Privacy Policy

At Construction Admin Helper, operated by Boris Jimenez (French sole proprietorship – auto-entrepreneur), we are committed to strict data minimization. Unlike most platforms, we do not use tracking cookies or third-party analytics. We only process personal data strictly necessary to provide our Procore administration services.

1. Information We Collect

We process only the minimum data required for the Service to function.

A. Account Data

• Email address: used for authentication via Procore OAuth and for sending transactional emails and audit reports.
• Procore user ID and Procore company IDs: used to identify permissions and link your account to your Procore environment.
• Procore API rate-limiting metadata: calculated based on the number and timing of recent actions.

B. Audit Logs (Service Usage)

When you perform an action through the Service, we log:

• User email address.
• User IP address and authentication route.
• Timestamps of the action.
• Selection parameters and identifiers of the affected Procore records (e.g. project ID, tool ID, item ID).

Important: We do not store business content. Only item technical identifiers (IDs) and traces of actions are stored for audit, troubleshooting, and security purposes; however company name project name and item type name are stored to display the logs to the user.

2. How We Use Your Information

• Authentication: to verify your identity through Procore OAuth.
• Action execution: to perform the administrative actions you explicitly request.
• Audit trail: to generate and send you detailed logs of executed actions.
• Troubleshooting and support: to investigate incidents and resolve technical issues.
• Usage statistics: to provide you with aggregated usage information based on audit logs.

3. Legal Basis for Processing (GDPR)

We process personal data under the following legal bases, as defined in Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): to provide the Service you subscribed to.
• Legitimate interest (Art. 6(1)(f)): for security, audit logs, troubleshooting, and service improvement.
• Legal obligation (Art. 6(1)(c)): for billing, accounting, and tax compliance.

4. Data Storage and Retention

• Hosting location: databases are hosted in Frankfurt, Germany (EU).
• Audit logs: retained for a maximum of 12 months and deleted automatically or upon request.
• Account metadata: retained for as long as the account remains active.
• Billing and invoices: retained for 10 years to comply with French commercial and tax law.

5. Information Sharing and International Transfers

We do not sell or rent your personal data.

Data may be shared only with the following parties, strictly as required to operate the Service:

• Procore Technologies, Inc.: to execute the actions you trigger via the Service using Procore’s public API.
• Render Services, Inc.: to host the Service infrastructure, including the website, application backend, and databases. Render acts as an infrastructure and hosting provider and may process personal data solely for the purpose of operating and maintaining the Service. Data is hosted in Frankfurt, Germany (EU).
• SendGrid (Twilio Inc.): to deliver audit logs and generated files by email. SendGrid processes data (email address and attachments) on servers located in the United States, based on Standard Contractual Clauses (SCCs).

6. No Cookies and No Tracking

Our website does not use cookies for advertising, tracking, or behavioral analytics. We only use strictly necessary session cookies to manage your authentication and ensure the security of your connection. These include:

Authentication Data: We store your encrypted Procore access_token (including its issuance date created_at and duration expires_in) to maintain your session and allow the Service to interact with the Procore API on your behalf. Identity: Your email address is stored in the session to identify your account while you are logged in. Security (OAuth State): A oauth_state token is used during the login process to prevent Cross-Site Request Forgery (CSRF) attacks.

These cookies are temporary and are essential for the Service to function securely. We do not monitor browsing behavior.

7. Data Security

Authentication relies exclusively on Procore’s OAuth mechanism. We never access or store passwords. Access to internal systems and databases is restricted to a single administrator and protected by multi-factor authentication. Session authentication data stored in cookies are encrypted and transmitted exclusively via secure HTTPS connections.

8. Roles and Responsibilities (Controller / Processor)

For personal data related to user accounts, audit logs, and billing information, Construction Admin Helper acts as a data controller.

For data originating from Procore and processed on behalf of the Customer, Construction Admin Helper acts as a data processor, while the Customer remains the data controller.

No separate Data Processing Agreement (DPA) is provided unless expressly agreed in writing. These Terms of Service and the Privacy Policy constitute the entire data processing agreement between the parties.

9. Your Rights (GDPR)

Under the GDPR, you have the right to access, rectify, erase, and port your personal data, as well as the right to object to certain processing activities.

Please note that certain data (such as invoices) cannot be deleted where retention is required by law.

To exercise your rights, contact support@constructionadminhelper.com. You also have the right to lodge a complaint with the CNIL (France).

10. International Users

The Service is intended for professional users worldwide. By using the Service, you acknowledge that your data is processed within the European Union and, where applicable, transferred to third countries under appropriate safeguards.

11. Contact

Email: support@constructionadminhelper.com
Address: Boris Jimenez (auto-entrepreneur), 58 rue de Monceau, 75008 Paris, CS 48756, France