Last updated: November 9, 2026
This page is in three parts. The Data Processing Addendum is the agreement that governs how BldrTeam handles personal information you store in the Services. The Security section describes how we protect it. The Subprocessors section names the companies that help us run the Services. The full Security Overview is available from security@bldrteam.com.
This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between BLDRTEAM SERVICES LLC (“BldrTeam” or “Processor”) and each customer that uses the Services (“Customer” or “Controller”). It applies to every customer account without a signature. If your organization needs a countersigned copy naming your legal entity, email privacy@bldrteam.com and we will send one.
1.1 Data Protection Laws means all laws applicable to the processing of Personal Data under the Agreement, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and other U.S. state privacy laws.
1.2 Personal Data means any information relating to an identified or identifiable natural person that BldrTeam processes on behalf of Customer in providing the Services.
1.3 Processing means any operation performed on Personal Data, such as collection, storage, use, disclosure or deletion.
1.4 Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
1.5 Subprocessor means any third party engaged by BldrTeam to process Personal Data.
Capitalized terms not defined here have the meanings given in the Agreement.
2.1 Roles. Customer is the controller (or “business”) and BldrTeam is the processor (or “service provider”) of Personal Data.
2.2 Details of processing. The subject matter, duration, nature, purpose, data types and data subjects are described in Annex 1.
2.3 Customer responsibilities. Customer is responsible for the lawfulness of the Personal Data it provides and for having any notices and consents required to allow BldrTeam to process it under this DPA.
3.1 Instructions. BldrTeam will process Personal Data only on Customer’s documented instructions, which are the Agreement, this DPA and Customer’s use and configuration of the Services, unless required otherwise by law. In that case BldrTeam will inform Customer before processing unless the law prohibits it.
3.2 Unlawful instructions. BldrTeam will notify Customer if it believes an instruction violates Data Protection Laws.
3.3 CCPA. BldrTeam will not sell or share Personal Data, retain, use or disclose it for any purpose other than providing the Services, or combine it with personal information received from other sources, except as permitted by the CCPA.
BldrTeam will ensure that personnel authorized to process Personal Data are bound by confidentiality obligations and access Personal Data only as needed to provide the Services.
BldrTeam will implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in the BldrTeam Security Overview, which is summarized in the Security section of this page and available in full on request. BldrTeam may update these measures provided the update does not materially reduce the overall level of protection.
6.1 Authorization. Customer generally authorizes BldrTeam to engage Subprocessors. The current Subprocessors are listed in the Subprocessors section of this page.
6.2 Obligations. BldrTeam will impose data protection terms on each Subprocessor that are no less protective than this DPA, and remains responsible for each Subprocessor’s performance.
Taking into account the nature of the processing, BldrTeam will provide reasonable assistance to Customer in responding to requests from individuals exercising their rights under Data Protection Laws. If BldrTeam receives such a request directly, it will forward the request to Customer and will not respond except as Customer instructs or as required by law.
BldrTeam will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer’s Personal Data. The notice will describe the incident, the data affected, and the steps taken to contain it, as that information becomes available. BldrTeam will take reasonable steps to mitigate the incident and will cooperate with Customer’s reasonable requests.
BldrTeam will provide reasonable assistance to Customer with data protection impact assessments and consultations with regulators, to the extent required by Data Protection Laws and relating to Customer’s use of the Services.
During the term, Customer may export its data through the Services or by request. After the Agreement ends, BldrTeam will retain Customer’s data for one (1) year so Customer can request a free export, and will then delete it from production systems. Backup copies are deleted within a further thirty (30) days. Customer may request earlier deletion in writing. BldrTeam may retain Personal Data as required by law, subject to this DPA’s confidentiality and security obligations.
BldrTeam stores Personal Data in the United States. Where Data Protection Laws require a transfer mechanism for Personal Data transferred from the EEA, UK or Switzerland, the parties agree that the applicable Standard Contractual Clauses (Module Two, controller to processor), together with the UK Addendum where relevant, are incorporated by reference.
Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability in the Agreement.
13.1 Precedence. If this DPA conflicts with the Agreement regarding the processing of Personal Data, this DPA controls.
13.2 Term. This DPA remains in effect for as long as BldrTeam processes Personal Data on Customer’s behalf.
13.3 Governing law. This DPA is governed by the law that governs the Agreement, unless Data Protection Laws require otherwise.
Subject matter: Providing the BldrTeam construction project management platform to Customer.
Duration: The term of the Agreement plus the retention period in Section 10.
Nature and purpose: Hosting, storage, organization, display, transmission and analysis of Customer data, including AI-assisted features, integrations Customer enables, and communications Customer sends through the Services.
Data subjects: Customer’s employees and users; Customer’s clients (homeowners); Customer’s vendors, subcontractors and their contacts.
Categories of Personal Data: Names; business and home addresses; email addresses; phone numbers; job titles; project, schedule, financial and contract information; photos and documents uploaded by users; messages; time-tracking records; account credentials (stored as one-way hashes); usage and device information.
Sensitive data: None intended. Customer should not upload special categories of personal data.
Security measures and Subprocessors: As described in the Security and Subprocessors sections of this page.
The application, background processing and database run on AWS in Northern Virginia across multiple availability zones, with a passive failover in Oregon. Uploaded files and documents are stored in a private S3 bucket in Oregon. All customer data is stored in the United States.
Some features send your content to the AI providers listed below to produce results such as bill imports and plan analysis. We use these providers through their paid business APIs, under terms that prohibit using your data to train their models. We use more than one provider to get the best results and to keep the Services running if one has an outage or changes its terms.
Subprocessors receive only the data needed for the purpose shown. Those marked “when you connect it” receive nothing until you turn on that integration.
Subprocessors process data in the United States, with two notes. Mistral AI is a European company, and we use its US endpoint. Cloudflare’s network is global, so it carries traffic at the edge nearest the visitor.
Questions about this agreement or a countersigned DPA: privacy@bldrteam.com. Security questions, the full Security Overview, or to report a vulnerability: security@bldrteam.com.