All policies · CONSTRUX

Last updated 6 September 2026

Everything that governs how the platform is run and used. Where a policy describes something not yet built, it says so rather than being written in the present tense.

Terms of Service: The terms on which the service is provided.
Privacy Policy: What personal data is held, why, and what is never done with it.
Acceptable use: No unlawful content, no attempts to reach another tenancy, no automated traffic that degrades the service for others. Security testing against your own tenancy is welcome — tell us first.
Security disclosure: Report a vulnerability to contact@construxvg.com with SECURITY in the subject. We will not pursue anybody acting in good faith within their own tenancy, and we will credit you unless you ask us not to.
Cancellation: Cancel at any time from the console, or by writing to contact@construxvg.com. The subscription runs to the end of the period already paid for and is not renewed. Nothing is deleted on cancellation: the record goes read-only and stays exportable, because an evidential chain a customer cannot take with them is a chain that was never theirs.
Refunds: A period is refunded in full where the platform did not provide the service it was charged for. Unused time in a period a customer chose to leave part-way through is not refunded, and the period is not renewed. AI credit that has been spent is spent — it was passed to a provider who has already been paid for it — and unspent credit is refundable on request. Statutory rights are unaffected and none of this displaces them.
Data retention: The event chain is retained for the life of the tenancy. Notification delivery records are retained because "we told you on the 14th" must stay answerable. Bounded operational logs rotate and are never the source of a metric. Where off-host backup is configured, a bounded number of recent copies of the record is held in object storage and the oldest is discarded as each new one lands — so a copy of your data outlives a deletion inside the platform by as long as that window, which is a property of having backups at all rather than a policy choice we could make differently.
Sub-processors: The SMTP relay, and the AI providers named on each AI event with model class and cost. Any channel with no provider configured records as dispatched-not-transmitted.
AI usage: Governance decisions refuse AI authorship at the catalogue level, so no agent can reach one. Almost every agent is confined to PROPOSE; the few that may act unattended do so only inside a revocable, dated envelope a person granted, naming the permitted commands, and none carries authority over money. Costs are quoted before an action runs and charged against the wallet with a ledger entry.
Accessibility: A WCAG 2.2 AA audit has been run against the signed-in console in a real browser, and what it found was fixed: three text colours that failed contrast on the surfaces they were used on, missing landmark regions, nineteen decorative icons that announced themselves, and a heading outline that skipped a level across 254 card titles. It reports clean on language, one h1 per view, control and input labelling, table headers, target size and a uniform focus state. That is not a conformance statement and we will not call it one: the audit is automated, at one viewport, on the console — it does not cover these marketing pages, keyboard traps, screen-reader announcement order, reflow at 320 pixels, or the cognitive criteria. What is true is that the failures an automated check can find have been found and fixed.

This document describes how the platform behaves. Where it states a technical guarantee — chaining, redaction, tenancy isolation, notice handling — that behaviour is implemented and tested, and the corresponding test is the thing that keeps this page true.