1. Introduction
This Privacy Policy explains how Blueprint Consulting Inc., a corporation incorporated under the laws of the Province of British Columbia, Canada (“Blueprint”, “Company”, “we”, “us”, or “our”), collects, uses, discloses, stores, processes, retains, and protects personal information and other information in connection with the BuildBox platform, including all associated websites, web applications, mobile applications, dashboards, tools, features, and related services (collectively, the “Platform”).
Blueprint is committed to handling personal information in a manner that is consistent with applicable privacy laws, including British Columbia’s Personal Information Protection Act (“BC PIPA”) and, where applicable, the Personal Information Protection and Electronic Documents Act (“PIPEDA”). BC PIPA governs private-sector organizations in British Columbia, and PIPEDA applies to private-sector organizations in the course of commercial activity in Canada, including its fair information principles and related breach-reporting obligations.
This Privacy Policy forms part of and is incorporated into the BuildBox Terms of Service. If you do not agree with this Privacy Policy, you must not access or use the Platform.
2. Scope of this Privacy Policy
This Privacy Policy applies to information collected by Blueprint through the Platform, through direct communications with you, and through related business, support, billing, onboarding, product, and operational activities connected to the Platform.
This Privacy Policy does not apply to third-party websites, platforms, products, services, or applications that are not operated by Blueprint, even if they are linked to, integrated with, or accessible from the Platform. Those third parties operate under their own terms and privacy policies, and Blueprint is not responsible for their privacy practices.
3. The Types of Information We Collect
Blueprint may collect personal information, business information, technical information, usage information, and other information that you or others provide to us or that is generated through your use of the Platform.
The information we collect may include account and contact information such as your name, business name, company role, email address, telephone number, account credentials, and billing contact information. It may also include subscription and payment-related information, although payment card processing may be handled by third-party processors and Blueprint may not store full payment card details directly.
The information we collect may also include Customer Data uploaded to or generated through the Platform. Depending on how BuildBox is used, this may include project information, site information, drawings, specifications, contracts, correspondence, schedules, task records, daily reports, photos, budgets, financial entries, project notes, communications, prompts, document metadata, user-generated documents, and similar materials. If users upload personal information relating to employees, subcontractors, collaborators, clients, consultants, or other identifiable individuals, that information may also be processed through the Platform.
We may collect support and communications information, including records of emails, support tickets, meeting notes, calls, onboarding information, feature requests, survey responses, and other correspondence.
We may collect technical and device information such as IP address, browser type, device type, operating system, login records, session activity, approximate geolocation derived from IP address, app or browser version, usage timestamps, pages or features accessed, crash data, error logs, diagnostics, and other telemetry and analytics information. Privacy laws require openness and reasonable transparency about these practices, and this policy is intended to meet that obligation.
We may also collect cookie and similar technology data as described in our Cookie Policy.
4. How We Collect Information
We collect information directly from you when you create an account, subscribe, pay for the Platform, upload files, use Platform features, complete forms, communicate with us, request support, participate in onboarding, respond to surveys, or otherwise interact with Blueprint.
We collect information automatically when you use the Platform, including technical, device, usage, and analytics information generated through your access to and interaction with the Platform.
We may also receive information from other users within your organization, from administrators managing your organization’s account, from service providers that support our operations, from integrations you authorize, and from publicly available or business-related sources where lawful and appropriate.
5. Why We Collect and Use Information
Blueprint collects, uses, and processes information for purposes that are reasonably necessary to provide and operate the Platform and to carry on our business in a lawful and commercially reasonable manner. BC PIPA requires purposes to be ones a reasonable person would consider appropriate in the circumstances, and PIPEDA’s fair information principles similarly require identified purposes, limiting collection, safeguards, openness, and access rights.
We may use information to create and manage accounts, authenticate users, provide subscription access, process payments, deliver features, support collaboration, enable document storage and retrieval, provide reporting and dashboards, support customer service, troubleshoot issues, secure the Platform, detect misuse or fraud, enforce our agreements, communicate with users, improve the Platform, develop new features, and operate our business.
We may use Customer Data and related information to operate Platform functionality requested by you, including document storage, indexing, search, extraction, summarization, workflow processing, analytics, notifications, and AI-assisted functionality.
