Privacy policy

Personal data processing in the system is the responsibility of the data controller whose details are listed in the controller section of this page. You can contact the controller about any data processing question using the email address provided.

If you use the system on behalf of your employer or client, the controller of the data entered into estimates and projects may be that company, and we process such data as a processor acting on the company instructions.

Account data: first name, last name, email address, profile picture and identifier received from the Google sign-in service, as well as your assigned user group, permissions and selected language.

Work data: company and project information, estimates, positions, materials, prices, work schedules and other data that you or your organisation enter into the system.

Technical data: sign-in time, IP address, browser and device information, and system logs required for security and troubleshooting.

Consent data: your choice of cookie categories and the time when it was made.

Providing the service and managing your account — the basis is performance of a contract or steps taken before entering into a contract (GDPR Article 6(1)(b)).

System security, troubleshooting and prevention of abuse — the basis is our legitimate interests (GDPR Article 6(1)(f)).

Optional cookies and similar technologies — the basis is your consent (GDPR Article 6(1)(a)), which you can withdraw at any time.

Accounting and other statutory requirements — the basis is compliance with a legal obligation (GDPR Article 6(1)(c)).

The system uses strictly necessary cookies required for sign-in and security, and optional cookies for which we ask your consent. The full list and consent management are described in the cookie policy.

Data is processed only by authorised users in your organisation according to their permissions, and by our IT service providers acting under a data processing agreement.

The main processors are our cloud infrastructure and database provider (Supabase), our application hosting provider and Google as the sign-in identity provider.

We do not sell your data and do not share it with third parties for marketing purposes.

Data is primarily stored in the European Union. Where data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the standard contractual clauses approved by the European Commission.

Account and work data is retained while the account or the contract with your organisation is active. After the account is closed we delete or anonymise the data within a reasonable period, unless law requires longer retention.

Technical logs are kept for up to 12 months, and the cookie consent record for up to 6 months, after which we ask for consent again.

You have the right to access your data, to rectify inaccurate data, to request erasure or restriction of processing, to object to processing based on legitimate interests, and to receive your data in a structured, machine-readable format (data portability).

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal. You can change your cookie consent using the "Cookie settings" link in the page footer.

To exercise your rights, write to the controller email address provided. We will respond within one month. If you believe your rights have been infringed, you can lodge a complaint with the supervisory authority.

We use encrypted data transmission, access control based on user groups and permissions, database-level access restrictions and regular security checks. In the event of a personal data breach that poses a high risk, we will notify you and the supervisory authority within the period required by law.

We do not carry out automated decision-making or profiling that would produce legal effects concerning you or otherwise significantly affect you.

We may update this policy over time. We will notify you of material changes in the system or by email. The date of the latest update is always shown at the top of this page.

Send questions about privacy and data processing to the controller email address listed in the controller section of this page.