Terms and privacy

Who we are

B&M Data is a web platform that links a construction project's models with its schedule and costs. For any questions about this document or about your data, write to us at contact@bmdata.com.ar.

There are two different roles. The company that loads data into the platform (its users and projects) is the controller of that data and decides what is loaded and why. B&M Data processes it on the company's behalf, only to provide the service, as data processor (see the Data processing agreement). B&M Data is the controller of demo requests, this site and its own accounts.

What data we process

• Platform account: name, email address, role within the company and, if you add them, job title, phone number and photo.
• Projects: the models that are uploaded (IFC, GeoJSON, LandXML) and the data entered about them: phases, schedule, costs and notes.
• Google Drive, if you connect an account: that Google account's email address, the access permission Google grants when you connect it, the folder you choose and the details of the files in that folder (name, type, size and modification date) at the time you view them.
• Google Calendar, if you enable it: the platform only accesses the calendars it creates in your account, never your primary calendar or any other calendar you already have. From those calendars it reads the events (title, dates and whether they were deleted) to bring into the platform the changes you make in Google.
• Dropbox, if you connect an account: that account's email address, the access permission and the details of the files you choose to use in the platform.
• Acceptance of this document: who accepted it (name and role), their company and the date. We don't store the IP address or browser with the acceptance.
• Technical data: the IP address and masked email in the server's security logs, and technical errors without personal data.
• Platform usage: clicks, journeys and session recordings with text masked (see Analytics in the platform).

We don't collect sensitive data or your device's location.

How we use Google data

Connecting Google Drive and Google Calendar is optional and each user chooses to do it. We use that access only to:

• show the Drive folder you chose and its contents within the platform;
• import into a project the models you choose from that folder;
• save the models uploaded to a project in the folder linked to that project;
• create the calendars you set up from the platform and keep your projects' dates in them (deadlines, phases, schedule, events, milestones and activity);
• bring into the platform the changes you make in those calendars: moved dates and new events, which are saved as project milestones.

We don't sell that data, we don't use it for advertising, we don't use it to train artificial intelligence models and we don't share it with third parties, except with the providers that host the platform and only to provide the service.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it's stored and who can see it

• Data is stored in the platform's database (Supabase) and files in Cloudflare R2. The Google access permission is stored encrypted and is never sent to the browser.
• A Google account connected for the company is visible to that company's team; an account connected as personal is visible only to the person who connected it.
• A company's clients see only the projects assigned to them and have no access to Google Drive or Google Calendar.
• You decide who sees a calendar in Google, from Google Calendar: the platform doesn't share it with anyone.

Providers and international transfer

Data is hosted outside Argentina. We use these providers to deliver the service:

• Supabase (Brazil): database and account access.
• Cloudflare (North America and global network): files and platform delivery.
• Render (United States): platform server.
• Resend (United States): invitation and password recovery emails.
• Sentry (United States): technical errors, without personal data.
• Google and Dropbox: sign-in with Google and the accounts each user or company chooses to connect.

Microsoft Clarity isn't one of our providers in this sense: it processes data on its own account (see Analytics in the platform). If we add or change a provider, we give companies 30 days' notice.

How long we keep data

• Account and profile: while the person is in the company. Anyone who uploaded files stays deactivated, without access, to preserve the project's traceability.
• Project and team change history: while the project or company exists. It includes the name of whoever made each change.
• Acceptance of this document: while the company exists, even if the account is deleted, because it is the proof of acceptance.
• Company leaving the service: 30 days from the cancellation request, so it can export its data. Its projects, files, profiles and accounts are then deleted.
• Technical errors: 30 days. Server logs: a few days.
• Demo requests: while useful for commercial contact, with a yearly review.

Your rights

Under Argentine Law 25,326 you can access your data, rectify it, update it and request its deletion:

• Access: with Descargar mis datos, in Mi perfil. It's free, at intervals of no less than six months unless you show a legitimate interest.
• Rectification: from Mi perfil. To change your email, ask your company's administrator.
• Deletion and objection: ask your company's administrator, since the company is the controller. If you write to us, we forward the request within 2 business days.

The Agencia de Acceso a la Información Pública, the supervisory authority for Law 25,326, handles complaints from anyone whose personal data rights are affected.

How to disconnect and delete

• From the platform, under Google Drive → Desconectar or Google Calendar → Desconectar (Disconnect): the platform stops using that service. If it was the last one connected, the permission is revoked in Google and the saved connection is deleted.
• A calendar created by the platform can be deleted from it (it's also deleted in Google, with its events) or from Google Calendar.
• From your Google account, at myaccount.google.com/permissions, by removing access for B&M.
• To delete your platform account and its data, ask your company's administrator. If you can't, write to us at contact@bmdata.com.ar.

Disconnecting Drive does not delete or change any file in your Google Drive. Disconnecting Calendar does not delete the calendars: they stay in your account with the last data sent.

