Who is responsible for your data
Christhian Paul Rodriguez Almarales, a natural person, at Via Damiano Chiesa 1, 43036 Fidenza, Italia. There is no company behind this: I answer for it myself.
For anything about your data — knowing what I hold, correcting it, taking it with you or deleting it — write to progetmanagement@gmail.com. I answer, not a form.
What data is in here
About the business using the service: name, address, phone, email, licence number and tax numbers. These print on every estimate and invoice it issues, because Quebec law requires them.
About its clients: name, phone, email and job address. The contractor enters these, not us.
About its workers and subcontractors: name, phone, trade, hourly rate, logged hours and — when clocking in from the phone — the GPS position at that moment. If the contractor uploads them, also their own documents such as a contract or a T4.
About what is invoiced and collected: amounts, taxes, dates and payment method.
What they are used for
To make the software work, and nothing else. They are not sold, not rented, not used for advertising and not used to train any model.
GPS position is stored only at the moment of clocking in or out, so it can be said where the punch happened. There is no continuous tracking: the app does not know where anyone is between punches.
A worker never sees another worker's pay or rate. What each person earns is between them and the office.
Where they are
Stored, in Canada. The database and the files are hosted on Supabase, in its Montreal region (`ca-central-1`). That is where everything lives and it does not move from there.
In use, they pass through Germany. The server that serves the software is in Frankfurt. It stores nothing: it asks Montreal for what a screen or a PDF needs, and lets go of it when done. But while you work, the data passes through there, and that belongs in plain sight rather than in the fine print. Germany is under the European GDPR, which gives protection equivalent to what Quebec requires.
My being in Italy adds nothing to that: I administer the system from here, but there is no copy of your data on my computer.
Who else sees them
Only these, and only what each one needs:
Supabase — holds the database and the files. Montreal, Canada.
Hostinger — rents the server the software runs on. Frankfurt, Germany. It stores nothing; the data passes through while you work.
Stripe — processes card payments. It receives the amount and the payer's details; the card never passes through our server.
Intuit (QuickBooks) — only if the contractor connects their accounting. It then receives their clients, invoices, payments and expenses, which is exactly what goes in their books.
Resend — sends the system's emails. It receives the address and the content.
OpenStreetMap — draws the maps and turns an address into coordinates. It receives the address being looked up.
None of them receives anything for their own purposes.
How long they are kept
For as long as the business uses the service. If it stops and asks me, I delete everything of theirs.
With one exception that is not ours to make: issued invoices are not deleted while the law requires them to be kept. In Canada that is six years. That is why, when a client asks to have their data deleted and they have invoices, the system refuses and says so — write to me and we resolve it without breaking anyone's accounting.
Your rights
You can ask to see what exists about you, correct it, take it with you as a file, delete it, or object to its use. Write to progetmanagement@gmail.com and I answer within a month at most — usually within days.
If you are a worker at a company that uses this, start with your office: the data is theirs and they enter it. If they don't answer you, write to me anyway.
If you think I have not handled it properly, you can complain to the Commission d'accès à l'information du Québec if you are in Quebec, or to the Garante per la protezione dei dati personali in Italy.
What is stored in your browser
Your session, the language you picked and a couple of screen preferences. Nothing else.
There are no advertising or tracking cookies, ours or anyone's. That is also why you will not see a cookie banner: there is nothing to consent to.
If this changes
It will: the product is young. When something that matters changes, I tell the business by email before it takes effect, and the date above is updated.
The day there is a company behind this instead of a person, that will be said here too.
Responsible party
Christhian Paul Rodriguez Almarales
Via Damiano Chiesa 1, 43036 Fidenza, Italia
progetmanagement@gmail.com