BuildClear
Sign inEarly access

Legal

Data Processing Agreement

Effective Date: October 19, 2026

This Data Processing Agreement ("DPA") is entered into between the entity identified as the customer in the applicable service agreement ("Customer," "Controller") and BuildClear, Inc., a Delaware corporation ("BuildClear," "Processor"). This DPA is incorporated into and forms part of the service agreement between the parties (the "Agreement").

1. Definitions

"Applicable Data Protection Laws" means the data protection laws that apply to the processing of Personal Data under this DPA, including, where they apply, the GDPR, the UK GDPR, the Swiss FADP and the CCPA/CPRA.

"Personal Data," "Processing," "Data Controller," "Data Processor," "Data Subject," and "Personal Data Breach" have the meanings given in the GDPR, or the equivalent terms under other Applicable Data Protection Laws.

"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as approved by the European Commission in Implementing Decision (EU) 2021/914.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018.

2. Scope and Roles

Customer is the Data Controller. BuildClear is the Data Processor. BuildClear processes Personal Data solely on behalf of Customer and in accordance with Customer's documented instructions to provide the BuildClear construction intelligence platform (the "Service").

This DPA applies to all Personal Data that BuildClear processes on Customer's behalf in connection with the Agreement. The details of Processing are described in Annex 1.

3. Customer Obligations

Customer will: comply with Applicable Data Protection Laws in its use of the Service and its instructions to BuildClear; have a lawful basis for the Processing, give any required notices to Data Subjects and obtain any required consents; and be responsible for the accuracy, quality and legality of the Personal Data it provides.

4. BuildClear Obligations

BuildClear will:

  • Process Personal Data only in accordance with Customer's documented instructions, unless required by applicable law. If BuildClear is required by law to process Personal Data for any other purpose, BuildClear will inform Customer of that legal requirement before Processing, unless prohibited by law from doing so.
  • Ensure that all personnel authorized to process Personal Data are bound by obligations of confidentiality.
  • Implement and maintain appropriate technical and organizational security measures as described in Annex 3.
  • Notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data, and provide the information it reasonably has about the nature of the breach, the data and Data Subjects affected, the likely consequences and the measures taken or proposed.
  • Assist Customer, at Customer's expense, in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Laws (access, rectification, erasure, portability, restriction, or objection).
  • Assist Customer in meeting its obligations related to data protection impact assessments and prior consultations with supervisory authorities, where required by Applicable Data Protection Laws.
  • Not engage any sub-processor except as provided in Section 6.
  • Make available to Customer all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits conducted by Customer or an auditor mandated by Customer, as described in Section 10.

5. Data Use Restrictions

BuildClear will not:

  • Sell Personal Data, as the term "sell" is defined under the CCPA/CPRA or any other Applicable Data Protection Law.
  • Retain, use, or disclose Personal Data for any purpose other than performing the Service under the Agreement or as expressly permitted in this Section 5, including for cross-context behavioral advertising.
  • Combine identifiable Personal Data received from Customer with identifiable personal data received from or on behalf of another person or entity, except as expressly permitted by Applicable Data Protection Laws to perform the Service.

BuildClear may:

  • Use Customer Data that has been aggregated and de-identified to evaluate and improve the Service. BuildClear will not re-identify it.

6. Sub-processors

Customer gives general written authorization for the sub-processors on BuildClear's current list (Annex 2). BuildClear will notify Customer of any new or replacement sub-processor at least 30 days before it receives access to Customer's Personal Data. Customer may object on reasonable data protection grounds by writing to privacy@buildclear.ai within 30 days of the notice. If the objection can't be resolved within 30 days, either party may terminate the affected part of the Agreement, and Customer receives a pro-rata refund of prepaid fees for that part.

BuildClear will bind each sub-processor to data protection obligations no less protective than those in this DPA, and remains liable for its sub-processors' acts and omissions to the same extent as for its own, subject to the limits in the Agreement.

7. US Privacy Laws

To the extent the CCPA applies, BuildClear is a service provider as defined in Cal. Civ. Code Section 1798.140(ag) and will comply with the CCPA obligations that apply to service providers. BuildClear will notify Customer if it determines that it can no longer meet its obligations under the CCPA. On notice, Customer may take reasonable steps to stop and remediate unauthorized use of Personal Data.

To the extent another US state privacy law applies, BuildClear acts as a processor, processes Personal Data only on Customer's instructions, and will help Customer respond to consumer requests.

