Privacy Policy

This policy explains what personal data PROJEKTA collects, where it is stored, who processes it and what you can do about it. The data controller is NXTFaze Construction Consultancy, registered in the Kingdom of Bahrain (CR 191-321). Contact: consult@nxtfaze.com.

1. What we store

PROJEKTA is a cloud application. Your data is stored on our servers, not only in your browser.

• Account record — your email address, the display name and company name you enter at sign-up, your plan (trial, free, professional, enterprise or cancelled), the trial start date and the account creation date. If you sign in with Google, we receive the email and display name from your Google account.
• Projects — everything you create in the app: project briefs, the text extracted from documents you upload, generated plans (phases, materials, permits, safety, value engineering, sustainability), timesheets, supply and delivery records, receipt data, drawing-check results, and the sharing membership of each project (the email addresses and roles of people you invite).
• Usage counters — a monthly count of AI tokens consumed and top-ups purchased, kept per account so we can enforce plan limits. Only the server can read or write these.
• Billing references — if you subscribe, your Stripe customer ID and subscription ID, and a record of any token top-up (amount, date, Stripe session ID). We never see or store your card number: payment details are entered on Stripe's hosted checkout and held by Stripe.
• Error and request logs — if something breaks in your browser, the app sends the error message, page and your account ID to our logs so we can fix it. Our servers also keep standard request logs (timestamp, route, IP address, status) as part of Google Cloud Run.
• Material rate cache — market unit rates discovered during plan generation (item, unit, price, source URL, country) are cached and shared across accounts. This cache contains no personal data and is not linked to your account.

2. Where it is stored

• Application servers: Google Cloud Run, region us-central1 (United States).
• Database and authentication: Google Firebase / Cloud Firestore, project hosted in the United States.
• Backups: a daily export of the database to Google Cloud Storage, kept for 30 days and then deleted automatically.
• Your browser: Firebase keeps a sign-in session and an offline copy of your projects in local storage / IndexedDB so the app works without a connection. Clearing site data removes the local copy; the cloud copy is unaffected.

We do not currently offer data residency in the GCC. If your organisation requires it, contact us before subscribing.

3. Third parties that process your data

• Google Gemini (Google LLC) — generates plans, answers chat questions, reads uploaded documents, receipts and drawings, and looks up material prices. The project brief, document text, images you submit for OCR or drawing checks, and your conversation with the assistant are sent to the Gemini API for processing. We use the API under Google's paid-service terms.
• Stripe, Inc. — subscription and top-up payments. Stripe receives your email and payment details directly and is an independent controller for payment data (see Stripe's privacy policy).
• Google Firebase — authentication (email/password and Google sign-in), database hosting, and App Check / reCAPTCHA Enterprise for abuse protection.
• Google Cloud — hosting, logging and backups.

We do not sell personal data, and we do not use advertising cookies or any third-party analytics service. We keep a small first-party usage log (for example, that a plan was generated or an export was made) stored in our own database with your account id when you are signed in; it contains no IP addresses, no device fingerprints and no advertising identifiers, and it is deleted with your account.

4. Why we process it (legal basis)

• To provide the service you signed up for (contract): account, projects, usage counters, billing references.
• To keep the service secure and working (legitimate interest): request logs, error logs, abuse protection, rate limits.
• To meet legal obligations: billing records retained by Stripe and by us as required by tax law.

5. How long we keep it

• Account, projects and usage counters: for as long as your account exists. Deleted when you delete your account (section 6). Copies in the daily backups expire within 30 days of deletion.
• Projects you own that were shared with others are deleted with your account; projects other people own that you were invited to remain theirs.
• Server and error logs: retained under Google Cloud Logging's default retention (30 days).
• Billing records: kept by Stripe under its own retention rules and by us as long as tax and accounting law require.

6. Your rights: export and deletion

Wherever you are, you can access, correct, export and delete your data. These work today:

• Correct — edit your projects and profile inside the app at any time.
• Export — GET /api/account/export (signed in) returns a JSON file containing your account record (billing identifiers removed), every project you own and your usage counters.
• Delete — POST /api/account/delete with the body {"confirm":"DELETE"} (signed in) permanently deletes the projects you own, pending invites you sent, your usage counters, your account record and your sign-in identity. If you have an active Professional or Enterprise subscription you must cancel it first, so you are not billed for an account that no longer exists.
• In the app — open the avatar menu (top right) → Account. “Download my data” saves the export file; “Delete my account” asks you to type DELETE and then runs the deletion above.
• Prefer email? Write to consult@nxtfaze.com from your registered address and we will run the export or deletion for you.

If you are in a jurisdiction with a data-protection law — including the Kingdom of Bahrain's Personal Data Protection Law (Law No. 30 of 2018) and the EU/UK GDPR — you also have the right to object to or restrict processing and to complain to your supervisory authority. We apply the same access, export and deletion mechanisms to everyone regardless of location. We do not claim any certification (such as ISO 27001 or SOC 2) that we do not hold.

7. AI-generated content

Plans, costs, quantities, permit checklists and safety content are produced by an AI model from the information you provide and from web sources. They are estimates and drafts, not professional advice, and are not validated against any regulator. Verify them with qualified professionals and the relevant local authority before relying on them.

8. Security

Data is encrypted in transit (HTTPS) and at rest by Google Cloud. Access to project data is enforced by Firestore security rules — only the owner and people they have explicitly shared with can read a project — and those rules are covered by an automated test suite. Usage counters and billing fields can only be written by the server. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

9. Children

PROJEKTA is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

10. Changes

We will update the “Last updated” date above when this policy changes and, for material changes, notify you by email or in the app.