Privacy Policy

Last updated on 29 October 2026

1. Who are we?

Punchlister BV, with its registered office at Nijverheidstraat 7A/201, 9160 Lokeren, Belgium, company number BE 1039.812.878 (“Punchlister”, “we”). This policy explains how we handle personal data on this website and in the Punchlister app (app.punchlister.ai), within the meaning of the General Data Protection Regulation (GDPR).

For the data you share with us through this website and for your user account, we are the data controller. For the project data your company puts into Punchlister (such as voice notes, messages, emails and documents), your company is the controller and we process that data on its behalf, under the data processing agreement that is part of our terms and conditions.

For questions about this policy or about your data, you can reach us at hello@punchlister.ai.

2. What data do we collect?

Through this website

When you request a demo or create an account, we collect the data you enter yourself:

• Name (first and last name)
• Email address
• Company name
• Phone number
• Any message you optionally include with a demo request
• Password for an account, which is only stored in hashed form so nobody can read it

When you use the app

• Account data: your name, email address, phone number, company and your role in projects.
• Project content: what you and your colleagues add to a project, such as voice notes and their transcripts, WhatsApp messages, emails sent to the project, photos, documents, and the records the app builds from them (for example change orders, open decisions and to-dos). This content can include personal data of other people involved in the project, such as subcontractors or the client.
• Connected accounts: if you connect a Microsoft 365 or Gmail account, the emails and files the app reads from it. For Gmail, see section 7.
• Usage data: how you use the app (pages visited, buttons clicked) and session recordings, in which everything typed into input fields is masked.
• Technical data: IP address, browser and device information in server logs, kept for a short period for security and troubleshooting.

We do not ask for special categories of personal data (such as health data or biometric data). We only use advertising cookies on our campaign page, and only with your consent (see cookies).

3. What do we use this data for?

We use the data from this website to:

• contact you about your demo request or your interest in Punchlister;
• answer your questions;
• where relevant, schedule a follow-up meeting;
• set up your company’s account when you sign up.

We use the data in the app to:

• provide the service: process voice notes, messages, emails and documents, keep each project’s records up to date and make the project searchable;
• send the messages the app sends to you or on your behalf, such as invitations, notifications and WhatsApp updates;
• provide support, and keep the service secure and working;
• understand how the app is used, so we can improve it;
• improve our own recognition and classification models, using pseudonymised data where technically possible, as set out in article 11 of our terms and conditions. Your company can opt out. Data received from Google APIs is never used for this (see section 7).

We do not send newsletters, marketing emails, or unsolicited commercial messages, and we do not sell your data to third parties.

4. What is the legal basis?

For the forms on this website, we rely on your explicit consent (Article 6.1.a GDPR), which you give by completing and submitting the form, and on our legitimate interest (Article 6.1.f GDPR) in following up on your request.

For your account and your use of the app, we rely on our legitimate interest and that of your company (Article 6.1.f GDPR) in providing the service your company signed up for, keeping it secure and improving it. Where you are yourself a party to the agreement, we rely on the performance of that agreement (Article 6.1.b GDPR). For project data we process on behalf of your company, your company determines the legal basis.

5. How long do we retain your data?

• Requests through this website: for a maximum of 24 months after the last contact, unless you ask us to delete them sooner, or a commercial relationship is established that requires a longer retention period (e.g. for accounting or contractual reasons).
• Account data and project content: as long as your account and the project exist in Punchlister, and at most until your company’s agreement ends. After that, your company can export its data for 30 days; we then delete it within 60 days, except what we must keep by law or what has already been anonymised.
• Usage data and session recordings: for a limited period, after which they are deleted automatically.
• Server logs: for a short period, for security and troubleshooting.
• Gmail messages: see section 7.

6. Who do we share your data with?

We only share your data with the service providers listed below, and only to the extent necessary to run the website and the app. They process the data on our instructions only. Within a project, its content is also visible to your colleagues and the other members of that project.

