Legal
The terms Kinetic Build Limited provides Kinetic Project and Kinetic BIM Standard and Kinetic BIM Pro under, and how we handle the data you keep in them.
Draft — not yet legally reviewed. These documents were prepared in-house and describe how the service actually works today, but they have not been reviewed by a lawyer. Don't rely on them as a final statement of your rights, and don't sign a customer up against them until that review has happened.
Privacy Policy
This policy explains how Kinetic Build Limited, trading as Kinetic BIM, handles personal information in Kinetic Project, Kinetic BIM Standard and Kinetic BIM Pro, and our website. It is written to meet the New Zealand Privacy Act 2020, and describes what we actually do rather than what we might one day do.
1. Two different roles
We handle personal information in two distinct capacities, and your rights differ between them:
- As an agency in our own right — for our own business contacts, prospective customers, the people who buy add-in licences, and our own staff. This policy governs that directly.
- On behalf of a customer organisation — everything inside a customer's workspace: their staff, their clients' contact details, their correspondence, their project records. There, the customer decides what goes in and why; we only act on their instructions. Those terms are set out in the Data Processing Addendum. If your details are in a customer's workspace and you want them changed or removed, ask that organisation — we will refer you to them.
2. What we collect
| Category | What it is | Why |
|---|---|---|
| Account details | Name, work email, role, phone number and job title where supplied. | To identify you, sign you in, and apply the right permissions. |
| Work you record | Projects, tasks, drawings, variations, requests, notes, time entries, progress claims, and the files you attach. | This is the service itself — it is the record your organisation is keeping. |
| Correspondence | Emails you forward to the app, and — where a user connects their mailbox — the subject, body, participants and attachments of messages read from it. | So project correspondence can be filed against the job it belongs to. |
| Financial records | Where an organisation connects Xero, invoice records and the contacts on them, matched to projects. | To track what has been claimed and paid against each project. |
| Licence records | Licence keys, the machine fingerprint an add-in is activated on, and purchase details. | To issue and enforce per-seat add-in licences. |
| Technical records | Sign-in times, activity timestamps, and the server logs our hosting and email providers keep, which include IP addresses. | To keep the service secure, diagnose faults, and investigate misuse. |
We collect this information from you directly, from the organisation that gave you access, and — for the mailbox and accounting integrations — from the systems that organisation chooses to connect.
3. Mailbox and accounting integrations
Both are off unless an organisation turns them on, and both are worth calling out because of how much they can carry:
- Mailbox sync. When a user connects their Microsoft 365 mailbox, we read messages from it and store their subject, body, participants and attachments in the app so they can be filed against projects. That may include correspondence with people who have no other relationship with us. Access is by OAuth; we store an encrypted refresh token, never a password, and a user can disconnect at any time.
- Xero. When an organisation connects Xero, we read invoices and the contacts on them so payments can be matched to projects. We do not write to Xero.
4. Cookies and tracking
Kinetic Project sets cookies for one purpose: keeping you signed in. There is no advertising, analytics or third-party tracking in the application, and we do not build behavioural profiles. Clearing the cookies signs you out.
5. Where your information is stored
Our database, authentication records and uploaded files are hosted with Supabase on Amazon Web Services infrastructure in the ap-northeast-2 region (Seoul, South Korea). The application itself is served by Vercel, and transactional email is sent through Postmark, both United States companies. Full detail is in the subprocessor list.
This means personal information is held and processed outside New Zealand. Where we disclose personal information to an overseas provider, we do so on contractual terms requiring them to protect it to a standard comparable to the Privacy Act 2020, as information privacy principle 12 requires. If your organisation needs data resident in a particular country, tell us before you sign up — it is a question of where the project is provisioned, and it cannot be changed casually afterwards.
6. Who else sees it
We share personal information only:
- with the subprocessors listed on the subprocessor page, each for the stated purpose;
- within the customer organisation whose workspace holds it, according to the permissions that organisation sets — including with the clients they invite into the client portal;
- where you ask us to;
- where the law requires it, or to establish or defend a legal claim. If we are compelled to disclose a customer's data, we will tell them unless we are legally barred from doing so.
We do not sell personal information, and we do not use it to train machine-learning models.
7. How we protect it
- Every record carries the organisation it belongs to, and database-level row security policies enforce that boundary on every query — not application code that could be bypassed.
- There are no passwords to steal: sign-in is by single-use emailed link or code.
- Data is encrypted in transit (TLS) and at rest by our hosting provider.
- Mailbox refresh tokens are additionally encrypted by us with AES-256-GCM before storage, and are readable only by the server.
- Cross-tenant isolation is tested with an automated suite that attempts to read one organisation's data from another and asserts that every attempt fails.
- Access to production systems is limited to those who need it.
No system is perfectly secure. If we suffer a privacy breach that is likely to cause serious harm, we will notify the affected people and the Office of the Privacy Commissioner as the Privacy Act 2020 requires, and any affected customer organisation without undue delay.
8. How long we keep it
- Customer workspace data is kept for as long as that organisation's subscription runs, then deleted on the timetable in the Terms of Service — an export available for 30 days after the agreement ends, deletion from the live service within a further 30 days, and backup copies removed as those backups age out (we keep the most recent 90 nightly backups, so within about three months).
- Our own business records — invoices, tax records and correspondence — are kept for at least seven years, as New Zealand tax law requires.
- Technical logs are kept for the retention period of the provider that holds them, which is short — days to weeks.
9. Your rights
Under the Privacy Act 2020 you can ask us for the personal information we hold about you, and ask us to correct it if it is wrong. We will respond within 20 working days. There is normally no charge.
If you are in the United Kingdom or the European Union, you may also have rights to erasure, restriction, portability and objection under the UK GDPR or GDPR. Where those apply to information we hold as an agency in our own right, we will honour them.
For information inside a customer's workspace, we act on that organisation's instructions and will pass your request to them.
To make a request, email bim@kineticbuild.co.nz.
10. Complaints
Raise it with us first at bim@kineticbuild.co.nz — most things are a misunderstanding we can fix quickly. If you are not satisfied, you can complain to the Office of the Privacy Commissioner in New Zealand, or to your own supervisory authority (in the United Kingdom, the Information Commissioner's Office).
11. Changes to this policy
We will update this page when our practices change, and the effective date at the top will change with it. For a change that materially affects how we handle personal information, we will notify customer organisations by email.
12. Contact
Kinetic Build Limited, 29 Grivelle Street, Kumeu, Auckland 0810, New Zealand. Privacy enquiries: bim@kineticbuild.co.nz.