Privacy Policy

ownit2buildit ("we", "us") provides a construction project management platform: projects, tasks, time, budgets, materials, quotes, invoices, team chat and a client portal. This policy covers our website, the web app and the ownit2buildit mobile app for Android and iPhone (together, the "Platform").

We act in two roles, and it helps to know which one applies:

• Your account and how you use the Platform. Your sign-in details, billing, device and security information. We decide why and how this is used, so we are responsible for it.
• Your company's records. Projects, tasks, employees, clients, time, budgets, invoices, messages and documents are entered by a company and its team. That company decides what goes in and who sees it. We store and process it for the company to provide the Platform and do not use it for our own purposes.

If you are an employee, subcontractor or client of a company that uses ownit2buildit, ask that company first about the records it keeps about you. We will help it respond.

Some of this you give us, some is entered by your company, and some is collected automatically when you use the Platform.

Account and profile

Your name, email address, phone number, profile photo, role and permissions, and when you last signed in. Your password is never stored as written: only a one-way hash is kept.

Company details

Company name and legal name, registration and tax numbers, address, logo, website, business phone and email, size, industry, currency and time zone.

Team records

Entered by a company about its people: job title, trade, department, employee code, ID number, employment type, pay rates and start and end dates.

Clients and suppliers

Names, contact person, email, phone, address and notes. If a client is given portal access, their portal sign-in too.

Project and business records

Projects and site details, tasks, comments and checklists, budgets and costs, materials and stock, purchase requests and orders, equipment, quotes, invoices, change requests, approvals and reports.

Files and photos

Documents, drawings, site photos, attachments, profile pictures and logos. A location tag can be stored with a document or photo when one is provided.

Time and attendance

Clock-in and clock-out times, hours, notes and approvals. In the mobile app, if you allow it, the phone's position at the moment you clock in or out.

Messages

Chat messages in direct and project chats, replies, @mentions, attached files and images, voice messages, and who has read them.

Payments

For invoice and subscription payments: amount, method (for example EcoCash), status, reference and the confirmation sent back by the payment provider. The mobile number you enter to pay is passed to Paynow. Card numbers and wallet PINs are entered with the payment provider and never reach our servers.

Device and security data

IP address and browser or device type for important actions, kept in an audit trail. In the mobile app, an alert token that identifies the phone, whether it is Android or iPhone, and when it was last seen. Your alert history and the alert choices you make.

What you send us

Anything you tell us when you contact support by email or WhatsApp.

• To run the Platform: create accounts, sign you in, and power projects, tasks, time, budgets, quotes, invoices, chat and the client portal.
• To send you alerts about activity that involves you, such as a task assigned to you, time waiting for approval, a new chat message, an invoice paid or a budget limit reached, in the app, as phone alerts and by email.
• To take subscription payments, send receipts and remind you before a subscription ends.
• To keep the Platform secure: prevent misuse, investigate problems and keep an audit trail of important actions.
• To answer support requests and send service notices such as invitations and password reset codes.
• To fix faults and keep the Platform reliable, using server logs and combined, non-identifying usage figures.
• To meet our legal duties and enforce our Terms of Service.

Where the law asks us to name a reason, we rely on: delivering the service you or your company signed up for; your consent for optional features such as location and phone alerts, which you can withdraw at any time; our legitimate interest in security and in keeping the Platform working; and our legal obligations.

We do not sell personal information, we do not show advertising, and we do not use your information to profile you for advertisers.

The app asks your phone for the following permissions, only when a feature needs them. You can say no, or change your mind later in your phone's settings, and the rest of the app keeps working.

Location

Used only to record where you were when you clock in or out, if you turn that on. The app reads your position at that moment. It does not track you in the background. If you refuse, or the phone cannot find you, you can still clock in and the entry simply has no location.

Notifications

Used to show alerts. Asked for when you turn alerts on. You can switch them off in the app or in your phone settings.

Microphone

Used to record a voice message in a chat. Asked for the first time you use the microphone button, and only used while you are recording a voice message.

Camera, photos and files

Used to take or choose photos and files to attach to tasks, chats and documents, or to set a profile picture or company logo. We only receive the files you pick.

Internet connection

Used to sync with your workspace and to hold changes made offline until the phone is back online.

On your phone, your sign-in is kept in the device's secure storage, and changes you make without a connection are saved on the phone until they reach the server.

Phone alerts.Alerts are delivered through Google's Firebase Cloud Messaging and, on iPhone, Apple's push service. To do this, a token that identifies your phone is registered with us, and the text of the alert passes through those services. When you sign out, or switch alerts off, the app removes your phone's registration.

Alerts go to the people who need to know. For example, when someone clocks out or adds their time, their project manager and the managers on that project are told; when a task is assigned to you, you are told; when an invoice is paid, the people who handle finance are told. You are not alerted about your own actions. If you work for a company on the Platform, this means your managers are told when you submit time or update their projects.

Alerts are stored so you can read them again on your phone and on the web, and reading one in either place marks it read in both. You can choose which kinds of alert you receive in your notification settings, and remove alerts from your list.

