Privacy Policy

Provider details — draft

Baubiber AG (in formation)
Zug, Switzerland

The company is currently being incorporated. These details are incomplete. The actual operator before incorporation and the following required details must be completed before legal approval.

Current legal operator

[...]

Registered street address and postcode

[...]

Authorised representative

[...]

Commercial register and CHE/UID

[...]

VAT details, where applicable

[...]

Contact: hello@baubiber.com

2. Overview and scope

We take the protection of your personal data very seriously. This privacy policy informs you about the personal data we collect, process, and use in connection with the Baubiber platform. It covers our website, the web app at app.baubiber.com, the mobile app for iOS and Android and the voice assistant Bobo. Processing is carried out in accordance with the European General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP/nFADP).

Section 3 explains when Baubiber is responsible for your data and when your company is. Sections 4 to 12 describe the individual features, and Section 13 lists every service provider and interface that receives data.

3. Who is responsible for your data?

3.1 Baubiber as controller

Baubiber is responsible for the platform itself: user accounts and sign-in, identity and business verification, projects, requests, offers and messages between clients and companies, AI features, support requests, security, abuse prevention, usage statistics, and contract administration and billing with our customers.

3.2 Your company as controller, Baubiber as processor

When a company uses Baubiber to run its own business, it determines the purposes and means of that processing and is its controller. Baubiber processes this data as a processor, only on the company's instructions. This covers in particular:

• Employees' working time, breaks, absences and payroll data
• Site attendance, day plans, crew assignments and live location sharing (Section 8)
• Vehicle and equipment positions from the company's fleet and equipment services
• The company's site logbook, internal tasks, team chats and documents
• Customer, supplier and invoice data that the company records or issues itself, including its delivery notes, purchase orders to suppliers and letters to clients

An Article 28 GDPR data processing agreement (DPA) with the specific appendices must be agreed before processing personal data on a company's behalf, including during a pilot or test import, rather than only at launch. The company determines lawful purposes and roles, informs its employees and addresses applicable employee representation or works council rights. The company checks working times before using them for payroll; a particular accounting integration is not a prerequisite for Baubiber. An instructed processing pause covers the affected active use, imports, synchronisation and onward disclosures; necessary secure retention and protective measures are documented separately.

If you work for such a company, your employer is your first contact for access to, correction and erasure of this data. If you contact us, we forward your request to the company and help it respond.

3.3 Project participants

What you share in a project is visible to the participants authorised for it, such as the client, awarded companies, property managers or a planner you bring in. When a company wins a job through Baubiber and so receives your contact details, it also processes them for its own purposes such as the contract, invoicing and statutory retention. The company is responsible for that itself.

3.4 Connected services and exports

When your company connects Baubiber to its own account with another provider (DATEV, Lexware Office, Peppol delivery through Storecove, Webfleet, PAJ GPS or Hilti ON!Track), or you connect your Google or Microsoft calendar or an AI assistant such as ChatGPT or Claude (Section 6.1), Baubiber acts on behalf of the company or on your behalf. Baubiber sends or reads only what the feature needs, and only after the connection has been set up. We store the access credentials for these services encrypted.

Once data has arrived in the other provider's system, its further processing is governed by the contract between your company and that provider. Baubiber is not responsible for that processing. The same applies to files you download or pass on, such as invoice PDFs, exports or the DATEV LODAS file, and to content you share through a share link, and to answers Baubiber returns to your AI assistant: that provider's privacy and retention terms apply to its copy. Disconnecting a service stops future transfers; it does not delete the data held by the provider, nor automatically the data already stored in Baubiber.

