Privacy Policy
Last updated: August 2026
1. Introduction
tectm ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our construction contract administration platform.
2. Information We Collect
We collect information that you provide directly to us, including:
- Account information (name, email address, organisation name)
- Enquiry details submitted through our website forms (name, company, email address, phone number, and your message), together with a record of the consent wording shown to you and when you agreed to it
- Project and contract data you upload or enter, including contract documents, dockets, variations, payment claims and rate cards
- Communications you send to us
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Send you technical notices, updates, and support messages
- Respond to your comments, questions, and requests
- Contact you by email and phone about tectm and its products, where you have given us your details for that purpose
- Monitor and analyse trends, usage, and activities
4. Who Else Processes Your Data
tectm runs on services operated by other companies, and some of them receive your content. They are named below, with what each one actually receives and where it is processed. This list is the whole list.
| Provider | What we use it for | What it receives | Where it processes |
|---|---|---|---|
| Supabase | Database, authentication and file storage: the platform tectm runs on | All customer data at rest: every project, contract, docket, claim and variation, every uploaded document and photo, and your account details | Australia (AWS ap-southeast-2, Sydney) |
| Vercel | Application hosting, plus website analytics and performance monitoring | Any data the application handles while serving a request, in transit; Vercel does not store that. It does store visitor analytics for every page view: the page visited, the referring site, your device and browser, and page performance timings. Those carry no account or project data. | Australia (Sydney, syd1) for application code. Static pages and assets are delivered from a global edge network, and analytics are processed outside Australia. |
| Anthropic (Claude) | Contract review, document data extraction, and letter drafting | The text of contracts and documents you submit for analysis, and the prompts and instructions sent with them | United States. Australian inference is pending, not live. |
| OpenAI | Embeddings: turning contract text into vectors so the contract can be searched | Passages of contract text, sent in batches to be embedded | United States. OpenAI offers Australian storage but no Australian processing option at any price. |
| Sentry | Error monitoring and session replay | Error reports with stack traces, the URL and the account and organisation the error happened in, and your IP address. It also records session replays, about one in twenty sessions plus every session in which an error occurs. Replays mask text by default, so a recording shows layout and interaction rather than the words on screen. | Outside Australia |
| Resend | Sending email: sign-in links, invitations, notifications and password resets | The recipient email address and the contents of the message sent to them | Outside Australia |
| Attio | Customer relationship management for enquiries sent through this website | The name, company, email address, phone number, subject and message you submit in the website enquiry form, and a tag recording that the enquiry came from the website. No project or contract data reaches it. | Outside Australia |
| OpenFreeMap | The basemap under the project map: the streets and labels your site pins sit on | Your browser fetches map tiles directly from OpenFreeMap, so it sees your IP address and which part of the world you are looking at. On a project map, that is where your sites are. Nothing else is sent: no account, project, docket or contract data, and no site names. The pins, their counts and their labels are drawn by tectm on top of the tiles and never leave your browser. | Outside Australia |
| Australian Business Register (ABR) | Looking up a company name and GST status from an ABN you type, so you do not have to enter them by hand | The eleven-digit ABN you type, and nothing else. No account, project or contract data is sent with it, and the register only ever answers with public information about that ABN. | Australia (an Australian Government register) |
Contract review, document extraction and letter drafting send document content to Anthropic and OpenAI, which means that content is processed outside Australia. Neither provider uses it to train their models. If you would rather your documents were not processed this way, contact us and AI features can be disabled for your organisation.
We do not add a provider to this list quietly: the list is checked against the code by an automated test, so a new service that touches your data cannot ship without appearing here.
5. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Data is encrypted in transit and at rest, and every table holding customer data is protected by row-level security so your organisation's data is isolated from every other organisation's.
6. Where Your Data Is Stored
Your project data, contract documents and uploaded files are stored in Australia, in Sydney, and the application code that reads and writes them runs in Sydney too. Some processing still happens outside Australia, and section 4 says exactly which: the AI providers process document content in the United States, error monitoring and email are handled offshore, and static pages are delivered from a global edge network.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. If you wish to cancel your account or request that we no longer use your information, please contact us.
8. Data Sharing
We do not sell your personal information, and we do not share it with anyone beyond the providers named in section 4. Those providers are bound by contractual obligations to keep personal information confidential and to process it only on our instructions. We will also disclose information where the law requires it.
9. Your Rights
You have the right to:
- Access your personal information
- Correct inaccurate or incomplete information
- Request deletion of your information
- Export your data in a portable format
- Opt-out of marketing communications
10. Cookies
We use cookies and similar tracking technologies to track activity on our platform and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
12. Enquiries and Marketing Communications
When you submit an enquiry through our website, you are asked to agree that we may contact you by email and phone about tectm and its products. We store the exact wording of that agreement alongside your details, so there is a record of what you consented to at the time.
If you are new to us, that enquiry also adds you to our mailing list, and you will receive a short series of introductory emails over the following days explaining what tectm does. These are sent automatically. Getting in touch again later does not start the series over.
Every marketing email we send includes an unsubscribe link, and unsubscribing takes effect for all future marketing email. If you would prefer not to receive phone calls, tell us and we will note it against your record. Unsubscribing from marketing does not stop service messages you need, such as an invitation to join a project or a notification about your account.
We use a third-party email provider to send and manage these communications, and a customer relationship management provider to keep track of who we are talking to. Both are bound by the confidentiality obligations described in section 8. We do not sell your details or share them for anyone else's marketing.
13. Contact Us
If you have any questions about this Privacy Policy, please .