• People in your company.What each person can see depends on the role and permissions your company's administrators give them. Managers and administrators can see team members' time entries (including any clock-in location), tasks and project records. Chat messages are visible to the people in that conversation.
• Your clients. A client with portal access sees only what the company shares with them: their projects, quotes, invoices, documents and messages.
• Our staff. A small number of ownit2buildit staff can reach workspace data to provide support, handle billing, investigate misuse and keep the Platform running. We limit this to what the task needs.

We do not sell personal information. We share it only with the following, and only as far as needed to provide the Platform:

• Paynow and the mobile-money networks it connects to, such as EcoCash, to take payments.
• Google (Firebase Cloud Messaging) and Apple, to deliver alerts to phones.
• Our email delivery service, which sends invitations, password reset codes, invoices and reminders on our behalf.
• Hosting, database and file-storage providers, who run the infrastructure and may only use the data to provide that service.
• Authorities, where the law or a valid legal request requires it, or to protect people's safety or our legal rights.
• A successor, if ownit2buildit is merged with or sold to another business. We would tell you first, and this policy would continue to apply to your information.

Information also goes where your company sends it: an invoice or quote emailed to a client, for example, is shared by the company, not by us.

Some of the providers above, such as Google, may handle information in other countries. When personal information leaves Zimbabwe, we take the steps the law requires to keep it protected, and we choose providers that protect it to a comparable standard.

While you are with us

We keep account and workspace data for as long as the account is active.

After an account closes

We keep it for 90 days so the company can export what it needs, then delete it or make it anonymous. This matches our Terms of Service.

Money and audit records

Invoices, payment and subscription records and the audit trail may be kept longer where tax, accounting or other law requires, or to deal with a dispute.

Deleted items

When something is deleted in the Platform it is first marked as deleted so it can be recovered, and is removed for good later. Copies may stay in routine backups for a short time until they are overwritten.

Phone alert tokens

Removed when you sign out or switch alerts off.

• Information travels between your device and our servers over encrypted (HTTPS) connections.
• Passwords are stored only as one-way hashes. Sign-in sessions use short-lived tokens that are renewed by a longer-lived token, which we store only in hashed form.
• Each company's data is kept separate from every other company's, and what a person can see or change is limited by their role.
• Important actions are recorded in an audit trail with the time, the person and the device.
• In the mobile app, your sign-in is kept in the phone's secure storage.

No system is completely secure, so please use a strong, unique password and tell us at once if you suspect someone else has used your account. If a breach affects personal information, we will tell the companies affected and, where the law requires, the regulator and the people concerned, without undue delay.

The website and web app use only what is needed to keep you signed in. Signing out removes all of it.

bp_access_token

Cookie and browser storage. Keeps you signed in. Up to 7 days.

bp_refresh_token

Cookie and browser storage. Renews your sign-in without asking for your password again. Up to 7 days.

bp_tenant_slug

Cookie and browser storage. Remembers which company workspace you are using. Up to 1 day.

The website and web app do not load third-party analytics, advertising or social-media tracking scripts.

Depending on where you live, the law, including Zimbabwe's Cyber and Data Protection Act, gives you rights over your personal information. You can:

• Ask for a copy of the personal information we hold about you.
• Correct it.You can edit your own profile in the app or on the web, or ask us or your company's administrator.
• Export it. Many records, such as reports, quotes and invoices, can be downloaded from the Platform as CSV or PDF, and you can ask us for a fuller export.
• Ask us to delete it, or to limit or stop a use of it. See the next section.
• Withdraw consent.Say no to location, microphone or camera in your phone's settings, and turn alerts off in the app or on your phone.
• Complain.Please talk to us first so we can put things right. You also have the right to complain to Zimbabwe's data protection authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

To use any of these rights, email privacy@ownit2buildit.com or message us on WhatsApp at +263 77 227 3888. We may ask you to confirm who you are before we act, and we aim to reply within 30 days. If your request is about records that belong to your employer or a company you deal with, we may need that company to act on it, and we will tell you.

To ask us to delete your account and the personal information we hold about you, email privacy@ownit2buildit.comfrom the address on your account with the subject "Delete my account", or message us on WhatsApp at +263 77 227 3888. We will confirm that it is you, tell you what will be removed and what we must keep, and then carry it out.

If you are part of a company's workspace, deleting your account removes your access and your profile. Records you created for the company, such as tasks, time entries and invoices, belong to the company and may stay in its workspace; where the law requires it, we will remove or anonymise your personal details in them. To close a whole company account, the company's administrator should contact us. How long we keep things is set out in "How long we keep it".

The Platform is for businesses and is not meant for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us personal information, tell us and we will delete it.

We may update this policy as the Platform changes, and we will change the date at the top when we do. For a significant change we will tell you by email or with a notice in the Platform before it takes effect. If you keep using the Platform after a change takes effect, the updated policy applies.

Questions about this policy or your information? Email privacy@ownit2buildit.com or message us on WhatsApp at +263 77 227 3888.