We may use information to comply with legal obligations, regulatory requirements, lawful access requests, court orders, investigations, and enforcement needs, and to protect the rights, safety, property, and security of Blueprint, our users, and others.
We may also use de-identified and aggregated information for analytics, benchmarking, diagnostics, system monitoring, service improvement, product development, internal reporting, and other lawful business purposes, provided such information does not identify an individual or your organization as an identifiable party.
6. AI and Automated Processing
BuildBox may use artificial intelligence, machine learning, automated extraction, automated summarization, automated drafting, and similar technologies to process information you submit to the Platform and to generate outputs, drafts, analyses, summaries, alerts, or insights.
Where you choose to use AI-enabled features, the information you provide through those features, including uploaded documents, prompts, metadata, and related Customer Data, may be processed to generate the requested functionality. Such processing may include automated review, indexing, extraction, summarization, classification, drafting, or other AI-assisted operations.
Unless expressly stated otherwise in this Privacy Policy or separately agreed in writing, Blueprint does not use Customer Data to train third-party general-purpose AI models. Blueprint may, however, use Customer Data to provide, support, secure, maintain, and improve the Platform and related services, and may use de-identified and aggregated information for product improvement, analytics, diagnostics, and service development.
Any separate rules, limitations, and disclaimers regarding AI outputs, reliability, and user responsibility are set out in the AI Use & Disclaimer Policy and the Terms of Service.
7. Cookies and Similar Technologies
Blueprint may use cookies, pixels, tags, local storage, SDKs, and similar technologies to operate the Platform, remember preferences, authenticate sessions, understand usage patterns, improve performance, support security, and measure the effectiveness of features and communications.
Some cookies or similar technologies may be necessary for the operation of the Platform. Others may be used for analytics, product improvement, or communications. Further information about our use of cookies and similar technologies is provided in the Cookie Policy.
You may be able to control certain cookie settings through your browser or device settings; however, disabling certain technologies may affect the functionality, security, or availability of the Platform.
8. Disclosure of Information
Blueprint does not sell personal information in the ordinary sense of selling user data for money. We may disclose information in the following circumstances where reasonably necessary or legally permitted.
We may disclose information to our employees, contractors, professional advisors, and affiliated entities on a need-to-know basis for the purposes described in this Privacy Policy.
We may disclose information to third-party service providers and subprocessors that assist us in operating the Platform and our business. These may include cloud hosting providers, database providers, analytics providers, communications providers, payment processors, authentication providers, support providers, infrastructure providers, and AI-related service providers. PIPEDA permits transfers for processing, but the organization remains accountable for protecting personal information in those arrangements.
We may disclose information where required or permitted by law, including in response to subpoenas, court orders, warrants, lawful access requests, regulatory requests, legal proceedings, investigations, or enforcement demands.
We may disclose information where necessary to enforce our agreements, protect our legal rights, protect the security or integrity of the Platform, investigate fraud or misuse, or protect Blueprint, our users, or others from harm.
We may disclose information in connection with a merger, acquisition, corporate reorganization, financing, sale of assets, insolvency proceeding, or other corporate transaction, in which case the information may be transferred as part of that transaction, subject to appropriate legal safeguards.
9. Cross-Border Storage and Processing
The Platform and related services may use service providers located in Canada, the United States, and other jurisdictions. As a result, personal information and Customer Data may be stored, processed, transferred, or accessed outside your province, territory, or country of residence.
Canadian privacy guidance recognizes that transfers for processing may occur across borders, and organizations remain accountable for protecting personal information in those arrangements. PIPEDA does not prohibit cross-border processing, but it does require accountability and reasonable safeguards.
By using the Platform, you acknowledge that your information may be transferred to and processed in jurisdictions outside your own, where it may be subject to the laws of those jurisdictions and to lawful access by courts, regulators, or law enforcement in those jurisdictions.
10. Accuracy and Customer Responsibility
We rely on the information you and your organization provide to us. You and your organization are responsible for ensuring that information uploaded to or entered into the Platform is accurate, current, complete, and lawfully provided.