8. International Data Transfers

BuildClear stores Customer's Personal Data in the United States. BuildClear and its sub-processors may process Personal Data in other countries where needed to provide the Service, in accordance with Applicable Data Protection Laws. If Customer or any Data Subject is located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following transfer mechanisms apply.

8.1 EU Standard Contractual Clauses

The EU Standard Contractual Clauses (Module 2, controller to processor, Implementing Decision (EU) 2021/914) are incorporated by reference. Customer is the data exporter and BuildClear is the data importer. Clause 9(a): Option 2, with the notice period in Section 6. Clause 17: the law of Ireland. Clause 18(b): the courts of Ireland. Annexes I and II are completed by Annex 1 and Annex 3 of this DPA, and Annex III by the sub-processor list described in Annex 2.

8.2 UK International Data Transfer Addendum

For transfers of Personal Data from the United Kingdom, the UK Addendum (as issued by the UK Information Commissioner under Section 119A(1) of the Data Protection Act 2018) is incorporated by reference and supplements the SCCs as described in Section 8.1. In the event of a conflict between the UK Addendum and the SCCs, the UK Addendum prevails with respect to transfers from the UK.

8.3 Switzerland

For transfers of Personal Data from Switzerland, the SCCs apply with the modifications required by the Swiss Federal Data Protection and Information Commissioner (FDPIC), including that the competent supervisory authority under Clause 13 is the FDPIC.

9. Data Deletion

Upon termination or expiration of the Agreement, BuildClear will provide a copy of Customer's data on request for 30 days. After that period closes, BuildClear will delete or return, at Customer's choice, all of Customer's Personal Data within a reasonable period, unless applicable law requires retention.

10. Audit Rights

On Customer's reasonable written request, no more than once a year, BuildClear will provide the information needed to show compliance with this DPA. If that isn't enough, Customer may audit BuildClear's processing at its own expense, on at least 30 days' notice, during business hours and under a confidentiality agreement.

11. General

In the event of a conflict between this DPA and the Agreement, this DPA governs with respect to the Processing of Personal Data. In the event of a conflict between this DPA and the SCCs, the SCCs prevail with respect to transfers of Personal Data subject to the SCCs. Each party's liability under this DPA is subject to the limits in the Agreement.

Contact

For questions about this DPA or to exercise any rights described herein, contact us at privacy@buildclear.ai.

Annex 1: Details of Processing

A. Categories of Data Subjects

  • Customer's employees, contractors, subcontractors, and consultants who access or are referenced within the Service
  • Third parties whose Personal Data appears in construction project records uploaded to the Service (architects, engineers, inspectors, vendors, regulatory contacts)
  • Individuals who send emails or SMS messages to BuildClear project inboxes or phone numbers

B. Types of Personal Data

  • Contact information (name, email, phone number, company, job title)
  • Account credentials and identifiers
  • Construction project data (documents, plans, contracts, cost data, schedules and similar records)
  • Communications (emails and text messages sent to BuildClear)
  • Usage data (IP address, device and browser information, feature interactions)
  • AI processing data (prompts, model responses and related workflow data)

C. Purposes of Processing

  1. Providing and operating the Service under the Agreement, including ingesting emails, texts and documents, extracting, classifying and analyzing them with AI, and sending project notifications
  2. Security, access control and logging
  3. Error monitoring and service reliability
  4. Creating de-identified aggregate data

D. Duration of Processing

Processing continues for the duration of the Agreement, plus the 30-day period after termination and the period described in Section 9.

E. Nature of Processing

Hosting, storage, transmission and automated analysis (including by AI models) of Customer's data to provide the Service.

Annex 2: Authorized Sub-Processors

BuildClear's sub-processors fall within these categories: cloud hosting and storage, AI model providers, email and text message delivery, push notifications, maps and address lookup, payment processing, and error and performance monitoring. BuildClear maintains a current list of its sub-processors, provides it to Customer on request at privacy@buildclear.ai, and notifies Customer of changes in accordance with Section 6.

Annex 3: Technical and Organizational Measures

BuildClear maintains technical and organizational measures designed to protect Personal Data processed under this DPA, including:

  • encryption at rest for BuildClear's databases and file storage, and encryption in transit for connections to the Service;
  • access controls that limit Personal Data to authorized users and personnel;
  • logging of security-relevant activity and monitoring for errors and incidents;
  • automated scanning of code and dependencies for vulnerabilities;
  • automated daily backups of the production database; and
  • confidentiality obligations for personnel with access to Personal Data.