Privacy Policy

Last updated: 01/07/2026

This Privacy Policy explains how Buildsasa ("we", "us", or "our") collects, uses, shares, and protects your personal information when you use our construction project-management platform at buildsasa.com and console.buildsasa.com and any related applications and services (the "Service"). Buildsasa is operated by [Legal Company Name], a company registered in Kenya, and we act as the data controller for your personal data. We handle personal data in line with the Kenya Data Protection Act, 2019.

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

1. Information we collect

• Account information — your name, email address, phone number, company/workspace name, role, and login credentials.
• Your Content — the project data you create or upload, such as projects, tasks, checklists, daily logs, photos, documents, budgets, invoices, bids, and inventory records.
• Payment information — subscription and billing details. Card and M-Pesa payments are processed securely by our payment provider, Paystack. We do not store full card numbers on our servers.
• Usage and technical data — how you interact with the Service, device and browser type, IP address, log data, and approximate location.
• Cookies and similar technologies — used to keep you signed in, remember preferences, and understand usage. See section 8.
• Communications — messages you send us (for example, support requests, contact-form and pricing-request submissions).

2. How we use your information

• To provide, operate, and maintain the Service and your account.
• To process subscriptions, payments, and invoices.
• To enable collaboration within your workspace and with the users you invite.
• To provide customer support and respond to your enquiries.
• To improve, personalise, and develop new features, including AI-assisted features.
• To send service-related notices, security alerts, and (where you have opted in) product updates.
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with our legal, tax, and regulatory obligations.

3. Legal basis for processing

Depending on the circumstances, we process your personal data on the basis of: your consent; the performance of our contract with you (these Terms); our legitimate interests in operating and improving the Service; and compliance with a legal obligation. You may withdraw consent at any time where processing is based on consent.

4. How we share your information

We do not sell your personal data. We share it only as needed to run the Service:

• Service providers — cloud hosting, storage, and infrastructure partners that host the Service on our behalf.
• Paystack — to process card and M-Pesa payments.
• Google — where you choose to sign in with Google.
• Within your workspace — with other members of your workspace, according to the roles and permissions set by your workspace owner.
• Legal and safety — where required by law, regulation, or valid legal process, or to protect our rights, users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

5. Data retention

We retain your personal data and Your Content for as long as your account is active and as needed to provide the Service. After your account is closed, we delete or anonymise your personal data within the timeframe described in section 7, except where we are required to retain certain records (for example, transaction, invoicing, and tax records) to meet legal, accounting, or regulatory obligations, which we may keep for up to seven (7) years as required under Kenyan law.

6. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data ("right to erasure");
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at hello@buildsasa.com. We will respond within a reasonable period and in any case within the timeframes required by law.

7. Account deletion and how long it takes

You can request deletion of your account and associated personal data at any time by emailing hello@buildsasa.com from your registered email address, or (where available) from within your account settings. Once we verify your request:

• We will deactivate your account and begin deleting your personal data and Your Content from our active systems within thirty (30) days of receiving your request.
• Residual copies may remain in encrypted routine backups for a limited period and will be deleted within ninety (90) days as backups cycle out.
• We may retain a limited set of records where the law requires it (for example, transaction and tax records, which may be kept for up to seven (7) years). Such data is kept only for the required purpose and then deleted.

Where you are a member of a workspace you do not own, some content you contributed may remain with that workspace; contact your workspace owner regarding that content.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Service secure, and understand how it is used. You can control cookies through your browser settings, though disabling some cookies may affect how the Service works.

9. Data security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and regular backups — to protect your personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your login credentials confidential and notify us immediately of any suspected unauthorised access.

10. International data transfers

Some of our service providers may process data outside Kenya. Where we transfer personal data internationally, we take steps to ensure it is protected in line with the Kenya Data Protection Act, 2019 and applicable safeguards.

11. Children

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service and update the "Last updated" date above. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy.

13. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us:

Buildsasa
Email: hello@buildsasa.com
WhatsApp: +254 782 223 749
Address: Westlands, Nairobi, Kenya