Privacy policy
How SESA collects, uses, stores and shares information, and the choices you have about it.
Who this covers
This policy explains how SESA Technologies, Inc. (SESA, we) handles information when you visit our website, when you contact us, and when your organisation uses the SESA service.
SESA is used by organisations rather than individuals. Where your employer or client has an agreement with us, that agreement governs how we handle the project content they put into the service, and this policy explains the rest. Where the two conflict on the treatment of that content, the agreement takes precedence.
Your project content, and information about you
We treat two things differently, and the distinction runs through the whole of this policy.
Project content is what your organisation puts into SESA or connects us to: contracts, specifications, addenda, drawings, submittals, RFIs, test reports, correspondence and the requirement records SESA builds from them. SESA claims no ownership of it. We handle it on your organisation's instructions to provide the service, and we do not use it for our own purposes.
Account and usage information is information about the people who use SESA and about visitors to this site: names, work email addresses, role, the pages and features used, and technical records of access. We decide how this is handled, within the limits this policy sets.
What we collect
Information you give us. Your name, work email address, employer, role and anything else you include when you request a demo, email us, or set up an account.
Meeting scheduling. Opening an embedded booking calendar connects your browser to Calendly and sends technical information such as your IP address and browser data. If you book a meeting, Calendly also receives the details you enter.
Project content. The documents your organisation uploads, and the records SESA reads from the systems you connect. This is described in the clause on connected systems below.
Information created by using the service. The requirement sets, evidence matches, verification statuses and review decisions SESA produces, together with the record of who approved what and when. That record is a core part of the product: the service exists to show its work, and it cannot do so without keeping an account of it.
Technical information. Site and service logs may include IP address, browser and device type, pages or features requested, and access times. Calendly may collect separate browser information when you open its calendar, as explained below.
How we use it
We use project content only to provide the service to the organisation that supplied it: to extract requirements, to match them against evidence, to re-verify them when a governing document changes, and to produce the compliance records and exports your team asks for.
We use account and usage information to give you access, to support you, to keep the service secure and reliable, to bill for it, and to tell you about changes to it. We use technical information to operate and protect the site and the service.
Where data protection law requires a lawful basis for information whose purposes we determine, we rely on our legitimate interests in responding to enquiries, providing access, supporting and securing the service, and communicating operational changes; on legal obligations for records we must keep; and on consent where we ask for it. For project content processed on your organisation's instructions, that organisation determines the lawful basis for the processing it asks us to perform.
Automated processing, and what we never do with your content
SESA reads documents and proposes matches between requirements and the evidence that satisfies them. That processing is automated, and it is why the service is worth using.
Your content is never used to train models. We make the same commitment on our homepage and in our terms of service: project content supplied by one customer is not used to train, fine-tune or improve any model, and is not used to serve any other customer.
No requirement is closed automatically. SESA proposes; a person on your team accepts, rejects or reassigns. Nothing the service produces is a certification, professional advice, or a substitute for your own sign-off, and you remain responsible for the compliance decisions you make.
Connected systems
SESA can connect to the document and project systems your organisation already runs, including Procore, Autodesk Construction Cloud, Aconex, e-Builder and SharePoint. Those are third-party services and their own privacy terms govern what they do with your data.
A connection is made by someone in your organisation with authority to make it, and it grants us only the access needed to read the records the service matches against. We do not write to, alter or delete anything in a connected system unless your organisation asks us to and the connection permits it.
When a connection is removed, we stop reading from that system. Records already read and the requirement history built from them are retained as described in the clause on retention below, because removing them would destroy the compliance record your organisation relies on.
How long we keep it
We keep project content and the requirement records built from it while your organisation's account is active. Our published terms provide 30 days after termination for export, followed by deletion or anonymisation except where retention is required. A signed customer agreement may provide a different period.
Account information is kept while the account is open and for as long afterwards as we need it to meet our legal, tax and accounting obligations. Technical logs are kept for a limited period appropriate to security and troubleshooting, and access records are kept for as long as the compliance record they support.
On a valid deletion request we delete or irreversibly anonymise the information, except where we are required to keep it. Backups are overwritten on their ordinary cycle, so a record may persist there briefly after deletion from the live service.
How we protect it
Information is encrypted in transit and at rest. Access is role-based, granted on the principle of least privilege, and every access is logged and auditable. These are the same four commitments we make on our homepage.
Internally, access to project content is limited to the people who need it to run and support the service, and is reviewed. Contact us for current information about independent audits or certifications and for evidence needed in a security review.
No service can promise perfect security. If a breach affects your information we will notify you and, where required, the relevant regulator, within the time the law allows.
Your rights
Depending on where you are, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to or restrict how we use it, and to withdraw consent you have given.
If you are in the European Economic Area or the United Kingdom, applicable data protection law may give you these rights, and you may complain to your national supervisory authority. Where California privacy law applies, California residents may have rights to know, delete, correct and opt out of sale or sharing.
If we rely on legitimate interests to process your personal information, you may object to that processing by contacting us.
To exercise a right, write to us at the address below. We will respond within the period the applicable law sets, and we will not treat you differently for asking. Where the request concerns project content, we will refer it to the organisation whose content it is, since they direct how it is handled.
Where your information is held
SESA is operated from the United States and information is processed on infrastructure operated by our hosting providers.
If we transfer personal data out of the European Economic Area or the United Kingdom, we use a lawful transfer mechanism and apply safeguards required for that transfer. Contact us for the current details relevant to your organisation.
Customers with a specific hosting or data residency requirement should raise it before signing; we will tell you plainly whether we can meet it.
Children
SESA is a business service and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.
Changes to this policy
We update this policy as the service changes. When a change materially affects how we handle your information we will tell affected customers in advance, by email or in the product, and update the effective date at the top of this page. The current version is always the one published here.
Contact
Questions about this policy, and any request to exercise a right under it, should go to justin.kunimoto@usesesa.com.
For postal inquiries, write to SESA Technologies, Inc., 5122 Mertola Drive, El Dorado Hills, CA 95762, United States.
If you are contacting us on behalf of an organisation that uses SESA, tell us which one. This lets us route the request to the right records without a round trip.