Privacy policy

[Company legal name], [company number], of [registered address] is the controller of the personal data described here. Contact: [privacy@congreat.co].

Account data: your name, email address, and — if you sign in with Google — the profile identifier Google returns. We never receive your Google password.

Documents you upload, and the reports produced from them. These may contain personal data belonging to others, such as names in correspondence; you are responsible for being entitled to upload them.

Service data: sign-in times, pages viewed, analyses run, and technical logs needed to operate and secure the service.

The analysis begins as soon as you upload, which is before you create an account. Until an account claims it, that upload lives in server memory only: the files, the text read out of them and the running analysis. Nothing is written to our database or to storage.

An upload that is never claimed is discarded within two hours and cannot be recovered. When you create an account, the files move into your own private storage folder and the report is saved to your account.

If we refuse an upload — because it is not a construction document — the analysis never starts, and the files are discarded on the same two-hour cycle.

To provide the service you asked for — performance of our contract with you.

To keep the service secure, prevent abuse, and meet our legal obligations — our legitimate interests and legal duties.

To contact you about your account or a report. Marketing messages are sent only with consent, and you can withdraw it at any time.

Analysis is carried out with the assistance of third-party AI providers. Document content is transmitted to them for the sole purpose of producing your report, under contracts that prohibit using it to train their models.

Current providers: Google (Gemini) for document analysis, OpenAI for drawing and visual inspection, and Anthropic (Claude) for synthesis of the final report. We will update this list when it changes.

Automated analysis does not produce legal effects for you on its own: a report is information, and every decision that follows it is taken by a person.

Supabase, our hosting, database, authentication and storage provider. Google, where you choose to sign in with it. The AI providers named above. Professional advisers and authorities where we are legally required to disclose.

We do not sell personal data, and we do not share your documents with other customers.

Documents are held in private storage, encrypted in transit and at rest. Access is restricted to your own account at the database level, enforced by row-level security rather than by application code alone. Administrative access is limited and logged.

Our SOC 2 Type II, ISO 27001 and GDPR compliance programmes are in progress. We do not claim any of them as achieved, and we will say so plainly here when they are.

Documents and reports are kept while your account is open, so you can return to them. Delete a project and its files and report are removed from active systems within 30 days, and from backups within 90.

Account and billing records are kept for as long as the law requires after closure.

Subject to the law that applies to you, you may request access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Write to [privacy@congreat.co]; we respond within 30 days.

If you are in the EEA or the UK you may also complain to your supervisory authority. In Israel you may contact the Privacy Protection Authority.

Our providers operate outside your country. Where data leaves your jurisdiction we rely on adequacy decisions or standard contractual clauses, with the safeguards those require.

We set a session cookie that keeps you signed in, and a short-lived cookie that holds an upload until you have an account. Both are necessary for the service to work.

We use Google Analytics to understand how the site is used — which pages people reach, and where they stop. It is switched off until you accept it: on your first visit we ask, and until you agree no analytics cookie is placed on your device. Your IP address is anonymised before it is recorded. We do not use advertising cookies, and we do not share analytics data with advertisers.

You can change your mind at any time, and withdrawing is as easy as agreeing — use the control at the end of this page. Turning it off deletes the analytics cookies from the browser you are using as well as stopping new ones.

Nothing from inside your documents or your report is sent to Google Analytics.

We will post any update here and, where the change is material, tell you before it takes effect.