# AI Data Privacy (Training on Your Data) > AI data privacy in construction is about whether a vendor or model provider uses your estimates, sub pricing, and project data to train models used by other companies, and which contractual and technical controls prevent that use. - Stages: Preconstruction, Estimating - Concepts: Security, Data - Published: 2026-08-28 - Canonical: https://buildr.com/library/ai-data-privacy ## Why it matters in construction A GC's competitive advantage often sits in its information: which subs are reliable at what price, the real margins, which owners pay late, and what the last ten bids on a project type came in at. An AI precon tool can use that information, but it should not feed a model shared with competitors. "Do you train on our data" is now a standard vendor question, and it should be. But the answer needs to be specific. The vendor's own models, the model provider underneath the tool, and any subprocessors in between are three separate answers. ## How it works Data can be used in three ways, each with a different privacy profile: 1. **Prompt and retrieval.** The tool sends your document to the model as part of a request, the model answers, and the request is done. Whether the provider retains the request and whether they train on it are two separate policy questions. 2. **Fine-tuning.** A vendor trains a model on customer data to improve it. If that model is shared across customers, one customer's data shapes another's results. If it is per-customer, it does not. 3. **Aggregate learning.** A vendor uses patterns across customers, such as benchmarks or typical unit costs, without raw documents. This may be a product feature, but it still belongs in the agreement. The controls to look for: - A written commitment in the contract, not a web page, that customer data does not train shared models. - The same commitment flowed down to the model provider. Business API agreements typically include this; consumer products typically do not. - Retention limits on prompts and outputs. - A SOC 2 report or equivalent that covers the AI components as well as the web app. - Clarity on what happens to your data if you leave. ## Example in practice For example, a commercial GC is evaluating two AI estimating tools. Both say "we don't train on your data" on their websites. In the security questionnaire, vendor A confirms in the MSA that neither they nor their model provider trains on customer inputs, names the provider, shares a SOC 2 Type II report, and specifies 30-day prompt retention. Vendor B's MSA is silent on training. Pressed, they explain they fine-tune a shared model on "anonymized" customer bid data. That model has absorbed three years of sub pricing from 40 GCs, some in the same market. Vendor B may produce better unit-cost suggestions. The CFO decides the improvement is not worth putting the firm's pricing history into a pool its competitors draw from and goes with vendor A. ## Go deeper - [The Pros and Cons of ChatGPT in Construction](/blog/chatgpt-construction.md) - [AI and Construction: The GC's No BS Guide to What Works in 2026](/blog/ai-construction-gc-guide-2026.md) - [Subcontractor Prequalification: What to Verify Before Sending a Single Bid Invite](/blog/subcontractor-prequalification-checklist.md) ## How Buildr applies this Buildr publishes how customer data is stored, protected, and handled, including straight answers on certifications and infrastructure, so you can evaluate it the same way you would any AI vendor. See [Buildr Security](/security). ## Related terms - [AI Vendor Evaluation](/library/ai-vendor-evaluation.md): AI vendor evaluation is how a construction company assesses AI software before buying it: data handling, security, accuracy on real bid documents, integration with existing systems, and whether AI is central to the product or added on. - [Fine-Tuning](/library/fine-tuning.md): Fine-tuning further trains an existing AI model on a specific set of examples so it learns a particular style, format, or task. A construction firm might use it to teach a model its conventions for classifying subcontractor scope items. - [Large Language Model (LLM)](/library/large-language-model.md): A large language model (LLM) is an AI system trained on large amounts of text that can read, summarize, and generate language. In construction, it can help parse RFPs, sub proposals, and specifications for preconstruction teams. - [Shadow AI](/library/shadow-ai.md): Shadow AI is the use of consumer AI tools by construction employees without company approval. For example, an estimator might paste a sub proposal or owner contract into a free chatbot, putting confidential project data outside the firm's security and contractual controls. - [The Lethal Trifecta](/library/lethal-trifecta.md): The lethal trifecta is a security pattern in which an AI system can access private data, read untrusted content, and send information out. In construction, a planted instruction in a bid or email can exploit a tool with all three capabilities and expose company data. ## Referenced by - [Activity Capture](/library/activity-capture.md): Activity capture uses AI to log emails, meetings, calls, and site visits against the right contacts and opportunities in a construction CRM. It gives business development teams a usable relationship history without manual data entry. - [Autonomous CRM Updates](/library/autonomous-crm-updates.md): Autonomous CRM updates use AI agents to read emails, calendar events, and call notes, then create or update contacts, opportunities, and activities in a construction CRM without manual data entry for every interaction. ## FAQ ### Does using an AI tool mean the model learns from my data? Not necessarily. Most business-tier AI products and API agreements exclude customer data from training by contract. Consumer-tier products often do not. The answer depends on the specific agreement, so read it rather than assuming. ### What is the difference between training on my data and retrieving my data? Retrieval means the model looks up your documents at query time to answer your question; nothing changes in the model itself. Training means your data alters the model's weights, which can then influence answers for anyone using it. ### Is my sub pricing really at risk? The usual risk is not a competitor extracting your exact numbers from a model. It is that pricing patterns, margin habits, and sub relationships become part of a model that competitors also use. A contractual exclusion from training is the standard protection.