4. Data we process

• Account data: Name, email address or phone number, verification status, and sign-in identifiers. Sign-in uses email links or one-time codes, phone codes, Apple or Google; Baubiber does not offer password sign-in.
• Project data: Descriptions of your renovation projects, material preferences, timelines, visit hours and open points
• Photos and documents: Photos, plans and attachments you upload, including for AI-powered analysis
• Property details: Property type, size, location, building information and rooms with room type, size and fixtures, as you enter them or as they are recognised from your photos
• Communication data: Messages, group chats and emails between project participants through the platform
• Voice data: User-initiated site-visit recordings, diary voice notes, audio recordings of conversations with Bobo, and resulting transcripts
• Working time, attendance and location: Optional automatic working time, site attendance and live location sharing as described in Section 8
• Fleet and day plans: Crew assignments, work status, and vehicle or equipment positions from providers connected by your company
• Financial and work records: Quotes, invoices, payment status, bank details you provide, work times, absences, payroll details, costs and project attachments
• Delivery note signatures: When a client signs a construction company's delivery note, the signer's name, the time and how it was signed; when signing on the company's phone or tablet, also the drawn signature as an image. The company keeps them with its delivery note to evidence the delivered work under its contract with the client (Section 3.2; Art. 6(1)(b) GDPR). The signature is stored privately and only the company and the project's client side see the note. Signatures and names are erased with the project; when an account that signed in Baubiber is deleted, its name is removed from those delivery notes and their stored copies are deleted.
• Calendars: When you connect a calendar, Baubiber reads busy times and events from the calendars you choose when needed to show your availability. We store the encrypted access and the names of the chosen calendars, not the events.
• Invitations and referrals: Selected colleagues' names and phone numbers, invitation status and team role; for referrals, who invited whom, the invited person's email address if given, and the status
• Business and identity verification: Business registration details, identity details and verification results from Didit (Section 10)
• Device and usage data: Device type, operating system, app version, IP address, access times, push token and error reports

Sources and required information

Data comes from you, authorised project or company participants, people inviting you, and activated integrations or verification services. Without required account or project information, the relevant features cannot be provided. Optional recordings, integrations and device permissions depend on the chosen feature. Published project or company profiles reach a broader audience than content you share only within a project.

5. Purposes and legal bases

Purposes

• Providing and managing your user account
• AI-powered matching between clients and companies
• Creating and managing projects, quotes, invoices and day plans
• Communication between platform users and notifications
• Operating, troubleshooting, securing and technically improving the platform. This does not authorise unrelated use of company data processed on instructions or general AI training with confidential customer materials.
• Fulfilling legal obligations

Legal bases

• Contract performance (Art. 6(1)(b) GDPR): to provide our services
• Consent (Art. 6(1)(a) GDPR): for AI features (Section 6), for face data in verification (Art. 9(2)(a) GDPR, Section 10) and for marketing communications
• Legitimate interest (Art. 6(1)(f) GDPR): for security, abuse prevention, usage statistics and improving the platform
• Legal obligation (Art. 6(1)(c) GDPR): for example tax and commercial record retention

For data Baubiber processes as a processor (Section 3.2), the company determines the legal basis. The appropriate legal basis for employee time and location-related processing depends on the employment relationship and applicable national law. Employers must determine and document it before deploying location-based features.

6. AI-powered features

Baubiber uses Google Gemini AI (provided by Google LLC) to deliver core features of the platform. When you use these features, the following data is sent to Google Gemini for processing:

• Photos you upload: Images of your property to detect issues (e.g. damage, wear) and analyse room conditions
• Project descriptions: Text descriptions of your renovation needs to generate tailored solution options and contractor reports
• Property details: Property type, size, and location as context for renovation recommendations and design visualisations
• Voice recordings and site context: User-initiated site-visit recordings and diary voice notes, together with relevant dates, participant names, and attached site photos, are sent for transcription and structured extraction
• Quote drafts: When a construction company creates a quote with AI or imports one from a PDF, its request or dictation, the attached photos, PDFs, spreadsheets, Word and GAEB files, the project brief, an earlier quote it picked, and matching entries of its own catalog and earlier quotes

Google Gemini processes this data for the following purposes:

• Detecting issues and damage in your photos
• Generating renovation solution options and scope recommendations
• Creating before/after visualisations and moodboard images
• Producing technical reports with work items and material lists
• Transcribing voice recordings and turning them into structured site notes, work items, and follow-up actions
• Drafting the titles, positions, quantities and prices of a construction company's quote for the company to check

Other AI services: voice conversations with Bobo run through LiveKit, Deepgram, OpenAI and Fish Audio; World Labs creates optional 3D views of your property from the photos you take or select for them; TypeSafe evaluates structured observations from project analysis (Section 13). We ask for your explicit consent separately for Gemini, for the 3D view (World Labs) and for voice conversations, immediately before you first use the relevant feature. You may withdraw these consents at any time in the app settings. Google's data processing is governed byGoogle's Privacy Policyand the Gemini API Terms.

