Privacy Policy

CONSTRUCHAIN GLOBAL LTDA
Effective Date: October 2, 2026
Version: 1.1

Version 1.1 updates the factual disclosures of this policy. Specific contracts between ConstruChain and a customer organization, and rights guaranteed by law, remain applicable and are not reduced by this update.

1. Introduction and Responsible Party

This Privacy Policy describes how personal data is processed in the ConstruChain Vision platform (“Service”) and in its MCP connector. The provider is CONSTRUCHAIN GLOBAL LTDA, Brazilian CNPJ 60.740.421/0001-80, with address at Avenida Saul Nonnenmacher, 250, Ipanema, Porto Alegre/RS, CEP 91751-220, Brazil (“ConstruChain,” “we,” “us,” or “our”). The privacy and support channel is support@construchain.com.br.

We process personal data in accordance with the Brazilian General Data Protection Law (LGPD) and, where applicable, other data protection laws.

The customer organization defines the models, projects and content it uploads and the people authorized to access them. ConstruChain processes that content to run the Service according to the organization’s instructions and contract. For its own activities of registration, authentication, security and support, ConstruChain defines the purposes of processing. Requests concerning project content may require the participation of the responsible organization.

2. Information We Collect

2.1 Information You Provide to Us

Account Information: First name, last name, email address and credentials at registration. A later onboarding form collects professional role, intended use and how you heard about the service. Workspace memberships, roles and invitations are stored after the account exists.
Billing Information: Corporate billing details for manual invoicing when a paid plan is contracted (no credit card data is stored directly by us).
Communication Data: Information and attachments sent in support requests or email inquiries.
Acceptance Records: When you accept the Terms of Service, we record the accepted version, the date and time, the acceptance method, the browser identification and, where captured, the IP address.

2.2 Information Collected Automatically

Usage and Security Data: Authentication records, operation and integration logs, timestamps, request results and technical identifiers needed to operate and protect the Service.
Device and Connection Information: IP address, browser type and operating system version.

2.3 Customer Content

Project Data: BIM models (including native IFC files), drawings, project files, element properties and metadata uploaded to the Service. This content may contain personal data included by users. As a B2B platform, we process this data primarily on behalf of our customers, under their instructions.

Do not include unnecessary personal information in models, projects or support requests. The Service is not designed for sensitive personal data without a configuration and an agreement suited to that purpose.

3. How We Use Your Information

We use the collected information for the following purposes:

Service Provision: To provide, operate and maintain the ConstruChain Vision platform, process uploaded models and extract their properties.
Account Management: To manage user registration, authentication, workspaces and permissions.
Integrations and Connector: To operate the integrations and the MCP connector you authorize.
Support: To respond to your comments, questions and support requests.
Security: To monitor usage, investigate failures and prevent fraud and unauthorized access.
Legal Compliance: To comply with applicable laws, regulations and valid orders.

The performance of the Service and of the contract, compliance with legal obligations and other legal bases applicable to each purpose guide the processing. When an activity depends on consent, it will be requested specifically and may be withdrawn; merely accessing this policy does not constitute consent to every activity.

4. Service Providers, Integrations and Disclosure

We do not sell your personal data. We share information only in the following circumstances:

Service Providers: We use Supabase for authentication, database and file storage, Vercel for hosting the web application and its authentication callback functions, Railway for the MCP connector and model-processing workers, and Resend for transactional emails such as workspace invitations. Authentication emails may also be sent through Supabase. These providers receive the data necessary to their function.
Optional Sign-In: Sign-in with Google is optional. If you use it, Google processes your authentication according to its own terms.
Optional Autodesk Integration: If your organization links models from Autodesk Construction Cloud or other Autodesk products, we share the data necessary to that integration and the Autodesk viewer loads Autodesk resources. Native IFC uploads are processed by ConstruChain without Autodesk.
AI Platforms: When you connect an MCP client such as ChatGPT or Claude, authorized tool results are sent to that platform (see Section 5).
Legal Requirements: We may disclose information if required by law or in response to valid requests by public authorities.

