Siteliner
How Siteliner handles your data
Siteliner is a construction operations platform: one project record from estimate to handover, with AI assistants that work on your company's own documents, rates and processes. This policy explains what we collect, why, and what you control. Short version: your company's data stays your company's data, we use it to run your workspace and nothing else, and connected services such as Microsoft 365 are read only with your explicit consent and only for the person who connected them.
1. Who we are
Siteliner is operated by Pantaia (the "operator", "we"). Contact for anything in this policy: hello@siteliner.ai. For the purposes of data protection law, the company that owns a workspace (our customer) is the controller of the business data inside it; we act as its processor. For your account details and our website we are the controller.
2. What we collect
- Account data: name, work email, role in the platform, and a hashed password or a session token. Never a plain-text password.
- Workspace data: what your company puts into its workspace: projects, cost sheets, opportunities, suppliers, purchase orders, invoices, uploaded documents (tender packs, drawings, product data sheets, cost sheets), snags, photos, and the conversations you have with the assistant.
- Usage data: server logs (time, request path, IP address, browser) kept for security and reliability, and per-workspace storage metering.
- Connected services: if you connect Microsoft 365 (see section 5), an encrypted refresh token for your own account and the data read at the moment you ask the assistant for it.
We do not use advertising trackers on the platform. The public website uses no analytics cookies.
3. Why we use it
- To run your workspace: store your records, generate documents, run the estimating, documentation and snagging assistants, and answer your questions.
- To train nothing. Your documents and data are used to answer your own company's requests and to build your own company's knowledge base. They are never used to train models, and never shared with other customers.
- To keep the service secure, meter storage, and support you when you ask.
4. AI processing
When you use an assistant, the relevant parts of your workspace data (for example a tender pack and your rates) are sent to an AI model provider to produce the result, over encrypted connections, under terms that prohibit the provider from training on that data. A workspace administrator can choose the model provider and bring the company's own provider account; in that case the provider's own terms apply to those requests. AI output is a draft for a professional to review; see the terms.
5. Microsoft 365 and other connected services
What connecting Microsoft 365 does. A user can connect their own Microsoft 365 account so the assistant can read their Outlook mail and calendar, search and read the SharePoint and OneDrive files they can already open, and save email drafts to their Drafts folder. Access is delegated: the assistant can only see what that person can see, and it acts only when that person asks.
- We ask Microsoft for these permissions only: read and write access to mail (to read and to create drafts; we never send mail), read calendars, read sites and files, sign in and read the basic profile, and offline access so the connection stays alive.
- We store one thing: an encrypted refresh token for that user. Mail, events and files are fetched at the moment of a request, used to answer it, and are not copied into the workspace unless the user explicitly saves something.
- Disconnecting in Integrations deletes the stored token immediately. Revoking the app in the Microsoft account settings has the same effect.
- Nothing is set up on the company's Microsoft tenant by us; consent is given by the user, or by their administrator if their organisation requires it.
Agents outside the platform (for example a company's own automation) can be given access to a workspace through a personal access token created by a user. Such an agent acts as that user and can do nothing that user could not do; tokens can be revoked at any time.
6. Where data lives and who helps us run the service
Workspaces run on cloud infrastructure in the European Union and the United Kingdom region where available (application hosting and databases) and a global edge network for the web front end. Sub-processors: hosting and database providers, the AI model provider selected for the workspace, and Microsoft when a user connects Microsoft 365. Each is bound by a data-processing agreement. We do not sell data, and we do not share it with anyone else except when the law requires.
7. Retention
Workspace data is kept for as long as the workspace exists. When a customer ends its subscription we return or delete the workspace data within 30 days of the request. Server logs are kept for 90 days. Assistant conversations can be deleted by the user at any time.
8. Security
Encrypted connections everywhere, encrypted storage for secrets (provider keys, connected-service tokens), role-based access inside each workspace, isolated deployments per customer, and audit marks on edits to financial records. Passwords are hashed; access tokens are stored only as hashes.
9. Your rights
You can ask us to access, correct, export or delete your personal data, and to stop a particular processing, by writing to hello@siteliner.ai. If you are a user inside a customer's workspace we may need to route the request through that customer. You can complain to your local data protection authority; we would rather you talk to us first.
10. Changes
We will post changes here with a new effective date, and tell workspace administrators about material changes before they take effect.