Privacy Policy

The controller is Tekio Consulting and Engineering Ltd, a company registered in Israel under number 516402492, with its registered office at Dr. Abraham Elihau Harkavy 3, Tel Aviv-Yafo 6732921, Israel.

For any privacy question, including from individuals in the European Union and the United Kingdom, you can write to us at info@kalma.build.

Account data: name, email address, password (stored only as a hash), or your Google account identifier if you sign in with Google; language and preferences (for example, weekly summary frequency); and the date of your last visit.

Project content: projects, disciplines, stages, deliverables, dates, companies, and the names and email addresses of the people you invite or assign as leads.

Autodesk Construction Cloud integration (optional): read-only access tokens, your Autodesk account identifier, name and email, and metadata of linked files.

Product usage: pages visited and actions taken in the Service (for example, creating a project or linking a file), associated with your account identifier, name and email, and technical errors.

Technical data: IP address, browser and device, and the logs needed to operate and protect the Service.

Communications: the email you leave on the waitlist, contact form data (name, email, company and message), and feedback you send us from the app.

If you received a personal invitation from us, we obtained your name, company and business email from public professional sources (your company’s website, LinkedIn or industry events). We use them to send you at most three messages about early access, based on our legitimate interest in introducing a product related to your professional activity.

We record when you open your personal link (date, browser and referring page, without your IP address), whether you join the waitlist and whether you create an account.

You can unsubscribe using the link in every message or object by writing to us. When you unsubscribe we keep only your email on a suppression list, so we never write to you again.

Providing the Service, managing your account and sending operational notifications (assignments, status changes, email verification): performance of contract (Art. 6(1)(b) GDPR).

Sending the weekly summary of your projects, which you can turn off in Settings or from the email itself: legitimate interest (Art. 6(1)(f)).

Product analytics to understand how the Service is used and improve it: legitimate interest. We use no analytics cookies, and you can object by writing to us.

Security, abuse prevention and rate limiting: legitimate interest.

Support: to resolve issues, authorised Kalma staff may temporarily access your account and see what you see, only when necessary: legitimate interest and performance of contract.

Early access invitations and replying to enquiries: legitimate interest. Compliance with legal obligations: Art. 6(1)(c).

We only use strictly necessary or functional cookies and local storage. We use no analytics or advertising cookies. Details are in our Cookie Policy.

We share data with providers that act as processors on our behalf under data processing agreements: Supabase (database), Vercel (hosting), Resend (email delivery), PostHog (product analytics) and Upstash (rate limiting). The full list is on our Subprocessors page.

If you sign in with Google or connect Autodesk Construction Cloud, Google and Autodesk process your data as independent controllers under their own policies.

We may disclose data to authorities where required by law. We do not sell your personal data.

Kalma is operated from Israel, which benefits from an adequacy decision of the European Commission and is recognised as adequate by the United Kingdom. Our database and application servers are hosted in the European Union (Frankfurt).

Some providers are established in the United States or provide global services. In those cases, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

Account and content: while your account is active. After closure, we delete them within 30 days, unless required by law.

Waitlist: until we give you access or you unsubscribe, and for no more than 24 months.

Early access invitations: up to 12 months from the last contact if you do not create an account. The suppression list (email only) is kept for as long as needed to honour your unsubscribe.

Product analytics: no more than 24 months. Enquiries and feedback: as long as needed to handle them, no more than 24 months. Technical logs: our providers’ short retention periods.

We apply technical and organisational measures to protect your data: encryption in transit, passwords stored as hashes, per-project and role-based access control, EU hosting, rate limiting and restricted staff access. In the event of a personal data breach affecting your rights, we will act in line with the applicable notification obligations.

You may exercise your rights of access, rectification, erasure, restriction of processing, portability and objection (including objection to analytics and invitations), and withdraw consent where it is the basis of processing.

To exercise them, write to us at info@kalma.build. We reply within one month. You may also lodge a complaint with the data protection authority of your EU country, the UK Information Commissioner’s Office (ICO) or the Israeli Privacy Protection Authority.

If your data is part of a project managed by another customer organisation, that organisation decides about it: we will help you direct your request to it.

The Service is intended for professionals, not for children. We do not knowingly collect children’s data.

We may update this Privacy Policy. We will publish the current version with its date and, if the changes are material, notify you by email.

Tekio Consulting and Engineering Ltd · Dr. Abraham Elihau Harkavy 3, Tel Aviv-Yafo 6732921, Israel · info@kalma.build