Cookies and site analytics

On bmdata.com.ar we use Microsoft Clarity to see how the site is used: which sections get read, how far down the page people scroll and where they get stuck. It helps us improve the page; we ask you for no personal data to visit it and there are no forms.

• No cookies: we ask Clarity not to use storage, so it leaves no identifier in your browser and every visit is counted on its own, without recognising earlier ones.
• No advertising: we don't use this data for advertising and we send Microsoft no marketing signals.
• What is recorded: pages viewed, clicks, mouse movement and scrolling, plus your device type, your browser and the approximate country inferred from your IP address. Recordings hide any text typed into form fields; the site has none anyway.

Clarity is a Microsoft service, and Microsoft handles that data on its own account under its privacy statement. If you'd rather your visit wasn't recorded, your browser's tracker blocking is enough. This section covers the bmdata.com.ar site.

Analytics in the platform

Inside the platform we also use Microsoft Clarity, to understand how it's used and improve it. Unlike this site, there it does use cookies (_clck and _clsk) and records the session.

• What's recorded: clicks, journeys, usage events and a recording of the session.
• What isn't: all text is masked before being sent, and the model and map viewers appear blank in recordings.
• No advertising: we don't use this data for advertising.

Microsoft handles that data on its own account, as controller, under its privacy statement. If you'd rather your session wasn't recorded, your browser's tracker blocking is enough.

Changes to this document

If we change it, we'll publish the new version on this page with its update date. If the change is important, we'll ask you to accept it again inside the platform.

What these terms cover

These terms govern the use of B&M Data. By accepting them in the platform you are bound by them. If you use it on behalf of a company, you confirm you are authorized to do so.

Accounts and access

• Each account is personal: don't share your password, and let us know if you think someone got in without permission.
• Each company's administrator manages its users and permissions, and the company answers for what the people it invites do.

Pilot and pricing

During the pilot, commercial terms are agreed with each company. We don't charge anything that hasn't been agreed beforehand.

Usage limits

Each company has a storage and element quota, and there is a maximum size per file. Once the quota is reached, nothing more can be uploaded until space is freed or a larger quota is agreed.

Your content

The models, drawings and data you load belong to your company. You allow us to host, process and display them only as needed to provide the service. You confirm you have the right to load them.

Our property

The platform, its software and the B&M Data brand are ours. They may not be copied, decompiled or resold.

Permitted use

You may not:

• breach the platform's security or test it without authorization;
• try to access another company's data;
• upload malicious software or illegal content;
• overload the service or extract its data automatically.

A tool, not professional judgment

The quantities, costs, schedules and georeferencing shown by the platform are a working aid. Checking them and making the project's technical decisions remains the responsibility of the professionals in charge.

Availability

We do what's reasonable to keep the service running, but it may have interruptions, from maintenance or provider failures, and it is offered as is. Always keep the originals of your files.

Liability

To the extent permitted by law, we aren't liable for indirect damages, loss of profits or losses caused by events beyond our control or by misuse of the service. Nothing here limits rights that the law doesn't allow you to waive.

Suspension and cancellation

We may suspend an account that breaches these terms or puts security at risk. A company can request cancellation at any time at contact@bmdata.com.ar: it has 30 days to export its data, which is then deleted.

Governing law

This document is governed by the laws of the Argentine Republic. If there are differences between languages, the Spanish version prevails.

Parties and purpose

This agreement is between the company using B&M Data (the controller) and B&M Data (the processor), under article 25 of Argentine Law 25,326. It is accepted by an administrator, who confirms being authorized to do so on behalf of the company.

B&M Data processes the personal data the company loads only to provide the service and according to what the company configures, and doesn't use it for any other purpose.

What data it covers

That of the company's users (name, email, role, position, phone and photo), the record of who made each change, and the names appearing in models and documents. The company ensures it has a legal basis for loading them and informs the people concerned.

Confidentiality and security

Those who access the data are bound to keep it confidential. We maintain appropriate technical and organizational measures: data isolated by company, role-based access, encrypted connections and third-party permissions stored encrypted.

Sub-processors

The company authorizes the providers listed in Providers and international transfer. We give 30 days' notice if we add or change one; if the company disagrees, it can request cancellation.

Requests from individuals

We help the company respond to access, rectification, deletion and objection requests. If one reaches us directly, we forward it within 2 business days.

Incidents

If a security incident affects the company's data, we notify its administrator within 72 hours of confirming it, with what happened, what data was affected and what was done.

International transfer

Data is hosted outside Argentina, in the countries listed in Providers and international transfer. By accepting this agreement, the company authorizes that transfer.

Analytics

The platform uses Microsoft Clarity as explained in Analytics in the platform. Microsoft handles that data on its own account, as controller and not as sub-processor. The company knows and accepts this.

Return and deletion

When the service ends, the company has 30 days from the cancellation request to export its data. We then delete its projects, files, profiles and accounts.

Audit

The company can request the information needed to verify that we comply with this agreement, and arrange an audit. Once available, it can receive our SOC 2 report instead.