Privacy policy. How we handle personal data.
For the forbuilders app at app.forbuilders.in, written for Indian law including the DPDP Act, 2023.
Last updated: 17 October 2026 · Effective from: 17 October 2026
The same text is published in the app at app.forbuilders.in/privacy.
This policy is written for Indian law: the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules", being brought into force in phases up to 13 May 2027), the Information Technology Act, 2000 and the rules under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Where these laws set different standards, we follow the stricter one.
1. Who we are
forbuilders (the "Service", at app.forbuilders.in) is a construction-management application operated by Revealio Quantlab Private Limited (CIN U62099TZ2026PTC038350), a company incorporated in India with its registered office at 48 Subramaniyam Street, Cheran Nagar, Modachur, Gobichettipalayam, Erode District, Tamil Nadu 638476, India ("we", "us", "our").
This policy explains what personal data we process, why, how long we keep it, who we share it with, and the rights you have. It is available in English; you may ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to the contact in section 11.
2. Two roles we play — please read this first
| Whose data | Our role under the DPDP Act | Who decides how it is used |
|---|---|---|
| Your account data (people who sign in to forbuilders) | Data Fiduciary | We do, as described in this policy |
| Data your company enters about other people — workers, staff, clients, vendors, subcontractors (names, phone numbers, wages, attendance, site photos, etc.) | Data Processor acting for your company | Your company (our customer) is the Data Fiduciary for that data |
If you are a worker, client or vendor whose details were entered by a construction company that uses forbuilders, please contact that company first to exercise your rights; we will help them respond.
3. Personal data we process
a. Account data — name, email address, mobile number (once verified), password (stored only as a one-way hash; we never see it), your Google account name, email and account ID if you choose "Continue with Google", your role in each company, and whether your email or phone is verified.
b. Security data — IP address, browser and device description, sign-in times and a sign-in history, the devices where you are signed in, one-time-code requests, trusted-device records and a log of important actions (for example approvals, permission changes, exports and backups). Used only to keep accounts and company data secure.
c. Company records you or your team enter — projects, parties, payments, invoices and bills (including GSTIN and PAN), attendance and wages, materials, purchase orders, work orders, BOQ, daily reports, tasks, approvals and documents.
d. Photos and files you upload (for example site photos and bills).
e. Location — only when a user taps "Punch in/out" or "Use my location": the device's GPS position at that moment, to record attendance at a site. We never track location in the background.
f. Communications — the emails we send you (one-time codes, security alerts, daily summaries, backup alerts) and records of their delivery.
g. Data on your own device — to work offline, the app keeps your session and recently viewed data in your browser's storage on your device. Signing out removes company data from the device (entries waiting to sync stay until they sync or you discard them).
h. Invitations — when a company Owner invites you, we hold what the Owner entered before you have agreed to anything: your email address, the name the Owner typed (if any), the role and projects offered, and the invitation's progress (opened, email confirmed, how many wrong confirmation codes were tried). We use it only to deliver the invitation and to let you accept or decline it. You can see it in Download my data.
i. Consent records — each time you accept the Terms of Service or this policy: which version you were shown, the wording you ticked, when, how (sign-up, invitation, update), and the IP address and browser used. We keep this as proof of your consent, as section 6(10) of the DPDP Act requires.
Cookies and tracking. The app does not use cookies to identify you; it signs you in with a token kept in your browser's storage. We do not use advertising or analytics cookies or third-party tracking, we do not sell personal data, and we do not use your data to train artificial- intelligence models.
4. Why we process it, and the legal basis
| Purpose | Data | Basis under the DPDP Act |
|---|---|---|
| Create and run your account; sign-in; one-time codes; trusted devices | a, b | Your consent when you register or sign in, and the legitimate use of a service you asked for |
| Provide the Service to your company (records, approvals, reports, documents, backups) | c, d, e | Done on your company's instructions (we act as its Data Processor) |
| Security, fraud prevention, abuse limits, activity logs | b | Legitimate use for safeguarding the Service and your data |
| Invitations: delivering an Owner's invitation and recording your answer | h | Done on the inviting company's instructions (as its Data Processor) until you accept or decline |
| Proving that, and to what, you consented | i | Compliance with law (section 6(10) of the DPDP Act) |
| Daily summary and alert emails | a, f | Your consent — switch daily summaries off in Settings or use the unsubscribe link at any time |
| Backups to your company Owner's Google Drive | c, d | Your company Owner's instruction; only what the Owner selects |
| Legal compliance (for example lawful requests from authorities) | as required | Compliance with law |
You may withdraw consent at any time in Settings or by writing to us. Withdrawing is as easy as giving consent. It does not affect processing already done, and some features may stop working. Where available under the DPDP Rules, you may also give, manage and withdraw consent through a registered Consent Manager.
