Privacy Policy

STRAITUP — PRIVACY POLICY Version 2026-09-1 Last updated 3 September 2026 WHO WE ARE StraitUp is a construction-management platform operated by Substrait Construction Limited (New Zealand). This policy explains what information StraitUp collects, how we use it, and your choices. Questions: gray@substraitconstruction.co.nz. INFORMATION WE COLLECT - Account information: your name, email address and role, used to sign you in and identify your work. - Business data you enter or upload: jobs, estimates, pricing, schedules, invoices, back-costing, client and contact details, time entries, photos and documents. - Connected-account data: where you connect a third-party account (Google, Xero), the data you authorise us to access from it (see "Google user data" below). - Usage and device information: basic technical data needed to run the app securely, such as sign-in events and the browser/device type. GOOGLE USER DATA With your explicit permission, StraitUp connects to your Google account for these features only: - Sign in with Google — your basic profile and email address (OpenID, profile, email) to create and secure your account. - Gmail (gmail.send) — to send emails you initiate in StraitUp — such as payment claims, proposals, purchase orders, handover packs and job messages — from your own Gmail account. StraitUp does not read your inbox, and StraitUp does not create invoices: accounting invoices and bills are handled in your accounting system (Xero), which you connect separately. - Google Drive (drive.file) — to create and manage only the files and folders StraitUp itself creates for your jobs. StraitUp cannot see the rest of your Drive. You authorise each connection yourself and can disconnect it at any time in Settings, which revokes StraitUp's access. HOW WE USE GOOGLE DATA — LIMITED USE StraitUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide and improve the user-facing features you connected it for. We do not sell it, we do not use it for advertising, we do not transfer it to others except as needed to provide these features or as required by law, and we do not use it to train generalised AI or machine-learning models. HOW WE STORE AND PROTECT DATA - Your data is stored in our database (Supabase / PostgreSQL), encrypted in transit (HTTPS/TLS) and at rest. - Each company's data is isolated by row-level security, so one company cannot access another's. - Secret keys are held server-side only and are never shipped in the app. WHO WE SHARE DATA WITH We do not sell your data and we do not share one company's data with another. We use trusted sub-processors only to run the service — Supabase (database and authentication), Vercel (hosting) and Google (the connections you authorise). We may disclose information if required by law. DATA RETENTION AND YOUR RIGHTS We keep your data while your account is active. You can request a copy of your data, ask us to correct it, or ask us to delete it, at any time. Under the New Zealand Privacy Act 2020 you have the right to access and correct the personal information we hold about you. To make a request, email gray@substraitconstruction.co.nz. CHANGES We may update this policy as the platform changes. The current version and date are shown at the top of this page. CONTACT Substrait Construction Limited — gray@substraitconstruction.co.nz