Privacy Policy

01What we collect

• Account data: name, email, company name, and role.
• Job data: checklists, task statuses, notes, and schedules.
• Evidence: photos and videos with timestamps, captured by your crew on the job. A photo can also carry metadata the phone's camera embedded directly in the file, device model, capture time, and GPS coordinates if the phone recorded them; we read this but never add to it.
• Location data: a GPS reading at clock-in, used to verify on-site presence.
• Support conversations: if you message us through the chat widget, we keep the conversation, any file you send, and whatever name or email you choose to give us.
• Billing data: your plan, billing cycle, and Stripe customer ID. Card details go straight to Stripe and never touch our servers.
• Technical data: browser and device information, IP address, and the general location (city/country) derived from it, used to keep the service working and secure.
• Website usage data: on the marketing site and the owner dashboard, pages visited, navigation patterns, and on-screen interaction such as scrolling and clicks, collected through Google Analytics and Microsoft Clarity. This does not run on the field crew app or our internal admin tools.

02How we use it

We use this data to operate the service: syncing offline evidence, generating client reports, verifying clock-ins, billing, providing support, and detecting abuse or security issues. We do not use it for anything else.

03What we never do

• We do not sell personal data.
• We do not use evidence or personal data for advertising.
• We do not share data with data brokers.

04Who can see your data

• Your company. Owners and admins at your company can see job data and evidence their crews produce. That is the core function of the service.
• Report recipients. Client reports are shared only with the recipients your company configures.
• Support conversations. A message you send through the chat widget is visible to whoever is answering support, not to other companies.
• Processors. Hosting, email, and payment providers process data under contract, only on our instructions.
• Analytics providers. Google (Analytics) and Microsoft (Clarity) process website usage data on our behalf, limited to the marketing site and owner dashboard.
• Authorities. We disclose data only where the law requires it, and we narrow every request we can.

05Location data

Location is captured at clock-in events to verify on-site presence, and is stored with the job record. Crew members see an indicator in the app whenever a location reading is recorded. Some photos also carry GPS coordinates the phone's own camera embedded in the file; we read whatever is already there and never request or add location data ourselves. Location data is visible to your company's owners and admins, is never sold, and is deleted with the account.

06Retention & deletion

We keep your evidence for as long as your account is active. When an account is closed or you ask us to delete specific data, we remove it within 30 days; backups are cleared within 90 days. Where the law requires longer retention, we keep only what it requires.

07Your rights

You may access, correct, export, or delete your personal data at any time by emailing legal@workaudit.app. If you are in the EU or UK, you also have the rights granted by GDPR, including the right to lodge a complaint with your supervisory authority. We respond to verified requests within 30 days.

08Security

Data is encrypted in transit and at rest. Access is limited by role and logged. No method of storage is perfectly secure; if a breach affects your data, we will notify you without undue delay.

09Cookies

We use strictly necessary cookies for login sessions and security. On the marketing site and owner dashboard, we also use Google Analytics and Microsoft Clarity to understand how the service is used, including page views, navigation patterns, and, through Clarity, recordings of on-screen interaction such as scrolling and clicks. These tools set their own cookies, separate from the ones we set ourselves. We do not use advertising or cross-site tracking cookies, and this usage data is never linked to an advertising profile. The chat widget also stores a conversation identifier in your browser's local storage so it can find your conversation again on your next visit; nothing in it leaves your device except the messages you choose to send.

10Children

The service is for businesses and is not directed at anyone under 16. We do not knowingly collect data from children.

11Changes

Material changes are announced by email and in-app at least 14 days before they take effect. The date above always reflects the current version.

12Contact

Privacy questions: legal@workaudit.app