Legal
Privacy Policy
Last updated: 18 August 2026
Constructly is a construction coordination platform. This page explains what it collects, why, where it is stored and for how long. It describes the product as it actually works — not as a list of everything we might one day do.
Who is responsible
Constructly is operated by [LEGAL ENTITY], [REGISTERED ADDRESS], company number [NUMBER]. For anything on this page, write to geral@dragoncrown.pt.
What we collect
Only what the platform needs in order to work.
- Your account. Name, email address, interface language, and a password that is stored only as a hash — never in a form we can read.
- Your company and projects. The organisation you create or are invited to, its projects, and the people who have access to each one.
- What you put in. Tasks, documents, site images, minutes, technical records, purchases and financial movements. This is your content; we process it to provide the service and for nothing else.
- Security records. Sign-in attempts, session activity and an audit log of sensitive actions, with the IP address and browser that made them. This is what lets us block brute-force attempts and lets you see who did what.
We do not run advertising, we do not profile you, and we do not sell or share your data with anyone for their own purposes.
Who processes it with us
We use a small number of providers to run the service. Each one only receives what it needs for its job.
- Vercel — hosting, file storage for your documents and images, and aggregate performance measurements (page speed). The performance measurements are not tied to your identity.
- Supabase — the PostgreSQL database where account, project and record data is stored.
- Resend — sending the transactional emails the platform needs: address confirmation, password reset and invitations.
- OpenStreetMap and OpenFreeMap — turning a project address into map coordinates, and drawing the map. The project address is sent for this; nothing about your account is.
Where it is stored
Data is stored and processed within the European Union. Where a provider needs to transfer data outside the EU, that transfer relies on the European Commission’s Standard Contractual Clauses.
How long we keep it
- Account and project data — for as long as the account is active. When an organisation is deleted, its data is deleted with it.
- Sessions — up to 30 days, or until you sign out or revoke them.
- Confirmation and password-reset links — 30 minutes, and only once. Using one invalidates it.
- Security audit records — kept while they remain useful for investigating misuse.
Your rights
Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. Write to the address above and we will answer within one month. If you believe we have handled your data badly, you can complain to your national supervisory authority — in Portugal, the CNPD.
Security
Passwords are hashed. Session cookies are httpOnly, Secure and SameSite, so they cannot be read by scripts and do not travel to other sites. Sessions can be revoked. Sign-in and password-reset endpoints are rate limited. Access to every project is checked on the server on every request, not just hidden in the interface.
Changes
If this policy changes in a way that affects you, we will say so in the platform before the change takes effect.