This policy does not authorize public disclosure of your projects or advertising use of customer content.

5. MCP Connector and AI Platforms

The ConstruChain Vision MCP connector exposes four tools: list_models, get_model_schema and query_model read property data of models in the workspaces you are authorized to access; publish_dashboard creates a dashboard in Vision only when you request it. An existing dashboard is updated only when you ask and its dashboard identifier is provided. The connector does not modify models or geometry.

A dashboard is created with workspace visibility by default. The members and public visibilities exist; a public dashboard is shareable by URL. The connector creates a public dashboard only when you explicitly request it; changing an existing dashboard to public inside Vision is restricted to workspace owners. Publication does not by itself mean public access.

When you authorize the connector, you review on the ConstruChain authorization screen what the connection may access. Query results requested through the connector are sent to the AI platform you chose and may include personal or confidential content present in the models. Subsequent processing by the AI platform follows its own terms and settings; consult them before connecting. Revoking the authorization, in Vision or in the AI platform, prevents future access by that connection but does not erase results already received by the platform.

Property data extracted from processed models is stored in private storage of the Service to support queries and dashboards. A dashboard linked to a 3D viewer requires an Autodesk-processed model; dashboards for native IFC models are published without the linked viewer.

6. International Data Transfers

The providers and integrations listed in this policy may process information outside Brazil, according to the environments contracted. A connection to an AI platform may also involve an international transfer. ConstruChain must observe the hypotheses and safeguards applicable to those transfers under the applicable law. This policy does not declare exclusive data residency in any country and does not presume that accepting the terms replaces those requirements. Contact the privacy channel for information about the processing of your data.

7. Retention and Termination

Account data, project content and operational records are retained as necessary to provide the Service, follow the organization’s instructions and contract, and meet legal obligations or the protection of rights. Deactivating an account, revoking an MCP connection and closing a project or workspace are distinct operations.

Deletion requests are analyzed regarding ownership, permissions and retention hypotheses. Backups and logs may have their own retention cycles; integration logs, for example, are purged after 90 days. This policy does not promise automatic deletion within a period that has not been defined and implemented. Deletion commitments assumed in a specific contract, or in an earlier version of this policy accepted by you, remain applicable according to their terms.

8. Your Data Protection Rights

You may request confirmation of processing, access and correction; anonymization, blocking or deletion in the applicable cases; information about sharing; portability as regulated; objection and review of automated decisions when applicable; and withdrawal of consent when consent is the legal basis. These rights are exercised under the applicable law, including the LGPD, and its conditions and exceptions. We do not sell personal data.

To exercise any of these rights, contact support@construchain.com.br. We may request proportional information to confirm your identity and forward the request to the responsible organization, without asking for your password. If a request is not resolved, you may contact the competent authority.

9. Cookies and Local Storage

The browser keeps session information and interface preferences needed for access and operation of the Service, as described in our Cookies Policy. The application does not embed third-party analytics or advertising scripts. Hosting and authentication providers keep technical access records. Optional providers (Google sign-in, Autodesk viewer) may use their own cookies and identifiers when you use them.

10. Security

We apply technical and administrative measures to protect personal data, including:

Encryption of data in transit (TLS/HTTPS).
Encryption of data at rest provided by the storage infrastructure (Supabase).
Authentication, workspace permissions and row-level access policies in the database.

These measures reduce risks and do not constitute a guarantee of absolute security. Incidents will be handled according to the applicable legal and contractual duties.

11. Updates

Updates are identified by version and date. Relevant changes will be communicated through the channels available in the Service, as required. A new version does not remove rights provided by law and does not automatically replace specific conditions of an organization’s contract.

12. Contact Us

If you have questions about this Privacy Policy, please contact us:

CONSTRUCHAIN GLOBAL LTDA
CNPJ 60.740.421/0001-80
Avenida Saul Nonnenmacher, 250, Ipanema, Porto Alegre/RS, CEP 91751-220, Brazil
Email: support@construchain.com.br