Privacy Policy

Controller

ContechCost is operated under the registered business name Contech Group (ABN 44 678 604 610), Sydney, New South Wales, Australia. The business name is held by BLACKBOX TRADING PTY LTD, which is responsible for personal information handled through ContechCost. In this policy, "Contech Group", "we", "us" and "our" refer to that company. Privacy enquiries may be sent to support@contechcost.com.

Information We Process

• Account and authentication data.
• Project, estimate, BOQ, and related workspace content entered by users.
• MCP, API, and application usage logs needed to operate and secure the service.
• Support and contact communications.

Purpose Of Processing

• To provide, secure, and maintain the service.
• To authenticate users and enforce access controls.
• To respond to support requests and operational issues.
• To investigate misuse, fraud, security incidents, and legal claims.

Legal Basis For Processing

Where UK or EU data protection law applies, we rely on the following legal bases:

• Performance of a contract — to provide the service you sign up for, authenticate you, and deliver estimating, cost-management, and related features.
• Legitimate interests — to operate, secure, and improve the service and to investigate misuse, fraud, and security incidents, balanced against your rights.
• Consent — for optional AI-connected features, which you agree to when you enable them.
• Legal obligation — to meet billing, tax, and other legal requirements.

How we use AI

• We use AI to help prepare estimates, manage project costs, and read contract documents. This is done by Anthropic (Claude), Microsoft Azure OpenAI, and OpenAI.
• Your data is never used to train any AI model.
• Your account data is stored in your own region (Australia, UK, or US). Some AI processing is performed by our AI providers and may take place outside your region, including in the United States, under contractual data-protection safeguards.
• AI providers may retain submitted content for limited periods to provide the service, protect against abuse and meet legal obligations. The period varies by provider, model, feature and contractual configuration. Standard API retention can be up to 30 days, but flagged safety material or legal requirements can require longer retention. See our Subprocessors page for the providers involved.
• All data is encrypted in transit and at rest.

Disclosure

We may disclose data to infrastructure and service providers acting on our behalf, to professional advisers, where required by law, or as part of a business reorganisation or transaction. Current subprocessors are listed on our Subprocessors page.

Retention

Customer project data is retained while the relevant account or workspace remains active, so that users can continue to access their estimates and historical records.

• Deleted customer content is removed from primary systems within 30 days.
• Backup copies may persist for up to 35 days before rolling deletion.
• Operational and security logs are generally retained for up to 90 days.
• We may retain limited information for longer where required for security, fraud prevention, billing, tax, or legal obligations.

International Processing

Data may be processed in countries where our service providers operate. Where required, we rely on contractual and technical safeguards appropriate to the transfer.

Rights And Requests

To request access, correction, deletion, or portability of your personal data, or further information about our handling of it, contact support@contechcost.com. Where UK or EU law applies, you also have the right to object to or restrict certain processing.

If you are not satisfied with how we handle a request or complaint, you may lodge a complaint with your data protection authority — in the UK, the Information Commissioner’s Office (ICO, ico.org.uk); in Australia, the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).