How Construway handles personal data, in accordance with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
Version: privacy-2026-09-01
Construway is the controller for your account data and for the security logs we keep to protect the service. For the project content your team creates here (documents, photos, schedules, records and comments), your company is the controller and Construway acts as its operator, processing that content on your company's instructions. Requests about project content are handled by your company administrator.
Account data: name, e-mail address, optional profile photo and country, and the company you belong to. Usage and security data: login timestamps, IP addresses and failed login attempts, kept to protect accounts. Project content: documents and site photos uploaded by your team, which may incidentally include images of people at the job site.
Account and project data are processed to perform the service contract with your company (LGPD art. 7, V). Security logs are processed under legitimate interest in preventing fraud and unauthorized access (LGPD art. 7, IX).
We use only cookies that are necessary to run the service. A session cookie keeps you signed in: it is HttpOnly, expires after 30 minutes of inactivity, and is discarded when you close the browser. A CSRF token cookie protects forms against forgery. A language cookie remembers the language you selected. If your company enables the optional remember-this-device step for two-factor sign-in, a further cookie stores that choice for up to 7 days. We set no advertising or cross-site tracking cookies.
Account data is kept while your account is active. Security logs are deleted after 12 months. When an account is removed, personal identifiers are erased or anonymized; records needed for the company's project history remain in anonymized form.
Data is stored with cloud providers acting as processing operators: application hosting and database in the cloud, photo storage on encrypted object storage, and a content-delivery/security layer. Some operators process data outside Brazil under their standard contractual safeguards (LGPD art. 33).
Under LGPD art. 18 you may request confirmation of processing, access, correction, anonymization or deletion of your personal data, and information about sharing. Contact your company administrator or write to us and we will respond within the legal timeframe.
Controller for account and security data: Construway. [email protected]