Privacy Policy

1. Who is responsible for your information

Most of what is in Jobsite Nexus is a project record that a construction company (our customer) keeps about its own work: schedules, roadblocks, daily logs, RFIs, documents and photos. For that record the company decides what is entered and who can see it, and we process it on its behalf. If you want something in a project record corrected or removed, the company that runs the project is usually the right first contact; we will help them do it.

For your account (your login, and the security and usage records tied to it) we decide how the information is used, and we are responsible for it.

2. What we collect

• Account details: your name, email address, optional phone number, company, role, and a one-way hash of your password (we never store or see the password itself).
• Project records you or your team enter: schedules, roadblocks, daily logs, RFIs and responses, checklists, documents and drawings, comments, and replies you send to Jobsite Nexus emails, which are added to the record they answer.
• Photos and files you upload. Photo files can carry information your device adds, such as when and, if your device records it, where the photo was taken.
• Site sign-in and time records, if your company uses them, including the location your device reports when you sign in at a site that checks it.
• Device and log data: your IP address, browser and device type, sign-in sessions, the time of requests, and error and security logs from our servers.
• Error reports and beta access requests: what the web app sends us when it hits an error, and what you enter in the request form on our homepage. Section 5 lists both.

We do not ask for sensitive information (such as health or financial details) and you should not put it into a project record.

3. How we use it

• to run the service: sign you in, show you your projects, store and show your records;
• to send email you or your team triggered: invitations, notifications about your work, password resets, shared links;
• to keep the service secure: prevent abuse, investigate problems, keep backups;
• to answer you when you contact us, and to fix and improve the product.

We do not sell your information, and we do not use it for advertising. Where the law asks for a legal basis, it is the contract with you or your company (to provide the service) and our legitimate interest in keeping it secure and working.

4. Cookies and local storage

We use one sign-in cookie (auth_session), which is strictly necessary to keep you signed in, and one preference cookie that remembers whether the side menu is open. Your browser's local storage holds display preferences such as sort order and zoom. We use no analytics, advertising or tracking cookies, so there is nothing to consent to. If that ever changes we will update this page and ask first.

5. Error reports and access requests

Error reports. When the Jobsite Nexus web app hits an unexpected error in your browser, it sends us a short report so we can find and fix the problem. A report holds:

• the error message and its technical stack trace;
• the page you were on, of which we keep only the path: never its query string or fragment, and not the website address;
• your browser's user-agent string and the version of the app you were running;
• the time of the error;
• your account id, if you were signed in;
• a one-way hash of your IP address, mixed with a random value that changes every day and is kept for at most 48 hours. We never store the IP address itself, and once that random value is gone the hash cannot be linked back to an address.

The reporter does not read form fields or other page content, but an error message can occasionally quote a value the app was working with when it failed. We keep only the page's path, and we redact secrets wherever they appear. Links that carry access in the address itself (shared links, site sign-in codes, invitation and password-reset links, and any token, code or key value in a query string) are removed or replaced with a “redacted” marker in the path, the message and the stack, first in your browser before the report is sent and again on our server before it is stored. We keep error reports for 30 days and then delete them automatically. A summary goes to us in a daily internal email; for reports sent while nobody was signed in, that email shows only a count, a short fingerprint, the page path and the first 80 characters of the message.

Beta access requests. The request form on our homepage asks for your work email, your name, your company and a short description of your project or how you would use Jobsite Nexus. We send what you enter to our own inbox by email, so we can reply to you; it is not stored in our database. Our server log records only that a request arrived, your email address in masked form (its first letter and its domain) and the length of each field, not what you wrote.

6. Who processes it for us

We use a small number of service providers, each only for the job described:

• [Hosting provider] (placeholder, to be filled in): the servers and database that run Jobsite Nexus, located in [region] (placeholder, to be filled in).
• Mailgun (Sinch): sending our email and receiving replies to it.
• Cloudflare R2: storing uploaded photos, documents and drawings.

Inside the service, what you enter is visible to the people your company and project give access to, and to anyone you send a shared link to. We disclose information to authorities only when the law requires it.

7. How long we keep it

• Account details: while your account is active. When an account is closed we delete or anonymise it within [90] days, except where your name has to stay on a project record the company keeps (for example, as the author of a daily log).
• Project records: for as long as the company that owns the project keeps them. Archiving hides a record without deleting it; the company can ask us to delete a project.
• Browser error reports: 30 days, then deleted automatically (see section 5).
• Server logs: [90] days. Backups: overwritten on a rolling [30]-day cycle.

8. How we protect it

Everything travels over HTTPS. Passwords are stored only as Argon2 hashes. Access inside a company is limited by roles and permissions, and only a small number of people at our company can reach the servers. No system is perfectly secure; if a breach affects your information we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, Canada's PIPEDA or California's CCPA), you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; export it; or stop or limit a particular use. Email ron@jobsitenexus.comfrom the address on your account. We answer within 30 days and do not charge for it. If the request is about a project record, we may involve the company that owns it. You can also complain to your local data-protection authority.

10. Children

Jobsite Nexus is a work tool and is not meant for anyone under 16.

11. Changes to this policy

When this policy changes we update the date at the top. If a change is significant we will also tell you by email or in the app before it takes effect. The Terms of Service cover the rest of our agreement with you.

12. Contact

[Company legal name] (placeholder, to be filled in), [postal address] (placeholder, to be filled in). Email ron@jobsitenexus.com.