Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how BuildRocket (“BuildRocket”, “we”, “us”, “our”), a product of C3 Builder, collects, uses, stores, and shares information when you use the BuildRocket web application at buildrocket.ai and the BuildRocket Companion mobile app (together, the “Service”).

BuildRocket is a business tool for residential builders and their teams. We designed it to handle your business and project information on your behalf. We do not sell your personal information.

1. Who we are

BuildRocket is operated by C3 Builder, based in Victoria, Australia. For any privacy question or request, contact us at admin@buildrocket.ai.

2. Information we collect

We collect the following categories of information:

• Account information. When you register, we collect your name, email address, and authentication credentials. If you set up a business profile, we also collect details you provide about your business (such as business name, trade, contact details, and operating preferences).
• Content you provide. Information you enter or upload to run the Service — projects and jobs, scopes, estimates and pricing, schedules, client and contact details, supplier and rate information, documents, plans, and notes.
• Photos and images. When you use camera or photo-upload features, we collect the images you capture or select (for example, site photos, plan drawings, and odometer readings).
• Audio and transcripts. When you use voice-capture features, we collect the audio you record and the text transcription generated from it.
• Information about your clients and other people. To run a job you enter details about other people — for example a client’s name, address, phone and email, their selections and signatures, and the names and contact details of suppliers and trades. Section 7 explains how we handle it.
• Employee and team information. If you manage employees through the Service, we collect the information you provide about them (such as names, contact details, roles, and work records). If you are an employee accessing the Service through an employer’s account, your employer controls the projects and data shared with you.
• Usage and diagnostic data. We collect limited technical information to keep the Service running and to diagnose errors — for example, device and app version, log and crash data, and basic usage events.

The Service is intended for business use. Please avoid entering sensitive personal information beyond what is needed to run your business.

3. Mobile app permissions

The BuildRocket Companion app requests the following device permissions, each only for the stated purpose. You can decline or revoke them in your device settings, though some features will not work without them.

• Camera — to capture site photos and odometer readings.
• Microphone — to record on-site scope captures.
• Photo library — to attach existing photos to captures and uploads.
• Speech recognition — lets your phone’s own speech service (Apple’s or Google’s) show your words as you speak. The recording itself is also uploaded and turned into the written note by OpenAI (see Section 5).
• Notifications — to send you alerts related to your work. To deliver these we store a push notification token for your device.

4. How we use information

• To provide, operate, and maintain the Service and its features;
• To generate the outputs you request (scopes, estimates, schedules, documents, and other deliverables);
• To authenticate you and secure your account;
• To communicate with you about the Service, including notifications you enable;
• To diagnose problems, monitor reliability, and improve the Service;
• To comply with legal obligations.

5. AI processing

Several BuildRocket features use third-party artificial-intelligence models to process content you submit. We use two AI providers, both in the United States:

• Anthropic (the Claude models) — reads and drafts text: scopes, estimates, schedules, documents and plans you upload, emails you ask it to search, and the written note made from a voice capture.
• OpenAI — turns your voice recordings into text, and makes the pictures you ask for (a drawing of a room from its measurements and your description of the finishes, or an image for your marketing).

We send only what is needed to produce the output you asked for, and only when you use a feature that needs it. Neither provider uses your content to train its models. Each may keep it for up to 30 days to check for misuse, then deletes it.

6. Service providers and integrations

We use trusted third-party providers to run the Service. They process information on our behalf, under agreements that limit their use of it to providing their services to us. Each is named with what it receives and where it is:

• Supabase — database, logins and file storage. Your information and files are stored in Sydney, Australia.
• Vercel — hosts the web app, on its servers in Sydney, Australia. Your information passes through those servers while a page is built for you; it is stored with Supabase, not Vercel.
• Anthropic and OpenAI (United States) — AI processing (see Section 5).
• Google Maps Platform (United States) — addresses you type into an address box, and job addresses we look up to find a site on the map or work out the driving distance to it.
• Sentry (United States) — error reports: technical details of a fault, such as the page and the device, and a replay of the screen just before the error with every piece of text and every image hidden.
• Expo (United States) — delivers notifications to the BuildRocket Companion app: the notification’s text and your device’s push token.
• Your web browser’s push service (run by Google, Apple or Mozilla, depending on the browser) — delivers notifications to a browser that has turned them on, including a client’s project page. It receives the notification’s text.

