PrivacyPolicy.

This policy describes how Building Reference United Company (BRU CO.) handles information in the BRU Mobile application. BRU Mobile is not a public consumer app: it is used by BRU staff and by clients of BRU projects, and every account is assigned a role together with a project or site scope.

It covers the mobile application only. The public website at www.bru.com.sa is a separate, informational site.

BRU Mobile collects only what the work in the app requires. In practice that falls into the following categories.

Information in BRU Mobile is used to operate the app and to deliver construction projects: to sign you in and keep your session secure, to show you the projects and sites you are assigned to, to create and route reports, to deliver messages and notifications, to record authorized site attendance, and to respond when you contact support.

BRU does not sell personal information, does not share it for advertising, and does not use it for advertising profiling. BRU Mobile does not include third-party analytics, advertising or crash-reporting software development kits.

Location is used when necessary to verify authorized site attendance and related operational features. For eligible field users, BRU Mobile can record attendance when the device verifies presence within a site the user is assigned to. There is no manual check-in button.

Where the operating system permits it and you have granted the permission, BRU Mobile may check location in the background so that attendance can be verified without the app being open. Background location is subject to iOS and Android restrictions, which can delay or prevent verification.

BRU does not continuously display off-site employee movement to clients. Location is not used to build a movement history for its own sake, and role-based access controls determine who can see operational information.

Location permission is optional and is requested by the operating system. You can decline it, or withdraw it later in your device settings. If you do, automatic attendance and any feature that depends on verifying site presence will not work, but the rest of the app continues to function.

Access in BRU Mobile is role-based. What you can open is limited to the projects and sites your account is assigned to, and to the role an approver granted you. Approving an access request does not automatically grant the role that was requested — the approver sets the final role and scope.

Client accounts are scoped to the client's own project. A client can see progress, milestones, the project gallery and messages for that project, and does not receive access to other projects or to staff information.

BRU Mobile relies on a small number of providers to operate. They process information on BRU's behalf and for no independent purpose of their own.

Because these providers operate globally, some information is processed or stored outside the Kingdom of Saudi Arabia. Where that happens, BRU applies appropriate contractual, technical and organisational safeguards as required by applicable law.

Information is transmitted over encrypted connections and is protected in the platform by access rules tied to your account's role and assignment, so that a request for data outside your scope is refused at the source rather than filtered in the app.

Sign-in credentials and session tokens are held in the secure storage provided by your device's operating system. If you enable Face ID, Touch ID or an Android biometric unlock, the biometric check is performed by the operating system and your biometric data never leaves your device and is never sent to BRU.

No system is perfectly secure. If you believe an account has been compromised, contact BRU immediately using the details below.

BRU retains account, project, attendance, report, communication and operational records only for as long as reasonably necessary to provide the service, maintain project and contractual records, meet legal or regulatory obligations, resolve disputes, and enforce agreements. When data is no longer required, it is deleted, anonymised, or securely archived in accordance with applicable requirements.

Project records — reports, progress entries, site photographs, uploaded documents and attendance records — form part of the construction record of a project, and are retained under that rule for as long as the project and its obligations require.

Account and profile information is retained while your account is active. Push tokens are removed when you sign out, uninstall the app, or turn notifications off.

Users may request account deletion directly from within BRU Mobile. Users may also contact BRU support for assistance with account or data requests. Deleting an account removes your profile and sign-in credentials and revokes your access.

Work already recorded against a project — a submitted report, a site photograph, an attendance record — remains part of that project's construction record and is retained under the rule described above, because it documents the delivery of the project rather than describing you.

BRU Mobile is a workplace application for BRU staff and BRU clients. It is not directed to children and BRU does not knowingly create accounts for them.

BRU handles personal data in accordance with the applicable laws and regulations of the Kingdom of Saudi Arabia, including the Saudi Personal Data Protection Law (PDPL) where applicable.

If this policy changes materially, the updated version will be published on this page and the date below will be revised. Continued use of BRU Mobile after that date is subject to the updated policy.