Privacy notice

Last updated 26 September 2026. Applies to siteplume.com, api.siteplume.com and the Siteplume Field app.

Who operates Siteplume

Siteplume is operated by Plumeware LLC. Questions about this notice: our contact page.

What we collect and why

• Account details: name, work email, password (stored hashed), and the organisation and project roles given to you by a project director. Needed to sign you in and to decide what you may see and do.
• Two-step sign-in: an authenticator secret and hashed recovery codes, if you enable it or your organisation requires it.
• Project records you create: inspections, RFIs, NCRs, submittals, letters, forms, punch items, daily logs, meeting minutes, comments and decisions, each recorded with your name, role and the time. These form the project's contractual record and are kept for the life of the project and the retention period agreed with the client.
• Photos and files you upload, with their capture time and, when you allow it, the location where a photo was taken. Location is used only to place the photo as evidence; the app asks for permission and works without it.
• Device token for push notifications, if you allow notifications in the app. Used only to deliver notifications about your projects.
• Technical logs: request time, address and outcome, kept briefly for security and reliability. When something goes wrong in the web app or the field app, the error message, the page or screen (without its address parameters) and the app version are kept for 30 days to fix it.
• Walkthrough requests from the public site: your name, work email, company and what you write, kept for a year to arrange the walkthrough and then deleted.

What we do not do

• We do not sell personal data or use it for advertising.
• We do not use your photos or documents to train AI models. Where AI features are enabled by the operator, your text and documents are sent to the AI provider only to produce the draft or answer you asked for.
• We do not track you across other apps or websites.

Who can see your data

Members of the same project, according to their roles under the construction contract: for example the contractor's team sees the inspections and NCRs on their project but not another project. Organisation owners and administrators can see the members of their organisation. Our hosting providers (the services listed on the subprocessors page) process data on our behalf under their terms.

Where data is stored

In the data centres of the services listed on the subprocessors page; ask us which region. Checking the latest backup…

Your choices

• Change your name, password and two-step sign-in under Account.
• Turn email digests off from the notification bell; turn push notifications off in your phone's settings.
• Ask your project director to remove you from a project, or your organisation's administrator to close your account. Records you created stay in the project's history, because they are part of the contractual record, but they no longer identify a live account.
• Download a copy of your data from your Account page, or ask us for it or to correct it.

Changes

We will post changes to this notice here and note the date above.