Privacy Policy

Effective date: 26 October 2026

Casametrica (“we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data when you use the Casametrica platform, including our website, applications, and related services (the “Service”).

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Portuguese data protection legislation.

1. Data Controller

The data controller responsible for your personal data is Casametrica. For any privacy-related enquiries, please contact us via our contact form.

2. Personal Data We Collect

2.1 Account Data

When you create an account, we collect:

  • Full name (first name, middle name, and last name);
  • Email address;
  • Password (stored in hashed form — we never store plain-text passwords);
  • Preferred language (English or Portuguese).

If you register or sign in using a third-party provider (Google, LinkedIn, or Apple), we receive your name and email address from that provider. We do not receive or store your third-party password.

2.2 Project and Construction Data

When you use the Service to manage a construction project, we process:

  • Project name and physical location;
  • Builder company name and contact email;
  • Bill of Quantities (BoQ) spreadsheets you upload (Excel, CSV, or ODS files);
  • Builder invoices you upload for each billing period;
  • Extracted line items including codes, descriptions, quantities, and prices;
  • Construction schedules and payment milestones.

2.3 Project Notes and Photographs

When you document site visits, we may collect:

  • Note titles and descriptions;
  • Photographs you upload;
  • Geolocation coordinates (latitude and longitude) if you choose to attach location data;
  • Photo capture timestamps.

Geolocation data is optional. You can create project notes without providing location information.

2.4 Digital Signature Data

When you or another party signs a dossier through the Service, we collect:

  • Full legal name of the signatory;
  • NIF (Número de Identificação Fiscal / Tax Identification Number);
  • Signature timestamp;
  • Certificate information from the Chave Móvel Digital (CMD) service.

2.5 Audit Logs

We automatically log significant actions performed on the platform, including the action type, the user who performed it, the affected entity, a timestamp, and relevant metadata. Audit logs are maintained to ensure transparency and accountability in the construction auditing process.

2.6 Design Projects

When you use design projects in Atelier, we process:

  • design-project names, creator identifiers, members and roles; documents’ discipline and phase (or name for Other documents); revisions’ numbers, optional notes, suggested discipline and phase, upload times, uploader identifiers and upload status;
  • for hidden revisions and deleted projects: identifiers of who acted, when, any hiding reason and restore deadlines; histories of hiding, deletion and restores with actor identifiers, times and any hiding reason; audit entries (2.5) for these actions, for invites sent, used to enter as a guest, accepted and revoked, and for members leaving, being removed or having their role or client status changed;
  • ended memberships, with their role, client status, end date and reason, and account identifier until account deletion;
  • invites: the invited email address, the role and client status offered, the identifier of who sent the invite, when it was sent and when it expires, and, for each invite link, when it was issued, when it expires and when it was used, with only a hash of the link itself. When an invite ends, its email address is removed from it;
  • guests: the name a guest gives when entering, and, for each entry, when the guest access starts and ends and whether the guest left, with only a hash of the guest’s token. A guest’s annotations, page and cursor carry an identifier of their invite instead of an account;
  • accounts registered from an invite: that the account came from a design-project invite and, if accepting an invite approved it, the identifier of who sent that invite;
  • revision PDFs, file names, sizes and upload times, including personal data in drawings, such as names and addresses in title blocks. Atelier reads PDF text in your browser to suggest discipline and phase; that extracted text is neither sent to us nor stored;
  • notes, shapes, pen strokes and comments (“annotations”), with author identifiers, and recent-change records that keep members’ views up to date;
  • while a revision is open, your page and cursor position, shared with members connected to it, and an indication when you edit a note.

Convex stores project, membership, invite, guest-access, document, revision, history and audit records, including PDF file names after upload confirmation and unfinished-upload discard times. Cloudflare stores PDFs, their metadata and uploader identifiers, and annotations.