Where Customer Data includes personal information about employees, subcontractors, collaborators, clients, consultants, or other individuals, the Customer is responsible for ensuring that it has the legal authority, notices, consents, permissions, and other lawful basis necessary to collect, use, disclose, and upload that information to the Platform.
Blueprint does not independently verify all information entered into the Platform and is not responsible for inaccurate, outdated, incomplete, or unlawfully uploaded information provided by users.
11. Retention of Information
Blueprint retains information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, to provide the Platform, to maintain appropriate business and legal records, to resolve disputes, to enforce agreements, and to comply with legal obligations.
As a general operational rule, where a BuildBox account is terminated, Customer Data may remain available for up to ninety (90) days after termination, after which it may be deleted or rendered inaccessible, subject to legal obligations, technical constraints, backups, fraud prevention, security needs, dispute resolution, and recordkeeping requirements. This timing aligns with the current retention approach described in the Terms of Service.
Deletion from active systems may not occur immediately, and copies may remain in backup, archival, logging, security, or disaster recovery systems for a period of time consistent with our internal processes and legal obligations.
12. Access, Correction, Export, and Requests
Applicable privacy laws provide individuals with rights to request access to personal information and to request correction of inaccurate information, subject to legal limits and exceptions. PIPEDA’s fair information principles include individual access and openness, and BC PIPA also requires organizations to maintain policies and practices and respond appropriately to access-related matters.
If you would like to request access to personal information we hold about you, request correction of inaccurate information, or make another privacy-related request, you may contact us using the contact information set out below. We may need to verify your identity before processing a request, and we may decline or limit a request where permitted or required by law.
If your organization’s account is terminated, and subject to our operational practices, the Terms of Service provide for the possibility of requesting a commercially reasonable export of Customer Data during the applicable post-termination period.
13. Security Safeguards
Blueprint uses commercially reasonable administrative, technical, and physical safeguards designed to protect personal information and Customer Data against unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks. Security and safeguarding obligations are core components of both BC PIPA and PIPEDA.
These safeguards may include access controls, authentication measures, role-based permissions, encryption in transit where appropriate, cloud-security controls, logging, monitoring, and other operational and technical protections appropriate to the nature of the information and the Platform.
However, no method of transmission, storage, or security can be guaranteed to be completely secure. As a result, while Blueprint takes reasonable steps to protect information, we cannot and do not guarantee absolute security.
14. Privacy Breaches
Where required by applicable law, Blueprint will assess suspected privacy or security incidents and, where necessary, notify affected individuals and applicable regulators. Under PIPEDA, organizations must report breaches of security safeguards posing a real risk of significant harm and must keep records of all breaches of security safeguards.
Customers are responsible for notifying Blueprint promptly if they become aware of any suspected unauthorized access, misuse, security breach, credential compromise, or privacy incident involving the Platform or Customer Data.
15. Marketing and Communications
Blueprint may send administrative, transactional, security, legal, service, and account-related communications that are necessary for operating the Platform, administering accounts, enforcing our agreements, addressing support issues, or complying with law. These communications may be sent by email, in-product notification, SMS, phone, or other reasonable means, depending on the circumstances.
Blueprint may also send marketing, promotional, product update, survey, or event-related communications where permitted by law. You may be able to opt out of certain promotional communications, but you may continue to receive service-related or legally required communications.
16. Children and Minors
The Platform is intended for business use and is not directed to children. Blueprint does not knowingly provide the Platform to children or intentionally collect personal information directly from children for consumer purposes. If we become aware that personal information has been collected from a child in a manner inconsistent with applicable law, we may take steps to delete that information.
17. Changes to this Privacy Policy
Blueprint may update this Privacy Policy from time to time to reflect changes in the Platform, our data practices, legal requirements, operational needs, or service providers. Where Blueprint considers a change material, we may provide additional notice by email, in-product notice, or other reasonable means.
Unless otherwise stated, an updated Privacy Policy becomes effective when posted or otherwise communicated. Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised Privacy Policy.
18. Contact Information
If you have questions, concerns, or requests relating to this Privacy Policy or Blueprint’s handling of personal information, you may contact us at:
Blueprint Consulting Inc.
Email: hello@buildboxpro.com
Mailing Address: 1801-550 Pacific Street, Vancouver, BC, V6Z 3G2
Attention: Privacy Officer