5. Google sign-in and Google Drive
If you choose "Continue with Google" we receive your Google account's name, email address and account ID, and use them only to sign you in and to link your forbuilders account. If your company's Owner turns on Google Drive backup, the app asks for permission to create files in that Google Drive and uses it only to save the backup files and reports your company chooses. The app can open only files it created or that you pick; it cannot read the rest of the Drive. The access token from Google is stored encrypted and can be removed at any time in Settings (or in your Google account's security settings).
forbuilders' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no person reads it unless you ask us to (for support), it is needed for security, or the law requires it.
6. Who we share data with (processors)
We share personal data only with service providers that process it on our behalf under contract:
| Provider | What for | Where |
|---|---|---|
| Microsoft Azure (Microsoft Corporation (India) Pvt Ltd / Microsoft Corporation) | Hosting, database, file storage, email delivery | India (Central India region) |
| Cloudflare, Inc. | Domain name service, secure connection (HTTPS) and attack protection for our website | Global network; traffic passes through its nearest location |
| Google LLC | "Continue with Google" (if you choose it) and backups to your company's own Google Drive (if your Owner turns it on) | Google's infrastructure, under your Google account's terms |
We will update this table before we add any new provider (for example an SMS provider for one-time codes). We may disclose data if Indian law, a court order or a lawful government request requires it, or to protect the rights, property or safety of users and the public. We do not transfer personal data to any country that the Government of India restricts under section 16 of the DPDP Act.
7. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account is active. When you delete your account, your name, email, phone, password and Google link are erased from our live systems at once — including from every invitation sent to your address (records you created inside a company stay with that company, shown as "Deleted user") |
| Invitations | While open (a link works for up to 7 days), then 90 days after the invitation was accepted, declined, withdrawn or expired; then deleted |
| Consent records | While the consent is in force, then 3 years after it ends (replaced or withdrawn, or your account deleted), then deleted. When you delete your account they no longer carry your name, email, IP address or browser |
| Company records, photos and files | While your company uses the Service. When an Owner closes the company, everything stays available to Owners for export (or to reopen) for 30 days, then is permanently deleted. Your company is responsible for any longer retention it needs, for example GST and tax records |
| Security and sign-in logs | 1 year |
| Change history of company records | Kept with those records for as long as the company keeps them |
| One-time-code records | Codes expire after 5 minutes; the records are deleted after 30 days |
| Email delivery records | 1 year |
| Signed-out or expired trusted-device records | 30 days |
| Backups and recovery copies (database, photos and files — for disaster recovery and undoing mistakes) | Up to 35 days, rolling — deleted data, including deleted photos and files, disappears from them within this time |
| Backups in your company Owner's Google Drive | Controlled by your company (kept in its own Drive); the Owner chooses how many daily backups to keep |
When we no longer need personal data for its purpose, we erase it, as section 8(7) of the DPDP Act and the DPDP Rules require.
8. How we protect data
Encryption in transit (HTTPS, TLS 1.2 or higher) and at rest; secrets kept in a key vault; a private network for the database; role-based access with per-project permissions; one-time codes for sensitive actions; a one-time code to confirm every account on a new device; activity logs; tested backups; and staff access on a need-to-know basis. No method is perfectly secure, but we maintain reasonable security safeguards as required by section 8(5) of the DPDP Act, the DPDP Rules and section 43A of the Information Technology Act, 2000.
Personal data breach. If a breach affects your personal data, we will inform you and the Data Protection Board of India without delay, and send the Board a detailed report within 72 hours of becoming aware of it (or such longer time as the Board allows), as the DPDP Rules require; we will also report to CERT-In where the law requires. Where we act for your company, we will tell your company promptly so it can meet its own obligations.
9. Your rights (sections 11–14 of the DPDP Act)
You have the right to:
- Access a summary of the personal data we process about you and how we process it — use Settings → Your data → Download my data;
- Correct, complete or update your personal data — in Settings, or by writing to us;
- Erase your personal data — use Settings → Your data → Delete my account (if you are the only Owner of a company that has other members, first make someone else an Owner or close the company);
- Withdraw consent (see section 4);
- Grievance redressal (see section 11);
- Nominate another person to exercise your rights in the event of your death or incapacity.
Company Owners can also download a complete export of their company's data, or close the company, in Settings. We respond to requests within the time the law requires, and in any case within 90 days. We may need to confirm your identity first.
10. Children
forbuilders is a business tool for adults. We do not knowingly process the personal data of anyone under 18. If you believe a child's data has been entered, contact us and we will delete it (unless the customer company must keep it by law, in which case that company must obtain verifiable parental consent).
11. Contact, Grievance Officer and the Data Protection Board
Grievance Officer: Dinesh Kumar, Revealio Quantlab Private Limited
Email: grievance@forbuilders.in
Address: 48 Subramaniyam Street, Cheran Nagar, Modachur, Gobichettipalayam, Erode District, Tamil Nadu 638476, India
For privacy questions and requests about your data, write to privacy@forbuilders.in; for anything else, contact@forbuilders.in. We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after first using our grievance process, as the DPDP Act provides.
12. Changes to this policy
We will tell you in the app or by email before a material change takes effect. The "Last updated" date above shows the current version.