd is involved in a merger, acquisition, or sale of assets, personal information may transfer as part of that transaction. We will notify account administrators of any such change.

5. Overseas disclosure

The Service is offered in New Zealand. Some personal information is held or processed outside New Zealand — in particular in Australia (application and database hosting in Sydney) and the United States (email, AI providers, and push delivery).

Under information privacy principle 12 of the Privacy Act, we only disclose personal information to an overseas person where we believe on reasonable grounds that they are required to protect the information in a way that, overall, is comparable to the Privacy Act (including by contract), or another exception in principle 12 applies.

6. How long we keep information

Information How long we keep it
Website access requests For as long as needed to handle the enquiry, then a short period in email for follow-up
Account information For the life of the account
Project records For the life of the customer contract. Construction records are often needed for defects-liability and limitation periods; we do not auto-purge live project history
Soft-deleted records Deactivated and excluded from ordinary use so the audit trail remains intact. The paper trail is part of what the customer is paying us to keep
Security and error logs Typically up to 12 months, unless needed longer to investigate an incident
Push tokens Until the device unregisters or the account is removed

When a customer contract ends, we will return or delete account-level personal information on request, except where we must retain it (for example a legal claim, or a notifiable privacy-breach record).

7. Security

We take reasonable steps to protect personal information, including:

  • Encryption in transit (TLS) and encryption at rest on hosted volumes and backups
  • Hashed passwords and revocable sessions
  • Server-side access control modelled on the construction contract
  • Tenant isolation with Row Level Security so one customer’s project data is never visible to another
  • Restricted staff access on a need-to-know basis

If you wish to review our detailed security whitepaper, contact us.

No internet service is perfectly secure. If we have a notifiable privacy breach, we will notify the Privacy Commissioner and affected people as the Privacy Act requires.

8. Your rights

Under the Privacy Act you may:

  • Ask whether we hold personal information about you, and request access to it
  • Request correction of information that is wrong, incomplete, or misleading
  • Complain to us if you think we have interfered with your privacy

Email contact@truvect.build. We will respond as soon as reasonably practicable, and within the timeframes in the Privacy Act.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

If your information is in Truvect because a customer organisation invited you, we may need to involve that organisation — they will often be the right agency to correct a project record (for example your name on a timesheet).

9. Children

Truvect is a workplace product for construction projects. It is not directed at children, and we do not knowingly create accounts for anyone under 16. If you believe we have information about a child, contact us and we will delete it.

10. Changes

We may update this policy from time to time. The “Last updated” date at the top will change, and the current version will always be at truvect.build/privacy. If a change is material, we will also email account administrators.

11. Contact

Truvect Ltd New Zealand

Privacy officer: contact@truvect.build