6.1 AI assistants you connect

You can connect your Baubiber account to an AI assistant such as ChatGPT or Claude and choose read-only or read/write access. The assistant sends the inputs needed for each tool. Baubiber returns the requested records that your account is allowed to access to the assistant provider you chose. Messages and task notes may contain personal or confidential information; only request or share what is needed. Baubiber does not receive your full chat history through this connector. You can revoke the connection in Settings → AI connections. Revocation stops future requests but does not erase information already returned to your assistant. That provider’s privacy and retention terms apply to its copy.

Baubiber in ChatGPT and Claude

AI results are suggestions. People make the decisions on offers, jobs, approvals and invoices.

7. Mobile app and device permissions

The app asks for a permission only when you use the feature that needs it. Every permission is optional: if you decline it, the rest of the app keeps working, only that feature does not. You can revoke permissions at any time in your phone's settings.

• Camera: Photos of rooms, damage and sites, and the guided photos for a 3D view. Baubiber receives only the photos you save or send in the app.
• Photos: Picking existing images through the system photo picker. Baubiber receives only the images you select; on Android the app does not request general access to your media library.
• Microphone: Conversations with Bobo, site-visit recordings and voice notes. Audio is recorded only while you have started a recording or conversation. To keep a recording running while the screen is locked, the app uses the background audio mode; on Android a notification shows the running recording.
• Location while using the app: Filling in an address when you choose “Use current location”. On iOS the app also uses device motion for this.
• Background location: Only for the two optional features in Section 8, automatic working time and live location sharing. Both are off by default.
• Contacts: Picking colleagues to invite. The address book is read only on the phone (Section 9).
• Notifications: Push notifications about messages, offers, appointments and tasks. For this we store your device's push token; delivery runs through Expo's push service and on through Apple (APNs) or Google (Firebase Cloud Messaging). You choose which notifications you receive in the app.
• Lock Screen and widget: On iOS the app can show your current job and running time on the Lock Screen and in its widget. This information stays on the device.
• Maps: Maps in the app are drawn by the device's map system, Apple Maps on iOS and Google Maps on Android. The map provider receives technical request data such as the IP address and the map area shown.

The app keeps your sign-in in the device's protected storage (Keychain or Keystore). Photos and recordings not yet uploaded stay on the device until upload. We send the app's crash and error reports to Sentry.

8. Working time, site attendance and location sharing

Both features concern a company's employees; the company is the controller (Section 3.2). They are independent of each other, off by default and switched on and off in Settings → Location at work. Manual time controls always remain available.

8.1 Automatic working time and site attendance

Your employee setting starts working time when you leave home or arrive at the office. Office departure or returning home stops it. For a crew with shared clock-out enabled, the assigned vehicle reaching its first return drop-off stops working time for the whole crew. Project arrivals and departures record site attendance separately and do not change working time.

Phone monitoring needs a disclosure acknowledgement and precise background-location permission. While enabled, the phone monitors 150 metre geofences around the saved home or office and assigned sites; automatic events are recorded only on working days according to team availability.

Baubiber stores the configured addresses and coordinates, employee settings, detected timestamps and event source. Phone events do not send a route or continuous GPS positions. Group clock-out uses positions from the company’s connected vehicle provider. The employee and authorised company managers can access these records.

Unsent time events stay on the phone until sent or explicitly discarded. Vehicle-based group clock-out is a separate crew-plan setting.

8.2 Live location sharing

When you turn on live location sharing, the phone sends your current position only during your planned working hours according to the sent day plan. Outside those hours, positions are discarded on the device and not uploaded. Baubiber stores only the latest position with its time and accuracy, no history and no route. It is visible to company admins and project managers on the live map and is deleted when work ends or at the latest five minutes after the last position. Positions change neither time records nor attendance. Turning sharing off deletes the opt-in and the stored position immediately. Signing out, switching companies or leaving the company also ends sharing; the last position then expires within five minutes.