Members and support staff can access documents and revisions; members see each other’s names. Unconfirmed uploads are visible only to their uploaders and support staff acting read-only in an uploader’s support session. Uploaders, project admins and support staff can hide confirmed revisions. Other members retain access to the revision number, creation time, hider identifier, hiding time, reason and restore deadline. For 30 days, only the hider can restore it; a hider who is a member can open it read-only. Leaving or account deletion ends this window. Members can leave while others remain; only the last member can delete a project. Deletion blocks everyone’s access to its contents. The deleter still sees its name, deletion date and restore deadline in Recently deleted and can restore it within 30 days, unless they delete their account. Hiding and deletion block the affected users’ access, including PDFs and annotations, normally at once and within five minutes at the latest; leaving blocks the departing member within five minutes. Design projects and annotations are optional; a PDF is needed to review a revision.

Project admins can invite people by email, including people who don’t have a Casametrica account. While Atelier is in private testing, only our support staff send invites, and only to test addresses we keep. The invite email names the role offered, not the project or who sent it. Its link works once, for 48 hours; the invited person can ask for a new link, which works once, for 15 minutes, and is sent only to the invited address. An invite lasts 30 days. Whoever opens a valid invite link sees the invited address masked (for example a•••@example.com) and can learn whether their browser is signed in to the Casametrica account with that address. Members see pending invites, with the address shown in full to admins and masked to others. Admins can change members’ roles and client status, remove members and revoke invites; when an admin is removed, demoted or leaves, the invites they sent stop working at once. Removing a member blocks their access within five minutes. To limit abuse, we count invite emails per invite, per invited address and per IP address, and invite-page requests per IP address; these counters hold a hash of the address and of the IP address, not the address itself.

Someone invited at an address without a Casametrica account can enter as a guest from the invite page, giving a name. That uses the link and lets that browser open the one project for up to 24 hours, never past the invite’s 30 days, as at most an editor and without uploading. Members and the project’s other guests see the guest’s name marked “(guest)” on their annotations and beside their cursor, and members also see it among pending invites; the name stays on those annotations after the invite ends, until 30 days after the invite was sent, or until the project is erased if that comes first; then we erase it, unless the guest accepted the invite. A guest sees the names of the project’s members and other guests on its revisions. The guest can leave, which ends that browser’s access; revoking the invite, or the admin who sent it being removed, demoted or leaving, ends it at once, and on an open revision within five minutes. Entering and fetching guest access count towards the invite-page limit per IP address, and we count guests’ requests to open revisions per hash of the guest token and per hash of the IP address.

Someone invited at an address without an approved Casametrica account can register from the invite page. That creates an account for the invited address, waiting for approval, unless it already has one, and emails the address a link to choose a password; the link works for one hour, and choosing a password through it confirms the address. Anyone holding a valid invite link can start this, but only the invited address receives the link, and registering counts towards the invite-email limits. An account registered this way that is still waiting for approval, and whose address nobody has confirmed, is deleted 30 days after it was registered, unless a construction project already names it. A confirmed account waits for approval like any other. Once logged in, the person can accept the invite, giving whichever of their name and their account type (homeowner or professional) their account doesn’t have yet. Accepting makes them a member of the project and, if their account is still waiting for approval, approves it for our private beta, recording who sent the invite; it never approves anyone as a professional. While Atelier is in private testing, an invited account at one of those test addresses, with a confirmed email, can then use Atelier. Annotations made as a guest stay under the guest’s name.

3. How We Use Your Data

We process your personal data for the following purposes:

  • Providing the Service — to create and manage your account, process your uploaded documents, perform AI-assisted reconciliation, generate dossiers, facilitate digital signatures, and display design projects’ revisions so that their members can review drawings, add annotations and discuss them;
  • Communication — to send you important information about your account, service updates, and responses to your enquiries;
  • Security and fraud prevention — to protect the Service, detect unauthorised access, and maintain audit trails;
  • Legal compliance — to comply with applicable laws and regulations, including responding to lawful requests from authorities;
  • Improvement of the Service — to analyse usage patterns and improve the platform’s functionality and user experience.

