How we protect your data

BuildPulse accounts are protected by email-and-password sign-in, and homeowners can also sign in with Google. Sessions are held in a same-origin, HTTP-only cookie — no access token is stored in browser storage where page scripts could read it — and are renewed automatically for up to 30 days.

Inside the app, you only see data that belongs to you. Row-level security is enforced in the database itself rather than only in application code: contractor records are scoped to your company, and homeowner projects, photos and AI renders are scoped to your own user account. The database role the application runs as cannot bypass those rules.

The BuildPulse web application is hosted on Vercel. Our database is Neon (managed PostgreSQL) and uploaded files are held in Neon Object Storage, both in the AWS us-east-2 region. All traffic is served over HTTPS with HSTS.

Authentication is handled in our own application against that same database, so your credentials are not shared with a third-party identity provider unless you choose to sign in with Google.

We collect the data you provide when you use BuildPulse. For contractors that is your account profile, company details, projects, costs, client contacts you add, project photos, and reviews submitted by your clients. For homeowners it is your account profile, the project details you enter in the estimate wizard, the room photos you upload, the AI renders generated from them, and the quote requests you send. We use this data to operate the service, show you your own dashboards and reports, match homeowner projects with contractors, send review requests on your behalf, and process subscription billing.

We do not sell your data or your clients' data to third parties.

Room photos, AI renders, project photos and reviewer photos are all stored in private buckets. None of them are served from a public URL: the app issues a short-lived signed link each time an authorised viewer needs to see a file, and deletion is restricted to trusted server-side operations.

BuildPulse uses a small number of subprocessors to deliver the service:

• Vercel — application hosting and delivery.
• Neon — managed PostgreSQL database and object storage for uploaded photos and AI renders.
• Stripe — subscription billing and payment processing. Card details are handled by Stripe directly and never touch our servers.
• Resend — transactional email delivery (review requests, account emails).
• Google (Gemini) — AI features: room photo analysis, design visualisation, and cost/ROI assistance.
• Google — optional "Sign in with Google", when you choose it.

If you want to export or delete your account data, email us at the address below and we will action your request. Clients who received a review request from a contractor using BuildPulse can also unsubscribe from future review emails at any time using the link in any email we send.

Active project, cost, and review data is retained while your account is active. When an account is deleted, we remove associated company data from production systems.

If you believe you've found a security issue in BuildPulse, please report it privately to security@buildpulse.ca. We will acknowledge your report and work with you on a fix. Please don't publicly disclose the issue until we've had a chance to address it.