Without sharing, a person's map position is derived from their site check-in, assigned vehicle or planned job site, not from locating their phone.

8.3 Notes for employers

The employer is responsible for its own lawful basis, employee information, retention and access rules, and any required consultation with employee representatives or a works council. An in-app opt-in is not, by itself, proof that employee consent is freely given or that all employment-law requirements have been met.

9. Phone sign-in and inviting colleagues

You can sign in with your mobile number instead of an email address. We then send a one-time code by SMS or WhatsApp, as you choose. We store your mobile number with your account and whether it has been confirmed.

Business owners and project managers can invite colleagues by phone number. In the mobile app they may pick those colleagues from their phone's address book:

• On-device access: The app asks for access to your contacts only when you open the invite screen. Your address book is read on your phone; Baubiber does not upload or store it.
• Only what you choose: Baubiber receives only the names and mobile numbers you select, to create the invitations.
• Sending invitations: When you choose Send SMS, Baubiber sends the invitation through Twilio. It contains a single-use sign-in link that expires within one hour and lets the recipient verify the invited number and join the team. Alternatively, you can share an ordinary invitation through your own WhatsApp app or copy its text; those links require sign-in and verification.
• Retention: An invitation expires after seven days unless it is sent again, and is deleted 30 days after it expired. The inviting organization can withdraw it at any time, which deletes it immediately. When the invited person joins, the invitation is linked to their account.

Processing the invited person's name and number is based on the legitimate interest of the inviting organization in adding its colleagues to the team (Art. 6(1)(f) GDPR).

10. Face data for identity and business verification

When you start identity verification (KYC), or an identity check for a business representative during business verification (KYB), you enter a verification flow hosted by Didit. This flow processes the portrait on your identity document, selfies or face images, liveness captures (including video where the verification step requires it), and derived facial geometry, face-match scores, liveness results and fraud signals.

We use this data to confirm identity, match the person to the identity document, check that a real person is present, prevent impersonation and duplicate-account abuse, and review business representatives and verification decisions. We do not use verification face data for advertising, marketing or renovation AI features, and we do not sell it. Didit's model-training option is disabled for Baubiber: our historical and new verification data is excluded from future model training and related evaluation. This does not reverse model updates made before the opt-out.

Sharing and storage

Face data is shared with Didit as our verification provider and processed by its authorized infrastructure and service providers. Didit's standard verification storage and processing are in the European Union, with encryption in transit and at rest. Its privacy notice describes service providers, legally required disclosures and safeguards for international transfers. Baubiber receives and stores identity details, verification outcomes, face-match scores, warnings and the returned verification response, which may include references to verification media. These records are stored in our access-controlled Neon PostgreSQL database in the AWS Europe Central 1 (eu-central-1, Frankfurt, Germany) region, and processed by our API hosted on Fly.io in Frankfurt. Verification images and biometric templates are not published to other platform users.

Retention and deletion

Baubiber has configured a 10-year retention period for verification sessions in Didit. Didit automatically deletes session data at the end of that period; earlier deletion may follow a valid erasure request or a shorter applicable legal requirement. Our setting deletes the face biometric template with the session; we do not enable separate template retention after session deletion. This period supports verification review, fraud investigation, dispute handling and audit records; it is not a statement that every user is legally required to have their face data retained for ten years.

Baubiber's own verification records remain while the relevant account or organization exists. Deleting your account deletes its personal KYC record from our application database. A business verification record belongs to the organization and may remain if that organization continues. Account deletion queues erasure of your personal Didit sessions and provider user record, including retained biometric templates. Failed requests are retried; deletion is complete only after confirmation. Business verification, separate blocklist entries, audit records and backups require separate assessment. To request erasure of verification data, contacthello@baubiber.com or use oursupport form. Our team checks the request and arranges deletion of the relevant local records and Didit sessions, including attributable biometric templates, unless a lawful retention obligation applies. These specific rules govern verification data alongside the general rules in Section 16.

Further information: Didit Verification Privacy Notice.

