How we handle personal data

Effisus — Building Solutions, S.A. is the controller of the personal data described here. Write to us at privacy@effisus.com about anything on this page.

The platform was built and is maintained for Effisus by NILG.AI, Lda., which acts on our instructions as a processor.

Effisus staff. Name, work email, role in the platform, the markets you follow, and whether you want the daily digest. This is here so you can sign in and so the tool can show you your own work.

Visit notes. When a member of staff records a voice note or writes a note after a client visit, we keep the recording, its transcript and the report made from it, which name the people they met and what was discussed. The recording is deleted thirty days after the report is filed, or thirty days after it was made if it is never filed. The report is filed on the customer record in Zoho CRM; the transcript and the report stay in the platform for 24 months and are then redacted. The recording is transcribed by OpenAI, and the report is laid out by OpenAI or Anthropic, all in the United States under standard contractual clauses. Sales managers can read their team’s transcripts and reports, not the recordings, and each time they open one it is logged.

Visits due. To show each member of staff which of the customer accounts they own are due a visit, we copy from Zoho CRM the rating of each account and the date and kind of the tasks closed on it, going back a little over a year. We do not copy what a task says or who closed it, and each person’s list is shown only to them. A closed task is deleted from the platform 400 days after it was closed, since no visit interval reaches further back. The source is Effisus’s own Zoho CRM, hosted in the United States, and the basis is Effisus’s legitimate interest in planning its commercial visits (Article 6(1)(f) GDPR).

People who work at companies involved in construction projects. Typically a name, job title, the company, a work email address, a LinkedIn profile address, and the city and country. Sometimes a phone number. These are business contact details of people in professional roles — developers, main contractors, architects, procurement teams.

People named in construction news. When a published article names the company behind a project, we record that company and its role, together with the sentence in the article that says so.

Published news articles; company websites; Apollo.io, a business contact database; public LinkedIn pages; and Zoho CRM, where Effisus already keeps its own customer records.

We do not buy consumer data, we do not track anybody across the web, and the platform sets no advertising or analytics cookies of any kind.

For Effisus staff, the basis is our contract with you as an employee and our legitimate interest in running the business.

For everyone else, the basis is our legitimate interest (Article 6(1)(f)) in reaching the people responsible for the building envelope on a project we can supply. We weighed that interest against your privacy and wrote the assessment down; the short version is that we hold work contact details of people in professional roles, for a purpose those roles exist to serve, and that we stop the moment you ask.

The platform never sends you anything. It has no code that emails or messages a contact. If you hear from Effisus, a person decided to write to you and wrote it themselves.

Then you are the reason this page is public. Article 14 of the GDPR says we have to tell you we hold your data — and where telling each person individually would take disproportionate effort, that we publish the information instead and make it easy to act on. That is what this page is, and the rest of this section is the part that matters.

You can tell us to stop, and we have to. Because we hold your details for direct marketing, your right to object under Article 21(2) is absolute: there is no balancing, we do not get to argue, and we do not ask why. Email privacy@effisus.com and say so.

When you do, we delete what we hold about you and add you to a suppression list. That list is the point: without it, the next time our systems looked at your company you would simply reappear. It keeps only what is needed to recognise you and leave you alone.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, and ask for it in a portable format. Write to privacy@effisus.com and we will answer within one month.

If you are not satisfied, you can complain to the Comissão Nacional de Proteção de Dados, the Portuguese supervisory authority, or to the authority where you live.

Construction is slow: three to five years often pass between a project first appearing in the news and the point where the building envelope is specified. Contact details are therefore kept for up to 36 months from the last time the related project showed any activity, and then deleted.

An objection is honoured immediately and does not wait for that clock.

The platform runs on Supabase (database) and Vercel (hosting). It uses OpenAI and Anthropic to read articles, to answer questions staff ask the in-platform assistant, and to transcribe and organise visit notes (the API data is not used to train their models), Voyage AI for search, Apify for collecting published pages, Serper for web search, Google for turning addresses into map positions, Apollo.io for business contact data, Resend for internal email, and Zoho CRM. Each acts on our instructions under a contract.

Some of these are based outside the European Union. Where that is the case we rely on the European Commission’s standard contractual clauses or an adequacy decision. You can ask us for the current list of processors and where each one operates.

We do not sell personal data, and we do not share it with anyone for their own purposes.

The platform uses AI to read published construction articles and pull out facts about projects, to score how relevant a project is to what Effisus makes, to turn a staff member’s visit note into a report, and to draft text for a person to review. Anything a model inferred is marked as inferred in the interface until a person confirms it, and a visit report reaches the CRM only after the person who recorded it has read it and sent it, marked as drafted by AI.

No automated decision is made about any individual. Nothing here decides anything with a legal or similarly significant effect on a person, and no AI-written message is ever sent without a person reading it, editing it, and sending it themselves.

If we change how any of this works we will update this page and change the date at the top. If the change is significant and we have a way to reach you, we will.