4. Legal Bases for Processing

We process your personal data based on the following legal grounds:

  • Performance of a contract (Article 6(1)(b) GDPR) — processing necessary to provide the Service you requested;
  • Legitimate interests (Article 6(1)(f) GDPR) — processing for security, fraud prevention, service improvement, maintaining audit trails, keeping a deleted member’s annotations in the shared project record (see Section 7), emailing an invite to someone a design-project admin chose to invite, who may not have an account (see Section 2.6), letting an invited person without an account take part in that design project as a guest, under the name they give (see Section 2.6), creating an account for an invited address when someone registers from its invite page, recording who sent the invite through which an account was approved, so that the accounts one person admitted can be found and reviewed (see Section 2.6), and cookieless product analytics that do not link activity across sessions. Where we act as controller, we also rely on legitimate interests in enabling shared project reviews to process personal data about people who are not parties to our service contract, such as people named in drawings, where necessary and after balancing their rights;
  • Legal obligation (Article 6(1)(c) GDPR) — processing required to comply with applicable laws;
  • Consent (Article 6(1)(a) GDPR) — where applicable, such as for optional geolocation data collection. You may withdraw consent at any time.

5. Third-Party Services and Data Processors

We share your data with the following third parties only as necessary to provide the Service:

  • Convex — our backend infrastructure provider that hosts the database and file storage. Uploaded documents, photographs and generated PDFs are stored on Convex infrastructure, except design-project PDFs and annotations, which are stored with Cloudflare;
  • Axiom — processes our server logs on our behalf. These logs record the operations our servers run and the errors they encounter, and can include identifiers of your account, projects and documents. They are stored in the European Union (Frankfurt, Germany);
  • Cloudflare (Cloudflare, Inc., United States) — processes design-project PDFs and annotations, and the counters that limit guests’ requests to open revisions, on our behalf under a data processing agreement meeting Article 28 GDPR. Design-project PDFs (Cloudflare R2) and annotations (Cloudflare Durable Objects) are stored in Cloudflare’s European Union jurisdiction. Design-project PDFs are downloaded to your browser and drawn on your device; we do not convert them on our servers;
  • Resend — sends our emails on our behalf, such as sign-in and password emails and design-project invites. It receives the recipient’s email address and the email’s content, including any link in it, also when the recipient has no account with us. It stores the emails and their delivery logs in the United States for 30 days;
  • Chave Móvel Digital (CMD) — the Portuguese government digital signature service. When you sign a dossier using CMD, your name, NIF, and the document hash are transmitted to CMD for signature validation;
  • OAuth providers (Google, LinkedIn, Apple) — if you choose to sign in with a third-party account, authentication data is exchanged with that provider;
  • AI processing services — we may use third-party AI services to assist with document reconciliation and translation. When used, only construction item descriptions are transmitted — never your personal identity data.
  • PostHog (PostHog Inc.) — cookieless product analytics, hosted in the European Union (eu.posthog.com), processor under Article 28 GDPR. Events carry a sanitised path and a small set of explicit product properties; PostHog does not receive cookies, fingerprint properties (browser, OS, screen, locale, timezone, user agent), session recordings, or cross-session identifiers, and client IP addresses are discarded server-side. PostHog Inc. is established in the United States; any transfers outside the EEA are governed by the safeguards described in Section 6.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

6. International Data Transfers

Some of our processors are established in the United States or process data outside the European Economic Area (EEA):

  • Convex (Convex, Inc.) — transfers are covered by the European Commission’s Standard Contractual Clauses in our agreement with Convex;
  • Cloudflare (Cloudflare, Inc.) — design-project PDFs and annotations are stored in the European Union, but requests may be decrypted and processed outside the EEA through Cloudflare’s global network. These transfers are covered by the European Commission’s Standard Contractual Clauses in our agreement with Cloudflare;
  • Resend (Plus Five Five, Inc.) — transfers are covered by the European Commission’s Standard Contractual Clauses in Resend’s data processing agreement;
  • PostHog (PostHog Inc.) — PostHog participates in the EU-U.S. Data Privacy Framework, and transfers to it rely on the European Commission’s adequacy decision for that framework.

