installIQ

Privacy Policy

Last updated: June 2026

1. Who we are

[Your Company Name] ("we", "our", "us") operates installIQ, a construction and installation project management platform. We are the data controller for personal data processed through this service.

Data Controller Contact: privacy@yourdomain.com

2. What data we collect

Account Data: Name, email address, organisation name, language preference, profile information.

Project & Work Data: Project names, site addresses, client details, issue records, asset registers, form responses, photos and documents you upload, meeting notes, RFI records, cost information, schedule data.

Voice Input Data: Audio captured via voice input features is transcribed in real-time by your browser's SpeechRecognition API and is NOT transmitted to or stored on our servers. Only the resulting text transcription is stored.

Image Data: Photos you capture or upload are stored securely. Images sent to our AI Equipment Vision feature are transmitted to Google's Gemini API (via the Lovable AI Gateway) for analysis (see Section 4).

Usage Data: Actions taken in the app, features used, session duration, device type, browser type, IP address.

3. How we use your data

  • To provide and operate the installIQ service under your subscription contract (GDPR Art. 6(1)(b))
  • To power AI features via Google Gemini (through the Lovable AI Gateway — see Section 4) based on your use of those features (Art. 6(1)(b))
  • To send service notifications (issue assignments, approvals, due dates) based on legitimate interests (Art. 6(1)(f))
  • To improve the service through aggregated usage analysis (Art. 6(1)(f))
  • To comply with legal obligations including tax records, audit requirements (Art. 6(1)(c))

4. AI processing — important disclosure

installIQ uses Google Gemini AI (delivered via the Lovable AI Gateway) to power the following features: AI Copilot, Compliance Advisor, Fire & Safety Expert, Quick Capture Agent, Smart Pre-fill, Equipment Vision, and Document Scanner.

When you use these features, your text input and any images you explicitly submit for analysis are routed through the Lovable AI Gateway (ai.gateway.lovable.dev) to Google's Gemini API for processing. This may constitute a transfer of data to Google LLC (USA) and Lovable's infrastructure providers, covered by Standard Contractual Clauses.

Google processes Gemini API requests according to its Generative AI Terms. Data submitted via the paid Gemini API is not used to train Google's models. For Google's privacy practices see: policies.google.com/privacy

AI responses are generated automatically and may contain errors. Always verify AI-generated guidance with qualified professionals, particularly for fire safety, regulatory compliance, and structural matters.

5. Data storage & security

Your data is stored on Supabase infrastructure in the European Union. We use industry-standard encryption in transit (TLS) and at rest. Access is controlled by row-level security policies.

6. Data retention

  • Account and project data: retained while your account is active
  • Deleted project data: permanently removed within 30 days of deletion
  • Audit logs: retained for 7 years (legal requirement for business records)
  • Account deletion: all personal data removed within 30 days of verified deletion request
  • Voice audio: never stored — processed entirely in-browser

7. Your rights under GDPR

You have the right to:

  • Access: request a copy of your personal data (Settings → Data Management → Export My Data)
  • Rectification: correct inaccurate data (edit your profile in Settings)
  • Erasure: delete your account and all associated data (Settings → Account → Delete Account)
  • Portability: export your data in machine-readable format (Settings → Data Management → Export)
  • Object: object to processing based on legitimate interests
  • Restriction: request restriction of processing in certain circumstances
  • Withdraw consent: where processing is based on consent

To exercise rights not available in-app: privacy@yourdomain.com

8. Third-party services

  • Google LLC (USA) — AI processing via Gemini API (routed through the Lovable AI Gateway). Data transfer covered by Standard Contractual Clauses.
  • Supabase Inc (USA, EU infrastructure) — Database, authentication, and file storage.
  • Google LLC (USA) — OAuth authentication (only if you sign in with Google).
  • Apple Inc (USA) — Sign In with Apple (only if you use Apple sign-in).

9. International transfers

Data is primarily stored in the EU. AI feature data is processed by Google in the USA via the Lovable AI Gateway. This transfer is lawful under GDPR Article 46 via Standard Contractual Clauses.

10. Cookies and local storage

We use: localStorage for session tokens, language preferences, and app state. No advertising cookies. No third-party tracking.

11. Children

installIQ is a professional B2B tool. We do not knowingly collect data from persons under 16.

12. Your supervisory authority

You have the right to lodge a complaint with your local data protection authority:

  • Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
  • Belgium: Gegevensbeschermingsautoriteit — dataprotectionauthority.be
  • Germany: Bundesbeauftragter für den Datenschutz — bfdi.bund.de
  • Sweden: Integritetsskyddsmyndigheten — imy.se
  • France: CNIL — cnil.fr
  • Spain: Agencia Española de Protección de Datos — aepd.es
  • Italy: Garante per la protezione dei dati personali — garanteprivacy.it
  • United Kingdom: Information Commissioner's Office — ico.org.uk
  • Poland: Urząd Ochrony Danych Osobowych — uodo.gov.pl
  • Czech Republic: Úřad pro ochranu osobních údajů — uoou.gov.cz
  • Slovakia: Úrad na ochranu osobných údajov — dataprotection.gov.sk
  • Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság — naih.hu

13. Updates

We may update this policy. Material changes will be notified via email and in-app notice. Continued use after 30 days constitutes acceptance.

Privacy PolicyTerms of ServiceCookie Notice