Privacy Policy
How Trustline Builds collects, uses, and protects your personal data.
Our commitment. Trust is our product, and that extends to your data. We collect only what we need to operate a construction-oversight platform, we are transparent about how we use it, and we hold it on industry-standard, GDPR-aligned infrastructure. This policy explains your rights and how to exercise them.
1. Introduction & Scope
This Privacy Policy explains how Trustline Builds Limited, which operates the Trustline Builds platform (“we”, “us”, “the Company”), collects and processes personal data when you use the Trustline Builds platform (the “Platform”). It applies to Clients, Contractors, Inspectors, Suppliers, administrators, and website visitors.
Because our Clients are often members of the diaspora in the United Kingdom, the European Union, the United States, Canada, and elsewhere, while construction takes place in Ghana or Nigeria, we handle personal data across borders. We aim to meet the standards of the Ghana Data Protection Act, 2012 (Act 843), the Nigeria Data Protection Act, 2023 (NDPA) for data relating to Nigerian projects, and, where applicable, the EU and UK General Data Protection Regulation (GDPR).
2. Who We Are (Data Controller)
The data controller is Trustline Builds Limited, [registered address ●]. For any privacy matter, contact us at [[email protected]] / [email protected]. [If a Data Protection Officer or a registered Data Controller with the Ghana Data Protection Commission is appointed, insert details here ●.]
3. Information We Collect
We collect the following categories of personal data, depending on your role and how you use the Platform:
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email, phone number, role, preferred display currency. | You, at sign-up / brief submission. |
| Contractor verification | National identity document (Ghana Card in Ghana; NIN in Nigeria) — number and images, business/registration/tax IDs, professional licences, certifications, references, portfolio. | Contractors, during onboarding. |
| Project information | Project brief, location/address, GPS coordinates, budget, timeline, project communications. | Clients and Contractors. |
| Site media & evidence | Photographs and videos, plus their metadata: GPS latitude/longitude/altitude, positional accuracy, capture date/time, device make/model, integrity hash (SHA-256), and verification result. | Captured on site by Contractors / Inspectors. |
| Inspection records | Inspector name, inspection date, progress, quality assessment, issues, recommended actions. | Inspectors / administrators. |
| Financial & procurement | Milestone and funding-request details, supplier details, payment proofs and references, amounts. We do not store full bank card numbers. | Clients, Contractors, administrators. |
| Usage & technical | Sign-in events, in-app notifications, audit-log entries, session cookies, IP-derived information, and device/browser data. | Automatically, as you use the Platform. |
4. Site Photographs & Location Data — A Closer Look
Verified site photography is central to the Platform. When a photo is captured for a project, we collect and store its location and timing metadata, the capturing device’s details, and a cryptographic hash, and we compute how far the photo was taken from the registered project site. We use this strictly to verify the integrity and provenance of construction evidence — that a photo was genuinely taken at the site and not altered or reused. We do not use this location data to track individuals’ movements for any other purpose.
5. How We Use Your Information
- To create and administer your account and provide the Platform’s oversight, inspection, and procurement services.
- To verify Contractors and the integrity of uploaded evidence.
- To coordinate milestones, procurement, and the recording and verification of payments.
- To send service communications — notifications, inspection alerts, onboarding, and payment-related messages.
- To maintain an immutable audit trail for accountability, compliance, and dispute resolution.
- To secure, maintain, and improve the Platform, and to detect and prevent fraud and abuse.
- To comply with legal obligations and enforce our Terms.
No sale of data. We do not sell your personal data, and we do not use it for third-party advertising.
6. Legal Bases for Processing
Where the GDPR / UK GDPR applies, we rely on: performance of a contract (to provide the Platform); legitimate interests (to secure and improve the service, prevent fraud, and maintain records balanced against your rights); legal obligation (to meet regulatory and accounting duties); and consent where specifically requested (which you may withdraw). Under the Ghana Data Protection Act, 2012, we process data fairly and lawfully for the purposes described and with your knowledge.
7. How We Share Data & Our Sub-Processors
We share personal data only as needed to operate the Platform: between the parties to a project (e.g. a Client sees verified evidence relating to their own project), and with the carefully selected service providers below, who process data on our behalf under contract.
| Sub-processor | Purpose | Location / Note |
|---|---|---|
| Clerk | Authentication (secure email sign-in links). | SOC 2 Type II certified; no passwords stored. |
| Supabase (PostgreSQL) | Primary database / system of record. | EU region hosting (AWS EU-West). |
| Cloudflare R2 | Storage and global delivery of photos, videos, and documents. | Global CDN; access via the Platform only. |
| Resend | Transactional email (alerts, onboarding, payment notices). | GDPR-compliant email provider. |
| Exchange-rate provider | Live currency conversion for display. | Rates only; no personal data shared. |
| Hosting / infrastructure | Application hosting (containerised deployment). | Cloud infrastructure under contract. |
We may also disclose data where required by law, to protect rights and safety, or in connection with a corporate reorganisation or transfer to an affiliate or successor entity. [Maintain a current sub-processor list and data-processing agreements with counsel.]
8. International Data Transfers
Operating across the diaspora and Ghana means your data may be transferred between Ghana, Nigeria, the EU/UK, and other countries. Where data is transferred out of the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision. Our primary database is hosted in the EU, and media is served through a global content-delivery network. [Confirm the specific transfer mechanisms with counsel.]
9. Data Retention
We keep personal data for as long as needed to provide the Platform, to maintain the integrity of the project record, and to meet legal, accounting, and dispute-resolution requirements. Consistent with the Platform’s accountability model, certain records — including audit logs and verified project evidence — are not hard-deleted; corrections are made by adding new, attributed, versioned entries rather than erasing the original. This may affect how erasure requests are handled (see Your Rights). When data is no longer needed, it is deleted or anonymised.
10. How We Protect Your Data
- Passwordless authentication. Secure email sign-in links via Clerk; no passwords for us to lose.
- Role isolation. Access is segregated by role so users see only the data relevant to them.
- Encrypted, reputable infrastructure. Data is hosted on EU-region, industry-standard providers; media is stored on a secure global network, not a public server.
- Immutable audit trail. Significant actions are logged with actor and timestamp.
- Least privilege & no personal data in URLs. Internal access is limited, and personal data is not placed in web addresses.
No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data.
11. Your Rights
Subject to applicable law (the Ghana Data Protection Act and, where relevant, GDPR / UK GDPR), you may have the right to:
- Access the personal data we hold about you and request a copy.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data, subject to our legal and record-keeping obligations and the versioned-record model described above.
- Object to or restrict certain processing, and withdraw consent where processing is based on consent.
- Request portability of data you provided, where applicable.
- Lodge a complaint with a supervisory authority — the Data Protection Commission of Ghana, or your local authority (e.g. the UK ICO or an EU data-protection authority).
How to exercise. To exercise any right, contact us at [[email protected]] / [email protected]. We may need to verify your identity before responding.
12. Cookies & Similar Technologies
We use a small number of cookies and similar technologies that are necessary to operate the Platform — principally the secure session cookie used for sign-in. We do not use advertising cookies. [If any analytics or non-essential cookies are added, update this section and provide a cookie banner/consent mechanism.]
13. Children
The Platform is intended for adults (18+) and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by email, and the effective date above will be updated.
15. Contact Us
For privacy questions or to exercise your rights, contact: Trustline Builds Limited, [[email protected]] / [email protected], +233 55 057 5987, [registered address ●]. [Insert Data Protection Officer / Ghana Data Protection Commission registration details, if applicable.]