Some of these providers are based in the United States. Where data is transferred outside the European Economic Area (EEA), we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission’s standard contractual clauses.

7. Use of Google user data (Gmail)

If you connect a Gmail account to Punchlister, Punchlister requests read-only access to your Gmail messages (gmail.readonly) and your basic profile (name and email address).

What we access. New messages arriving in your Gmail inbox after you connect, including subject, sender, body and attachments. We do not read messages in your Promotions or Social tabs, and we never send, modify or delete mail.

How we use it. Each new message is analysed automatically to decide whether it concerns one of your company’s construction projects. Messages that do not are discarded immediately without being stored. Messages that do are stored in that project in Punchlister, where you and your colleagues on the project can see them, and are used to keep the project’s records up to date (for example change orders, open decisions and to-dos). Text from attachments is stored so it can be searched within the project.

Who processes it. Only the service providers needed to deliver this feature: Supabase (database and storage), Vercel (hosting), Anthropic (AI analysis of message content) and OpenAI (search indexing of attachment text). These providers process the data on our instructions only and do not use it to train their models.

What we don’t do. We do not sell Google user data, use it for advertising, or use it to train generalised AI or machine-learning models. It is also excluded from the model improvement described in section 3. People at Punchlister do not read your messages, except with your permission, when needed for security reasons or to comply with the law.

Retention and deletion. Stored project messages are kept as long as the project exists in Punchlister. You can disconnect Gmail at any time from your Google Account, under Security → Your connections to third-party apps & services (myaccount.google.com/connections); after that we receive no new messages. To have stored messages deleted, contact hello@punchlister.ai.

8. Cookies

This website does not use analytics software that tracks your individual behaviour. Strictly necessary technical cookies (e.g. for the operation of the hosting platform) may be placed briefly. No consent is required for these under cookie legislation.

On our campaign page (punchlister.ai/start), where visitors from our Facebook and Instagram ads land, we use the Meta Pixel, but only if you consent via the cookie banner. The pixel then places cookies (such as _fbp and _fbc) and tells Meta that you visited the page and, if so, requested a demo. This shows us which ads work and lets Meta show our ads to similar companies. If you decline, the pixel is not loaded. You can change your choice via "Cookie settings" at the bottom of that page. The legal basis is your consent (Art. 6(1)(a) GDPR); Meta is a controller for its own processing (see Meta’s privacy policy).

The app (app.punchlister.ai) stores what it needs in your browser to keep you logged in. It also uses PostHog to measure how the app is used and to record sessions, with everything typed into input fields masked. For this, PostHog places a cookie or stores an identifier in your browser.

Should we add analytics to other pages of this website in the future, we will update this policy and ask for your prior consent via a cookie banner.

9. What rights do you have?

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access — you can request which data we hold about you.
• Right to rectification — you can have inaccurate data corrected.
• Right to erasure ("right to be forgotten") — you can request that your data be deleted.
• Right to restriction of processing.
• Right to data portability of your data.
• Right to object to the processing.
• Right to withdraw your consent, at any time.

To exercise any of these rights, email us at hello@punchlister.ai. We generally respond within 30 days. If your request concerns project data we process on behalf of your company, we pass it on to your company or handle it in consultation with them.

10. Filing a complaint

If you believe that we are not processing your data correctly and we are unable to resolve this together, you have the right to file a complaint with the Belgian Data Protection Authority (APD/GBA):

Drukpersstraat 35, 1000 Brussels
gegevensbeschermingsautoriteit.be
contact@apd-gba.be

11. Security

We take reasonable technical and organisational measures to protect your data against loss, misuse, and unauthorised access. Traffic to this website and the app is encrypted via HTTPS. Access to your data is internally limited to those who need it to provide the service, give support or follow up on your request.

12. Changes to this policy

We may amend this privacy policy from time to time, for example to align it with new regulations or changes to our services. The most recent version is always available on this page, with an updated date at the top.