Privacy Policy

Cakonstruct (“Cakonstruct”, “we”, “us”) provides a web and mobile platform that construction businesses use to manage projects, people, money and materials. This policy explains how we handle personal data when you visit our website, create an account, contact us, or use the platform.

Cakonstruct is used by organisations. Most of the data in the platform is entered by the organisation that uses it, or by people it invites. For that data, the organisation decides what is collected and why, and we process it on its behalf to run the service. For account, billing, security and website data, we decide how it is used. If you are an employee or team member, your employer or organisation can tell you how it uses your data.

Depending on how you use Cakonstruct, the platform may hold the following.

• Account and profile: name, email address, phone number, password (stored as a hash, not in plain text), and optional details such as a profile photo, date of birth, address and occupation.
• Organisation and team: organisation details, members and their roles, invitations and join codes.
• Project and site records: projects, milestones, tasks, documents, photos, progress reports, site diary entries, defect (snag) records, inventory and material requests, quantity surveying and bills of quantities, rate sheets, and carbon assessments and site fuel or delivery logs.
• Finance and payroll records: bank account names and numbers, transactions, invoices, bills, budgets; and for payroll, salary structures, employee bank details, pay periods, payslips and statutory deductions.
• Attendance and location: clock-in and clock-out times and, where you allow it, the GPS coordinates captured at that moment. These are compared with the project location and flagged if they differ.
• Hiring: job postings, and applications including cover letters, résumés and interview schedules.
• Communication: announcements, chat messages and in-app notifications.
• Subscription and payments: your plan, subscription status and payment references. Card details are entered on the hosted checkout page of our payment providers, not on Cakonstruct.
• Contact form: the name, email address, company, topic and message you send us.
• Technical data: IP address, browser or device details recorded with security-sensitive actions such as verification codes, request identifiers, and error and diagnostic logs.

• To create and manage accounts, verify email addresses and sign you in.
• To provide the features of the platform to your organisation, including payroll, attendance, finance, inventory, quantity surveying, carbon assessments, hiring and messaging.
• To process subscriptions and payments.
• To send service messages such as verification codes, invitations and notifications.
• To respond to messages sent through our contact form and to provide support.
• To keep the platform secure, prevent misuse, and investigate problems.
• To maintain and improve the platform.
• To meet legal obligations and to establish or defend legal claims.

Where the law requires a legal basis, we rely on performing our contract with you or your organisation, our legitimate interests in running and securing the service, compliance with legal obligations, and your consent where we ask for it (for example, device location permission).

Within your organisation. What you can see depends on your role in the organisation (owner, super admin, admin, staff, viewer or client). Payslips and attendance records are limited so that team members see their own, while managers can see those of their team.

Cakonstruct personnel. Authorised people on our team may access data where needed to provide support, keep the service secure, and fix problems.

Service providers. We use providers to run the platform. They may process data only to provide their service to us:

• Cloudinary, to store uploaded files and images.
• An email delivery provider, to send verification codes, invitations and notifications.
• Stripe and Paystack, to process subscription payments.
• Google Maps, to display maps and pick or show project locations.
• Error monitoring (Sentry), when enabled. It is configured not to send personal details such as email addresses, IP addresses or cookies.

Legal and business reasons. We may disclose information if required by law or to protect rights, safety or security, and as part of a merger, acquisition or sale of the business.

We do not sell personal data.

Our service providers may process data in countries other than your own. Where the law requires safeguards for such transfers, we use appropriate measures.

We keep personal data for as long as your account or your organisation’s account is active and as long as needed for the purposes in this policy, including legal, accounting and audit requirements.

Some records, such as invoices, transactions, payslips and payroll periods, are designed to be a permanent audit trail and are not deleted individually from the platform. When an account is closed, it is deactivated and we handle the data according to this section and to applicable law.

We use measures designed to protect your data, including:

• Encrypted connections (HTTPS), enforced in production.
• Passwords stored as salted hashes.
• Rate limits on sign-in and verification-code attempts.
• Short-lived access tokens, with refresh tokens that are rotated and revoked on sign-out.
• Access limited by organisation and role.
• A change history on financial and payroll records.

No system can be guaranteed to be completely secure. Please keep your password private and tell us promptly if you think your account has been accessed without permission. If a personal data breach occurs, we will notify affected people and regulators where the law requires it.

We use only what is needed to run the platform:

• Sign-in cookies that keep you signed in. They are not readable by page scripts, and expire after up to 1 day (access) and 7 days (refresh).
• A cookie that remembers whether the dashboard sidebar is open.
• Browser storage that remembers your selected organisation and session state.

These are used to provide the service you request, not for advertising.

Depending on where you live, you may have the right to access your personal data, correct it, request its deletion or restriction, object to certain processing, withdraw consent, receive a copy in a portable format, and complain to your data protection authority.

To make a request, email support@cakale.com. If your data is held in your employer’s or another organisation’s account, we may need to refer your request to that organisation, because it decides how that data is used. We may need to verify your identity, and some records must be kept for legal reasons.

You can withdraw device location permission at any time in your device or browser settings. Attendance features that depend on location may then not work as intended.

Cakonstruct is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. We will post the new version on this page with a new “Last updated” date. Please review it periodically.

Questions about this policy or your data: support@cakale.com or the contact page.