11. Electronic signatures for company documents

When you sign electronically as a company admin, we retain the document version and hash, your verified name, the company, an internal account reference, the Didit session reference, verification and signing timestamps, and your agreement declaration. Before signing we request the current verification decision from Didit. The signature record contains no identity-document copy or biometric data. It documents and evidences the agreement and is accessible to authorised company admins and internal contract staff. Account deletion removes prepared signing requests; necessary contractual evidence is handled separately under the applicable retention and erasure policy. The specific legal basis and retention period must be established for each contractual role before enterprise approval; this does not justify indefinite storage.

12. Support requests and support access

When you contact support, we store your name, email address, message, language and ticket reference in our internal support system. Our team uses this information to investigate your request and reply by email. Submitting a request does not create an account or verify ownership of an existing account. Please do not include passwords, sign-in codes, identity documents or selfies. Support records follow the storage and deletion rules in Section 16; you can request access or deletion at hello@baubiber.com.

To reproduce a problem, two named Baubiber staff members can temporarily see the web app as you see it. Such support access requires a stated reason, ends after 30 minutes at the latest and is logged with the person, reason, start and end. Account security, account deletion and administration functions are blocked during it. The legal basis is our legitimate interest in fixing errors and, for company data, the instructions in the DPA.

13. Recipients, service providers and interfaces

Within Baubiber, only people who need access for their task have it. To provide our services, we use the following service providers as processors:

Hosting and infrastructure

• Neon: PostgreSQL database hosting in AWS Europe Central 1 (eu-central-1, Frankfurt, Germany), including the verification records described in Section 10
• Fly.io: Hosting for the API and voice services, configured for Frankfurt
• Tigris: File storage for uploaded photos, documents, and user-initiated recordings in a private bucket configured for global placement
• Vercel: Hosting and delivery of the website and the web app
• Expo (650 Industries): Delivery of app updates and of push notifications through Apple and Google
• Sentry: Error monitoring and crash reporting
• Cloudflare: Runs our cookieless usage statistics (Traks, operated in our own Cloudflare account) for the web app and the mobile app, as described in Section 18

AI and voice

• Google Gemini AI (Google LLC): AI-powered photo analysis, renovation recommendations, visualisations, translations, voice transcription and structured site reports as described in Section 6
• LiveKit: Secure real-time transport for optional conversations with Bobo
• Deepgram: Speech-to-text for conversations with Bobo and recorded logbook notes
• OpenAI: Language processing of conversation text and relevant project context for conversations with Bobo, and structuring recorded logbook transcripts into entries for your review
• Fish Audio: Turns Bobo's response text into speech
• TypeSafe: Evaluates structured observations from project analysis to assess issues and recommendations
• World Labs: Processes the photos you take or select for an optional 3D view of your property

Sign-in, communication and verification

• Resend: Email delivery, such as sign-in links, notifications and project emails
• Twilio: Delivery of phone sign-in codes and SMS invitations, including the recipient number and message content. WhatsApp sign-in is offered only when enabled; WhatsApp delivery also involves WhatsApp
• Didit: Identity and business verification, including submitted identity documents, verification images and business details. Baubiber stores the verification outcome and returned details, which may include names, date of birth, nationality and document number
• Apple and Google: Process sign-in when you choose “Sign in with Apple” or “Sign in with Google”. Authentication itself runs in our infrastructure using the Better Auth software library.

Address search and maps

• OpenStreetMap Nominatim and Photon (komoot): When you search for an address or place, your search text is sent directly from your device to these services. For job sites without coordinates, our API looks up the stored address with Nominatim.
• Map services: OpenStreetMap tiles in the web app, Apple Maps and Google Maps in the mobile app (Section 7)

Services your company or you connect

These services work with your company's own account or your own account. Section 3.4 sets out who is responsible.

• DATEV: Transfer of issued invoices with their document file to accounting at DATEV when an authorised person transfers them. For payroll, Baubiber creates a LODAS file that your company downloads.
• Lexware Office: Transfer of issued invoices as sales vouchers with recipient details and the invoice PDF
• Storecove: Delivery of e-invoices over the Peppol network to the invoice recipient
• Webfleet, PAJ GPS and Hilti ON!Track: Supply vehicle or tool positions and status for day planning and the live map
• Google Calendar and Microsoft Outlook: Read-only access to busy times and events of the calendars you select
• Your AI assistant (for example ChatGPT or Claude): Receives the data you request through the connected account (Section 6.1)

14. International transfers

The intended provider is based in Switzerland, which has an EU adequacy decision. This does not automatically cover onward transfers to other recipients. Some of the service providers in Section 13 are based in, or process data in, the United States. Specific legal entities, processing locations, remote access and transfer grounds must be confirmed before enterprise approval. Where required, the EU-U.S. Data Privacy Framework for certified providers or appropriate safeguards under Article 46 GDPR, including standard contractual clauses and supplementary measures, are used. You can request information and available copies of the relevant safeguards through the privacy contact. This draft does not confirm a completed review of every provider.

