Privacy Policy

This Privacy Policy applies to all users of the Constroma platform, including visitors to our website, registered account holders, and any individual whose personal data is processed in the course of providing the Service.

We act as the data controller for personal information collected directly through the Service. Where we process personal data on behalf of our customers (for example, information contained within project schedules or delay records), we act as a data processor and our customers remain the data controllers for that information.

This policy should be read alongside our Terms of Service, which governs your use of the platform. Where there is any conflict between the two documents, the Terms of Service will take precedence except in matters relating specifically to the processing of personal data.

We collect information in three categories depending on how you interact with the Service:

We use the information we collect for the following purposes, each grounded in a lawful basis under applicable data protection law:

Your data is stored on infrastructure provided by Supabase, built on PostgreSQL, hosted within the European Union (EU West region). We have chosen EU-based servers to support compliance with the General Data Protection Regulation (GDPR) and to provide strong data protection standards for all users regardless of their location.

We implement the following technical and organisational security measures:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Database storage is encrypted at rest using AES-256. Uploaded files (XER schedules and associated documents) are stored in encrypted object storage.
• Access controls: Row-level security policies in PostgreSQL ensure that users can only access their own data. Administrative access to production systems is restricted to a small number of authorised personnel and requires multi-factor authentication.
• Authentication: Passwords are hashed using bcrypt. We support and encourage the use of third-party OAuth providers (Google, LinkedIn, Apple) which provide additional authentication security.
• Audit logging: All privileged access to production data is logged and reviewed periodically.

While we take reasonable and industry-standard precautions to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and you use the Service at your own risk in this regard.

In the event of a data breach that is likely to result in a risk to your rights or freedoms, we will notify you and any applicable supervisory authority within the timeframes required by law.

We do not sell, rent, or trade your personal information to any third party. We do not share your data with advertising networks, data brokers, or analytics companies for commercial purposes.

We share data only with the following sub-processors, strictly as necessary to operate the Service:

Each sub-processor is contractually required to process data only on our instructions, implement appropriate security measures, and comply with applicable data protection law. We do not allow sub-processors to use your data for their own purposes.

We may also disclose personal information if required to do so by law or in response to a valid legal request (such as a court order or regulatory inquiry), or where we believe disclosure is necessary to prevent fraud, protect our legal rights, or protect the safety of any person.

In the event that Constroma undergoes a merger, acquisition, or sale of all or part of its assets, your personal information may be transferred as part of that transaction. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.

Depending on your location and applicable law, you may have the following rights in relation to your personal data:

• Access: You have the right to request a copy of the personal information we hold about you.
• Correction: You have the right to request that we correct any inaccurate or incomplete personal information. You can update most account information directly in your profile settings.
• Export: You have the right to receive your personal data and project data in a structured, commonly used, machine-readable format (data portability). You can export your project data from the platform at any time via your account settings, or by contacting us.
• Deletion: You have the right to request deletion of your personal data. We will action deletion requests in accordance with Section 8 (Data Retention) and subject to any legal obligations that require us to retain certain information.
• Restriction: You have the right to request that we restrict processing of your personal data in certain circumstances, for example while a correction request is being assessed.
• Objection: Where we process your data based on our legitimate interests, you have the right to object to that processing. We will consider your objection and cease processing unless we have compelling legitimate grounds that override your interests.
• Withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at privacy@constroma.com. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

If you are located in the European Economic Area (EEA) or United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your personal data in accordance with applicable law.

Constroma uses cookies and similar browser storage technologies (such as localStorage) solely to operate essential platform functionality. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

The cookies we use are:

These cookies are strictly necessary for the Service to function. Blocking them through your browser settings will prevent you from logging in or using authenticated features. Because we only use essential cookies, we do not display a cookie consent banner — there are no optional cookies to accept or decline.

If we introduce non-essential cookies in the future (for example, for analytics), we will update this policy and, where required by law, seek your consent before setting them.

We retain personal data for as long as it is necessary to fulfil the purposes described in this policy or as required by applicable law.

• Active accounts: Your account information and project data are retained for the duration of your account. Project data associated with active or recently completed analyses is retained to allow you to access and re-export your results.
• Account closure: When you close your account or request deletion, we will retain your data for a period of 30 days. During this window you may reactivate your account or request a final data export. After 30 days, your account information and project data will be permanently and irreversibly deleted from our systems, including backups, unless we are required by law to retain it.
• Billing records: Invoices and payment records are retained for 7 years to comply with financial and tax reporting obligations. These records contain only your name, email, and billing amounts — not your project data.
• Usage logs: Server and access logs are retained for up to 90 days for security and operational purposes, then deleted on a rolling basis.
• Anonymised analytics: Aggregated and fully anonymised usage statistics (from which no individual can be identified) may be retained indefinitely for product research purposes.

The Constroma Service is a professional platform intended solely for use by individuals who are 18 years of age or older. We do not knowingly collect, solicit, or process personal information from children under the age of 18.

If you are under 18, please do not use the Service or provide any information through it. If we become aware that we have inadvertently collected personal information from a person under 18, we will take prompt steps to delete that information from our systems.

If you believe that a child under 18 has provided us with personal information, please contact us immediately at privacy@constroma.com so that we can take appropriate action.

If you have any questions, requests, or concerns regarding this Privacy Policy or the way we handle your personal data, please contact our privacy team:

For general support enquiries, please use support@constroma.com. Privacy-specific requests (access, deletion, correction) should be directed to the privacy address above to ensure they are routed to the appropriate team and handled within the required timeframes.

We aim to acknowledge all privacy-related requests within 5 business days and resolve them within 30 days. Complex or multi-subject requests may take longer; we will inform you of any expected delay.