Privacy policy

Construct Flow Information Technology FZCO · Last updated: 30 June 2026

This policy explains how Construct Flow Information Technology FZCO ("Construct Flow", "we") collects, uses and protects personal data in connection with the Construct Flow platform (app.constructflow.ae), our website (constructflow.ae) and our WhatsApp service. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

1. Two roles: controller and processor

For data you give us directly — a demo request, your account details, emails with us — we act as controller.

For data your organisation puts into the platform — projects, daily reports, photos, worker records, timesheets and wage data — your organisation is the controller and Construct Flow is a processor acting on its instructions. Questions about that data should go first to the contractor who operates your workspace.

2. What we collect

Account data: name, email address, password (hashed), organisation name, role and language preference.
Workspace data (on behalf of your organisation): project records, daily reports, snags, inspections, documents, photos, schedules, financial records, worker directory entries (names, trades, phone numbers, document references) and wage/WPS data.
Voice and messages: voice notes and messages sent to the platform or to our WhatsApp number, plus the transcripts and structured records generated from them.
Demo requests: name, company, mobile number, trade and company size from the website form.
Technical data: log and usage data needed to run and secure the service.

3. How we use it

To provide the platform: turning site capture into structured records, dashboards, reports and notifications.
To run AI features (transcription, translation, summaries, the Sitewise assistant) — see section 5.
To send WhatsApp messages to workers only after recorded opt-in consent; consent can be withdrawn at any time by replying STOP.
To respond to demo requests and provide support.
To secure the service, prevent abuse and meet legal obligations.

We do not sell personal data, and we do not use your workspace data to train AI models.

4. Sub-processors

Supabase — database, authentication and file storage.
Vercel — application hosting.
Anthropic — AI processing (transcribed text and selected records are sent for structuring, translation and summaries).
ElevenLabs / OpenAI — speech-to-text for voice notes.
Twilio — WhatsApp messaging.
Resend — transactional email.
Google / Microsoft — only if your organisation connects calendar or email sync.
Hostinger — website hosting (constructflow.ae).

Some sub-processors store data outside the UAE. Where data is transferred internationally we rely on contractual safeguards consistent with the PDPL.

5. AI processing

Voice notes and selected records are processed by the AI providers listed above to produce transcripts, translations, structured records and summaries. AI output is decision-support: records that matter (claims, money, safety) are confirmed by a human before they are written. We send providers only what the feature needs.

6. Retention

Workspace data is retained while your organisation's account is active and for a hand-over period after closure, after which it is deleted. Organisations can export their data at any time and may request earlier deletion. Demo-request data is kept no longer than 12 months unless you become a customer. Logs are kept for a shorter operational window.

7. Security

Each organisation's data is isolated at the database level (row-level security). Data is encrypted in transit and at rest by our hosting providers. Access inside Construct Flow is role-based.

8. Your rights

Under the PDPL you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. Workers contacted via WhatsApp can opt out at any time by replying STOP. To exercise any right, contact us at hello@constructflow.ae. If your data sits in a contractor's workspace, we may refer the request to that contractor as controller.

9. How to delete your data

You can request deletion of your account and personal data at any time:

Account holders: email hello@constructflow.ae from your registered email address with the subject "Data deletion request". We will confirm receipt and delete your account data within 30 days, except where UAE law requires longer retention (for example invoicing records).
Organisations: the organisation owner can request deletion of the entire workspace by the same route. We provide a data export before deletion on request.
Workers contacted via WhatsApp: reply STOP to opt out of messages at any time, and use the email route above to request deletion of your records.
Data in a contractor's workspace: if your data was entered by a contractor using the platform, that contractor is the controller; we will refer your request to them and support its completion.

10. Cookies and analytics

The website uses privacy-respecting, cookieless product analytics to count visits and measure which pages lead to demo bookings. We do not run third-party advertising cookies.

11. Changes and contact

We will post any changes to this policy on this page with an updated date. Questions: hello@constructflow.ae · +971 50 149 3663 · Construct Flow Information Technology FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.