15. Data security

• Connections to the website, web app, mobile app and API are encrypted with TLS.
• Files are kept in private storage. They are delivered to signed-in, authorised people, through a share or guest link someone deliberately created, or in a published profile.
• We store access credentials for connected services (Section 3.4) encrypted.
• Every request is checked against the person's role in the company and the project; on shared projects, companies see only their own amounts and records.
• Support access to accounts is logged (Section 12).

16. Retention and deletion

For verification face data, Didit sessions and organization verification records, the specific retention and deletion rules in Section 10 apply.

Retention depends on the purpose and applicable legal obligations. For data we process on a company's behalf, the company determines the retention period under the DPA. Account deletion anonymises the user account and removes certain personal records, including conversations with Bobo and their recordings; it does not promise deletion of every organisation, project, supplier or backup record within 30 days. A complete erasure request is assessed against the relevant records and legal exceptions. Specific periods for each category and backup set must be completed before approval of this draft.

Pending working-time and attendance events remain on the device until successfully synchronized or explicitly discarded. Confirmed time records follow the retention rules applicable to project, accounting, and employment records. Live positions are deleted as described in Section 8.2.

17. Your rights

• Right of access: You may request information about the data we store
• Right to rectification: You may request correction of inaccurate data
• Right to erasure: You may request deletion of your data
• Restriction: Subject to the statutory conditions, you may request restriction of processing
• Right to data portability: You may receive your data in a common format
• Right to object: You may object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing at any time
• Withdrawal: You may withdraw consent at any time for the future; earlier processing remains lawful
• Complaint: You may complain to a supervisory authority, particularly in the EU country of your habitual residence, workplace or the alleged infringement. The Swiss FDPIC is a contact for Swiss data protection concerns.

To exercise your rights, contact hello@baubiber.com. If your request concerns data we process for a company, Section 3.2 applies. Requests are generally answered within one month. Any lawful extension of up to two further months will be explained within the first month. We request only necessary information to verify identity. Where solely automated decisions have legal or similarly significant effects, Article 22 GDPR conditions and safeguards apply; the specific processing must be explained before use.

18. Cookies, usage statistics, fonts and maps

The website and web app use only technically necessary cookies, such as for your sign-in. We do not use analytics or advertising cookies.

To learn how the web app and the mobile app are used, we count page and screen views and a few actions (such as signing in, publishing a request or sending an offer) without cookies and without storing anything on your device. A view records the kind of page or screen opened (for example “project details”, never which project), the referring website, campaign tags, the browser or operating system and its version, the device type, the screen width, the app version, and the country, region and city derived from the IP address. An action also records its name, the interface language and fixed details such as whether it awaits approval, never anything you entered. To recognise views from the same visitor on the same day, the IP address and browser identifier are combined with a secret key that changes every day. The IP address itself is not stored, and views cannot be linked across days or to your account. The legal basis is our legitimate interest in improving the platform (Art. 6(1)(f) GDPR). You can object at any time athello@baubiber.com.

The website requests font files from Google Fonts. Maps may load OpenStreetMap tiles. These services receive the IP address and technical request data, among other information. Display also follows your device’s light/dark preference. Non-essential device access is subject to Section 25 TDDDG where applicable; further personal data processing needs its own legal basis. Third-party resource integration and its legal bases require review before approval.

19. Changes

We update this privacy policy when features, service providers or legal requirements change. The date at the top shows the current version. We inform registered users about material changes.

20. Contact

For questions about data protection, you can reach us at:
Email: hello@baubiber.com

See Legal and enterprise documents for enterprise information and the status of provider details.