Privacy policy

Building AgentOS is an invite-only beta for construction businesses. The Building AgentOS representative identified in your invitation is the primary contact for this beta. This policy covers information handled when a business requests access, creates an account, connects an integration or uses an AgentOS workflow.

• Account, company, contact, role and team details supplied during access and onboarding.
• Job, cashflow, invoice, supplier, client, task, variation, timesheet and site diary records entered or connected by an authorised user.
• Email metadata, message content and attachments made available through an authorised Microsoft connection.
• Voice notes, photos, generated summaries, user corrections, approvals, feedback and audit events.
• Technical, security and usage information needed to authenticate users, prevent abuse and troubleshoot the beta.

AgentOS is not designed for unnecessary sensitive information. An invited business must avoid entering health, identity-document, payment-card or other sensitive information unless it is genuinely required and authorised for the relevant construction record.

Information is collected directly from users, from other authorised members of their business, from connected services such as Microsoft and Xero, and from records generated when AgentOS processes or audits a workflow. It is held in access-controlled cloud infrastructure and may also appear in encrypted operational backups, audit records and provider logs for limited periods.

We use and disclose information only as reasonably required to provide the requested beta workflows, authenticate users, operate authorised integrations, generate agent suggestions, apply permitted actions, prevent abuse, provide support and improve reliability. We do not sell personal information.

Information may be disclosed to service providers including Supabase, Vercel, OpenAI, Microsoft, Xero and the configured email-delivery provider, and to professional advisers or authorities where reasonably necessary or legally required.

Configured AI providers may process the content needed to classify, structure or summarise a record. Agent output can be incorrect. Decisions with commercial or external consequences remain subject to the permissions and human-review conditions displayed in AgentOS. Users can correct source records, dismiss recommendations and provide feedback.

Cloud and integration providers may process information outside Australia, including in Japan and the United States, and in other locations listed in their current service documentation. Provider location and subprocessors can change. Reasonable contractual, access and security controls are used when selecting and operating these services.

Individuals may ask to access or correct personal information held about them. Business Administrators can export supported business records and submit an offboarding or deletion-review request from Business Settings. Requests are manually reviewed so identity, authority, legal, accounting, safety and backup-retention obligations can be considered before information is disclosed, corrected or deleted.

Beta data is retained only while required to operate the service, meet those obligations or resolve an active support or security issue. Residual encrypted backup copies are removed through the applicable backup-retention cycle rather than altered in place.

Contact the representative who issued your invitation, or use the beta access form and begin the notes with “Privacy request”, “Privacy complaint” or “Security report”. Include enough detail to identify the affected account or record, but do not submit passwords, access tokens or unnecessary sensitive documents. We will verify the requester’s identity and authority, investigate, and explain the outcome or any lawful reason a request cannot be completed.

If a privacy complaint is not resolved, you may be able to contact the Office of the Australian Information Commissioner.

The current version is published on this page. Material changes affecting an active beta business will be communicated through the service or the business’s nominated contact before they take effect where reasonably practicable.