You can request information about these transfers and copies of the applicable safeguards using the contact details in Section 13.

7. Data Retention

  • Account data — retained for as long as your account is active. When you delete your account, your sign-in account is removed and your profile is marked as deleted and no longer used to provide the Service. The remaining profile data is kept until we erase it; you can ask us to erase it at any time using the contact details in Section 13, unless the law requires us to keep it. Your annotations are handled as described below;
  • Construction-project data — retained for the duration of the project. A deleted project is moved to the trash; a project owner can then delete it permanently. Permanent deletion makes the project inaccessible; the project’s other records are kept until we erase them, and you can ask us to do so using the contact details in Section 13, unless the law requires us to keep them;
  • Design projects — these have their own members; deleting a construction project does not erase them. A hidden revision, and a deleted project with its documents, revisions, PDFs and annotations, are erased in the background once their 30-day restore window ends, or as soon as nobody can restore them any more: when the person who hid or deleted them leaves the project, is removed from it or deletes their account. Erasure deletes the PDFs and annotations and removes file names, notes, hiding reasons, the project’s name, the names of Other documents and guests’ names. It normally completes within a day; failures can delay it, and automatic retries stop after seven days, after which the erasure waits for our intervention. A minimal record remains: the identifiers, dates, numbers, disciplines and phases of the project, its documents, revisions and ended memberships, who hid, deleted and restored what and when, and the audit records. Our backups may keep erased data for up to seven more days. Projects that are not deleted have no scheduled erasure; you can request erasure using Section 13, unless the law requires retention. Account deletion ends memberships and removes their account identifiers, deletes projects where you were the last member, and ends restoration of projects you deleted and revisions you hid, so their erasure starts at once. Identifiers of who created, uploaded, hid, deleted or restored content remain after account deletion for our and members’ legitimate interests in preserving the review record and audit trail (Section 4). Uploaders can discard unfinished uploads, starting background erasure of their PDFs and annotations. Failures or outstanding uploads can delay erasure; automatic retries stop after seven days and unresolved failures need our intervention. Revision records remain, including number, any note, suggested discipline and phase, uploader identifier, creation time and discard time. Deleted annotations may be recoverable through Cloudflare’s point-in-time recovery for up to 30 days. Cleanup is scheduled after 24 hours for recent-change logs and seven days for deleted annotations and transaction records. Unaccepted uploads’ temporary files are scheduled for cleanup about 20 minutes after upload starts and again after 24 hours; failures may delay cleanup. This erases neither revision records nor PDFs accepted by storage but awaiting upload confirmation. Undo history stays in browser memory. Deleted comments’ author identifiers and times remain until revision erasure. We cannot remotely erase members’ downloaded PDF copies. An ended invite no longer holds the email address. 30 days after an invite is sent, unless it was accepted, we erase its links, its guest-access records and the guest’s name, normally within a day, and the name then no longer appears on the guest’s annotations. Accepting an invite deletes its links and guest-access records at once, and the name stays on the guest’s annotations. The invite rate-limit counters kept per invite, per sender, per address hash or per IP address hash are erased once their limit’s period (one minute, one hour or one day) has passed since the last counted request, by a cleanup that runs every 15 minutes and can be delayed by failures or backlog; this does not erase copies in our backups. The counters of guests’ requests to open revisions are deleted about a minute after each counted request, though Cloudflare’s point-in-time recovery may keep them for up to 30 days;
  • Your annotations after account deletion — your existing annotations remain with the project, and we replace your displayed author name with “Former member”. Author identifiers and any personal data written within your annotations may remain. We rely on our and other project members’ legitimate interests in preserving the shared project review record, only where continued retention is necessary. You can request erasure or object using the contact details in Section 13;
  • Audit logs — retained for the lifetime of the associated project to maintain the integrity of the audit trail, and may be retained longer if required by law;
  • Server logs — kept by Axiom for 30 days;
  • Abuse-prevention counters — to protect the Service against abuse (Section 4), we count accepted contact-form messages per email address and failed checks of the credentials used by automated software (bots) to access our API, per IP address. The counters store a code calculated from the address (a hash), rather than the address itself; these codes remain personal data. Counters created before 24 October 2026 store the address itself; we delete them all once, shortly after that date, and backup copies may remain for up to seven further days. Each counter becomes due for deletion one hour after the last counted contact message or one minute after the last counted failed bot API credential check. Requests refused by these limits do not increase the counters or delay deletion. Cleanup is scheduled every 15 minutes; failures or backlog can delay deletion. It does not delete backup copies, which may remain for up to seven further days. IP addresses also appear in server logs, kept for 30 days. This cleanup deletes only counters; contact messages are stored separately and currently have no scheduled deletion;
  • Digital signature data — retained as part of the signed dossier for the legally required period.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — request a copy of the personal data we hold about you;
  • Right to rectification — request correction of inaccurate or incomplete personal data;
  • Right to erasure — request deletion of your personal data, subject to legal retention requirements;
  • Right to restrict processing — request that we limit how we use your data in certain circumstances;
  • Right to data portability — request your data in a structured, commonly used, and machine-readable format;
  • Right to object — object to processing based on legitimate interests;
  • Right to withdraw consent — withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To object specifically to the cookieless product analytics described in Section 9, open the portal at Settings → Privacy and switch analytics off. You may also send a Global Privacy Control (GPC) signal from your browser, which we honour automatically. Your preference is stored on the browser/device where you set it, so opt out separately on each device.

