This is a translation of the Privacy Policy. In the event of any discrepancy, the Portuguese version prevails.

Privacy · LGPD

Privacy and Cookie Policy – BuildSphere

Last updated: October 2026

Welcome to the BuildSphere website. The protection of your personal data is a priority for GROMA TECH DESENVOLVIMENTO DE SOFTWARE CUSTOMIZAVEL LTDA ("Gromatech"), registered with the CNPJ under No. 68.454.007/0001-17.

This Privacy Policy explains how we collect, use and share the information of visitors and customers on our corporate website and sales flow.

1. Scope of this Policy (Website vs. Platform)

This Policy applies exclusively to the use of our public website, the completion of contact forms and the checkout/purchase process.

Notice to Platform Users: If you are an employee, worker or partner of a construction company and use the BuildSphere application/platform (where sensitive data is collected, such as facial photos at the site gate, selfies and FRM signatures), the construction company is the Controller of your data. In such cases, Gromatech acts strictly as a technology Processor. The processing of this data within the software is governed by a Data Processing Agreement (DPA) entered into between Gromatech and the contracting construction company, in addition to the platform's specific Terms of Use.

2. What data do we collect?

As Controller in the website environment, Gromatech collects the following categories of personal data:

Voluntarily provided data (Contact and Registration): Name, email, phone number and company information, collected when you interact with our forms.
Billing and Payment Data (Checkout): To enable contracting and payment processing through the Asaas gateway, we collect only name, email and CPF or CNPJ.
Browsing and Connection Data: When you access the website, we automatically record data that may identify you indirectly, such as IP (Internet Protocol) address, date and time. The collection of these access records is an obligation under the Marco Civil da Internet, and the mandatory retention for 6 months is currently in the technical implementation phase.

3. Purposes and Legal Bases for Processing

We process your data only when we have a legal justification (Legal Basis) supported by the LGPD:

Performance of a Contract / Preliminary Procedures: To process your registration, generate charges, enable your access and provide the service after payment is confirmed.
Legal Obligation: Retention of access records (IP address, date and time) for at least 6 months, in accordance with the Marco Civil da Internet (Lei nº 12.965/2014), in addition to tax obligations (issuance of invoices).
Legitimate Interest: To analyze browsing data in order to improve the website's performance and the stability and security of our systems, including the protection of forms against bots and automated submissions, and to measure the effectiveness of our campaigns. (You have the right to object to this processing).
Consent: For the use of advertising and remarketing cookies and the sending of promotional communications, where applicable.

4. With whom do we share your data?

Gromatech does not sell or trade your data. Sharing occurs only with suppliers essential to our operations, divided into these two categories:

A. Processor Partners (They act under our instructions and guidelines):

Cloud and Hosting Providers: To keep the website and the database online securely.
Artificial Intelligence Providers: Our AI partners process the requests sent when certain tools are used. They are contractually prohibited from using our users' inputs to train their own foundation AI models.
Transactional Email Services: Tools used to securely send confirmation emails, password recovery emails and system notices.
Anti-Bot Verification (Cloudflare Turnstile): On the website's forms (contact, registration and checkout), we use Cloudflare Turnstile to confirm that the submission is made by a person and to block bots and fraud. To do so, Cloudflare receives technical data from the browser and the device, such as the IP address and signals from the interaction with the page. This data is used exclusively for this security verification, and not for advertising or profiling.

B. Controller or Joint Controller Partners (They have their own policies):

Payment Processor (Asaas): The financial processing of the checkout is carried out by the Asaas gateway. It acts as a controller of the financial data for the purposes of fraud prevention and bank settlement.
Advertising and Analytics Networks (Google, Meta, LinkedIn): We use pixels and tags from these platforms to track the origin of leads and optimize campaigns. In such cases, these platforms may cross-reference this data with their own databases, and are governed by their respective privacy policies.

5. International Data Transfer

Our hosting, email, anti-bot verification and Artificial Intelligence providers may operate servers outside Brazil (such as in the United States or Europe). Gromatech ensures that transfers are made only to companies that adopt data protection levels compatible with the requirements of the LGPD, by means of standard contractual clauses.

6. Cookie Policy

We use cookies and similar trackers to enable the operation of the website and our marketing strategies:

Strictly Necessary Cookies: Essential for loading the website and maintaining the security of your access or checkout flow, including the anti-bot verification of forms (Cloudflare Turnstile). They do not require consent.
Performance and Advertising Cookies: They help map Google, Meta and LinkedIn campaigns.
How to withhold consent and its consequences: You can decline non-essential cookies in the initial notice on our website (cookie banner) or in your browser settings. Withholding consent does not prevent you from using the website, but it means you will not receive advertisements or content personalized according to your browsing.

7. Data Storage and Security

The personal data collected on this website will be stored only for as long as necessary to fulfill the purposes for which it was collected, such as the term of your contract, or to comply with legal and regulatory obligations (such as the retention of Marco Civil records or invoices). Gromatech adopts technical, administrative and encryption measures to protect your data against unauthorized access, loss, destruction or improper alteration. Once processing is no longer necessary, the data will be securely deleted or anonymized.

8. Your Rights (Article 18 of the LGPD)

You have control over your data and may request from us at any time:

Confirmation and Access: To know whether we process your data and to have access to it.
Correction: To update incomplete or inaccurate data.
Anonymization, Blocking or Deletion: For data that is unnecessary, excessive or processed in non-compliance with the law.
Portability: To receive your data in a structured format for transfer to another supplier, upon express request.
Information on Sharing: Details of the public and private entities with which your data has been shared.
Information on Consent: An explanation of the possibility of not giving consent and the consequences of such refusal.
Revocation of Consent: To withdraw permission previously given (e.g., unsubscribing from newsletters or cookies).
Objection: To object to processing based on our legitimate interest, should you consider that it affects your fundamental rights.

9. How to exercise your rights and Contact Us

To exercise any of your rights, report incidents or ask questions about this Policy, contact our Personal Data Protection Officer (DPO) directly:

Privacy Channel (Data Protection Officer): [email protected]
Company: GROMA TECH DESENVOLVIMENTO DE SOFTWARE CUSTOMIZAVEL LTDA (CNPJ: 68.454.007/0001-17)
Address: Rua Pais Leme, 215, conj. 1713, Pinheiros, São Paulo/SP, CEP 05424-150