Every night we copy stored files to Amazon Web Services, as an off-site backup. Where your data is kept, and the day we last checked each of these facts, is on how we look after your data.

Accounts you connect

You may choose to connect your own accounts with other services to BuildRocket — Google Workspace (Gmail, Google Calendar, Google Drive, Google Contacts), Xero (we read your invoices, bills, profit and loss, bank summary, staff and pay runs, and draft progress-claim invoices for you to check and send), Todoist and Notion. When you connect an account, we access only the data needed to provide the feature you enabled, and only for as long as you keep the integration connected. What we send into those accounts is held under your own agreement with that company, which stores it in its own locations — mostly the United States for Google, Xero and Notion. You can disconnect an integration at any time from within the Service.

Your own Claude. If you connect your own Claude account to BuildRocket (the BuildRocket connector), the Claude you connected can read your business profile, set-up answers, standard inclusions, trades, suppliers and rates, and your jobs (each job’s scope, Costing table, plan digest, site notes and open questions), and leave suggestions for you to accept. Only if you switch it on for that connection can it change a job’s scope or Costing table. It is told to read each change back to you first; each such change is kept with the words given for it, so it can be undone. What it reads goes to Anthropic (United States) under your own Claude account and its terms. Your clients’ names, phone numbers, emails and house numbers are never sent; a job is named by its street. You can disconnect it at any time from your Settings.

Google API Services. BuildRocket’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the features you have connected, and we do not transfer or sell it for advertising or other unrelated purposes.

7. How we share information

We do not sell your personal information. We share information only:

• With the service providers and integrations described above, to operate the Service;
• Within your own organisation — for example, between an employer account and the employees it grants access to, as configured by the account owner;
• When you direct us to — for example, generating a client-facing document or sharing a project link;
• If required by law, or to protect the rights, safety, or property of BuildRocket, our users, or others;
• In connection with a business transfer (such as a merger or acquisition), subject to this Policy.

If a builder holds your details

If you are a builder’s client, a site worker, a supplier or a trade, the builder you deal with may have entered your details into BuildRocket — for example your name, contact details, site address, selections, signatures, photos of your site, or your work and induction records. The builder collects that information and decides how it is used; BuildRocket stores and processes it for the builder, under this policy. Your builder should tell you what they hold and why. You can ask the builder, or us at admin@buildrocket.ai, to see or correct it. When you sign a document a builder sends you, the electronic signature terms explain what is recorded.

8. Data storage and security

Your information and files are stored in Sydney, Australia, with Supabase. They are protected with access controls, and encrypted in transit and at rest. Only the account owner can sign in to our hosting, database and code accounts, and each of those sign-ins uses two-step login.

Some information is sent outside Australia — to the United States — when a provider in Section 6 processes it: for AI features, maps, error reports and notifications, and for any account you connect. We choose those providers because their agreements limit what they may do with it, and we send only what each one needs.

No method of transmission or storage is completely secure, but we take reasonable steps to protect your information. If we find a data breach that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

9. Data retention

We keep your information for as long as your account is active and as needed to provide the Service. You can delete content within the Service, delete your account yourself (see deleting your account), or ask us to delete your account and associated personal information by contacting admin@buildrocket.ai. We may retain limited information where required for legal, accounting, or security reasons.

Deleted information also stays in our database backups until they roll over: we keep daily backups for 7 days. A deleted file stays in the nightly off-site copy of stored files (Section 6) for 30 days, then goes.

10. Your rights

Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct or delete it, or object to certain processing. To make a request, contact admin@buildrocket.ai. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Complaints

If you think we have mishandled your personal information, email admin@buildrocket.ai and say what happened. We will look into it and reply in writing within 30 days. If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Children

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the Service where appropriate.

13. Contact us

For any question or request about this Policy or your information, contact us at admin@buildrocket.ai.