Privacy Notice

Aeas Concept Project Management Service, trading as BuildRevu, is the data controller for the personal data described in this notice. That means we decide why and how it is processed. For any privacy question or request, contact hello@buildrevu.com.

Registered address: Office No. 202, Pinnacle Building, Al Barsha First, Dubai, U.A.E.

Where a customer organisation uploads project content containing personal data about its own staff or third parties, that organisation is the controller of that content and we process it on their behalf.

• Account data — name, work email, sign-in credentials, organisation, role and permissions. Used to create and secure your account and to control what you can see and approve. Legal basis: performance of our contract with you.
• Project content — documents, drawings, revisions, comments, approvals, instructions, letters, snags, inspection records and meeting minutes you upload or create, including the names and signatures shown on issued records. Used to deliver the service and produce the audit trail and reports. Legal basis: performance of our contract.
• Support communications — messages, attachments and correspondence you send us. Used to answer questions and resolve issues. Legal basis: performance of our contract and our legitimate interest in supporting customers.
• Usage and technical data — pages and actions viewed, timestamps, device and browser information, IP address, and error logs. Used for security, fraud and abuse prevention, troubleshooting and improving the product. Legal basis: our legitimate interests, and legal obligation where security incident records are required.
• Notification preferences and delivery records — email addresses and whether alerts were delivered. Used to send the action-required and status notifications the service depends on. Legal basis: performance of our contract.
• Marketing contact data — where you ask for a demo or subscribe to updates. Legal basis: consent, which you can withdraw at any time.

Payment card details are never collected or stored by us. Checkout, billing and tax data are handled by Paddle under their own privacy notice.

• Hosting and infrastructure providers that run the application, database, file storage and backups on our behalf.
• Email and notification delivery providers, used to send alerts, invitations and reports.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, invoicing and tax compliance.
• Professional advisers — legal, accounting and audit — where necessary.
• Public authorities, regulators or courts where we are legally required to disclose information.
• A successor entity in the event of a merger, acquisition or reorganisation, subject to this notice.

We do not sell personal data and we do not use your project content to advertise to you.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with technical protections including encryption in transit and at rest. Regional hosting is available on request.

Account and project data is kept while your account is active. After closure, data is retained for up to 90 days to allow export and recovery, then deleted or anonymised, except where a longer period is required for legal, tax or dispute-resolution purposes. Security and access logs are kept for up to 12 months. Backups are rotated and cloud copies are limited to the most recent set.

• Encryption in transit (TLS 1.2+) and at rest.
• Organisation, project, role and module permissions enforced at the database level.
• Immutable, timestamped audit trails for issued records and decisions.
• Least-privilege access for our own staff and administrative operations.
• Automated backups with recovery testing.

Subject to applicable law, you can ask us to:

• give you access to a copy of your personal data;
• correct data that is inaccurate or incomplete;
• delete data where there is no continuing legal or contractual reason to keep it;
• restrict or object to certain processing;
• provide your data in a portable format; or
• withdraw consent you previously gave, for example to marketing emails.

Email hello@buildrevu.com to exercise any of these. We aim to respond within one month. Some records that form part of a project's formal audit trail cannot be altered or removed once issued; in those cases we will explain what we can and cannot do. If you are in the UK or EEA, you also have the right to complain to your data protection supervisory authority.

We use essential cookies and local storage only — to keep you signed in, maintain your session and remember basic interface preferences. We do not use advertising cookies. You can clear or block cookies in your browser, but sign-in will not work without the essential ones.

We will update this page when our practices change and revise the "last updated" date above. Where changes are material, we will notify account administrators.