To exercise any of these rights, contact us via our contact form. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

9. Cookies and Tracking

The Service uses essential cookies necessary for authentication and session management. We do not use advertising cookies, advertising trackers, or third-party advertising scripts.

When you open an invite link, our API host sets an essential, HTTP-only cookie that holds the link for 24 hours, so that the invite page can find the invite without the link appearing in the address bar or in our analytics.

When you enter a design project as a guest, our API host sets a second essential, HTTP-only cookie that holds your guest token until your guest access ends, at most 24 hours later, and keeps the invite cookie for as long. Atelier fetches the token from our API host and keeps it only in the page’s memory, never in its address or in our analytics.

For product analytics we use PostHog in cookieless mode, hosted in the European Union. PostHog helps us understand which features people use so we can improve the Service. We have configured it so that:

  • No cookies are set for analytics;
  • No cross-session tracking, no session recording, no fingerprinting (browser, OS, screen, locale, timezone, and user-agent properties are stripped from every event);
  • Client IP addresses are discarded server-side;
  • Events carry only a sanitised URL path (UUIDs and other identifiers are redacted before send) plus a small set of explicit product events.

A localStorage entry is written only when you opt out, to remember your objection. This entry is strictly necessary under Article 5(3) of the ePrivacy Directive.

How to opt out: use the toggle below, open the portal at Settings → Privacy if you have an account, or send a Global Privacy Control (GPC) signal from your browser — we honour GPC automatically. The opt-out preference is stored on the browser/device where you set it.

Changes take effect the next time you load a page. Your preference is stored only on this browser.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit (TLS/HTTPS);
  • Hashed password storage;
  • Role-based access controls within projects;
  • Authenticated file download endpoints;
  • Complete audit logging of all significant actions.

No system is perfectly secure. If you become aware of any security vulnerability or breach, please notify us immediately via our contact form.

11. Children’s Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. The “Effective date” at the top of this page indicates when this Policy or its most recent material revision took effect.

13. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Contact form