How Strukta handles your data.

Strukta provides UK construction opportunity intelligence from public planning and tender sources. This notice tells you what personal data we use, why, and what rights you have.

Strukta is a trading name of Konstructa Ltd. Konstructa Ltd is the data controller for personal data in your Strukta account and for the platform's analytical data. For any privacy question, email privacy@strukta.io.

Konstructa Ltd is registered in England and Wales, company number 17255511. Its registered office is 124 City Road, London, EC1V 2NX.

We collect:

• Account details: name, work email, password hash, role.
• Company details: business name, sector, trades, regions.
• Subscription details: plan, billing status, invoices, and (via Stripe) the last four digits of your card.
• Workspace content: saved searches, saved records, notes, tags, workflow status, profile settings, and market intent saves.
• Assistant and research content: prompts, messages, conversation history, saved assistant memory, research briefs, sources used, generated summaries, and usage or credit records.
• Public planning and tender records ingested from UK public sources.
• Market-signal and market-intent records from official feeds, public announcements, trade press, and other public built-environment sources.
• Professional contact information: name, role, company, work email, work phone, direct mobile, and work LinkedIn, sourced from public records, published company information, and contact-enrichment providers.
• Contact-enrichment metadata, such as whether a business email, company phone, or direct mobile reveal was requested and which provider returned it.
• Service logs: IP address, browser, device, timestamps, cookie identifiers.

Data comes from:

• You.
• Your employer or teammates.
• Public planning portals across UK councils.
• National tender feeds: Contracts Finder and Find a Tender.
• Public Companies House records.
• Public professional websites, official organisation pages, trade press, and published company directories.
• Contact-enrichment providers for professional business contact details.
• Your use of Strukta features, including saved records, searches, notes, workflows, assistant prompts, and research actions.

• To provide the app.
• To show construction opportunities relevant to your business.
• To link projects, tenders, companies, and contacts.
• To run the assistant, lead research, market intent, and contact-enrichment features you choose to use.
• To remember assistant context and preferences when you ask us to.
• To keep records fresh and accurate.
• To send account, alert, and service emails.
• To send marketing about Strukta and similar services where you have opted in, or where you started a trial or were a customer, always with an easy opt-out.
• To improve security and product performance.
• To bill subscriptions and meet legal obligations.

We rely on the following lawful bases under UK GDPR:

• Contract: your account, subscription, saved searches, alerts, workspace tools, assistant conversations, lead research, and contact-enrichment requests.
• Legitimate interests: operating public opportunity intelligence, market-intent signals, linking projects, companies and contacts, enriching professional business contact data, keeping data accurate, securing the service, and sending service emails. We balance this against the rights of individuals named in public records, who are generally senior professionals acting in a published business capacity.
• Legal obligation: tax records, accounting, and lawful requests from authorities.
• Consent: non-essential cookies, and marketing emails where we rely on your opt-in.
• Soft opt-in (PECR): occasional marketing about Strukta and similar services to people who started a Strukta trial or have been customers, where we obtained the work email in the course of providing or negotiating a sale. Every such message includes an unsubscribe link, and you can opt out at any time.

We do not use Strukta data to make legal, employment, credit, housing, or similarly significant decisions about individuals.

Strukta uses AI and web-research tools to help customers search records, summarise opportunities, draft business-development notes, identify public market signals, and research companies or contacts linked to an opportunity.

• Ask Strukta may process your prompts, conversation history, selected records, saved memory, and profile settings so it can answer in context.
• Lead research and Researcher may send opportunity details, organisation names, public URLs, and your research question to AI model and web-search providers so they can produce a brief with sources.
• Contact enrichment may send a professional contact name, company name, company domain, or LinkedIn URL to a business-contact provider to look for a work email, job title, LinkedIn URL, company phone, or direct mobile.
• We store research results, assistant messages, usage records, and enrichment provenance so you can reuse them, audit what happened, and avoid repeat paid lookups.
• You can delete assistant conversations and manage assistant memory in the product. You can also email privacy@strukta.io to ask for correction, suppression, or removal of personal data.

We do not intentionally collect special category data (such as health, racial, religious, or trade-union information). If public documents contain unnecessary personal or sensitive details, we aim to minimise, suppress, or remove that information where appropriate.

Strukta may use automated matching to rank projects, tenders, contacts, companies, and market-intent signals against a customer's business profile. This is used to prioritise business records and suggest next actions. It is not used to make legal, employment, credit, housing, or similarly significant decisions about individuals.

We share data with carefully chosen providers and parties only as needed to run the service:

• Hosting, authentication, and database providers, including Vercel and Supabase.
• Payment provider Stripe for billing, payment methods, invoices, and subscription status.
• Email providers, including Resend and Supabase Auth, for transactional, alert, account, and marketing email.
• AI, embedding, and research providers, including DeepSeek, OpenAI, and Tavily, when you use assistant, lead research, Researcher, or market-intelligence features.
• Contact-enrichment provider Apollo when a user asks to reveal or verify professional business contact details.
• Map, postcode, and tile services, including OpenFreeMap, Esri, and postcodes.io, when you use map or postcode search features.
• Runtime, logging, and operational tooling, including Modal and Vercel platform logs.
• Professional advisers, including accountants and lawyers, when required.
• Other Strukta users from your own organisation, within your shared workspace.

We do not sell personal data.

Some providers are based outside the UK, including in the US and the EU. International transfers are covered by the UK Addendum to the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK-US Data Bridge / EU-US Data Privacy Framework where applicable. To request our current subprocessor list, email privacy@strukta.io.

We use a small number of cookies and similar tools. Strictly necessary cookies keep you logged in and the site secure. At present, no optional analytics script is active. If we add one, we will ask for your consent before non-essential cookies load.

You can change your choices any time at /cookies.

• Account data: while your account is active, plus six months.
• Billing records: seven years (UK tax and accounting requirements).
• Assistant conversations, saved memory, research briefs, enrichment usage, notes, tags, workflow status, and saved records: while your account or workspace is active, unless you delete them sooner or ask us to delete them.
• Public opportunity records: while commercially relevant; superseded records may be archived.
• Contact-enrichment lookup records and provenance: while needed to show the result, avoid repeat paid lookups, audit use, and honour suppression or correction requests.
• Suppression and objection requests: kept indefinitely so we can keep honouring the request.
• Service logs: typically 90 days.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Ask for erasure.
• Restrict processing.
• Object to processing, including direct marketing, which is an absolute right.
• Portability where it applies.
• Withdraw consent where consent was the basis.
• Complain to the Information Commissioner's Office at ico.org.uk.

We respond to requests within one month. If a request is complex, we may extend by two further months and will tell you why. Email privacy@strukta.io.

If your professional details appear in Strukta and you want them corrected, suppressed, or removed, email privacy@strukta.io. We will respond within 30 days. If you object to processing based on legitimate interests we will stop, unless we can show overriding lawful grounds; if you object to direct marketing, we will stop.

Strukta is a business-to-business tool. It is not intended for anyone under 18. We do not knowingly collect personal data from children.

We use industry-standard security, including encryption in transit, hashed passwords, scoped access, and audit logs. If a personal data breach occurs that is likely to risk your rights, we will notify affected users and, where required, the ICO within 72 hours of becoming aware.

We may update this notice. The "Last updated" date at the top shows the most recent change. We will tell you about material changes by email or in the app.

Email privacy@strukta.io.

Postal address: Konstructa Ltd, 124 City Road, London, EC1V 2NX.