Privacy Policy
This policy explains what AtPlot collects when you create an account in the construction CRM app, how we use it, and your rights under the GDPR.
1. Who we are
AtPlot is a business (B2B) workspace for construction teams: clients, projects, calendar, chat, photos, time tracking, and an AI assistant. We process personal data to provide that service.
2. Data we collect
- Account: name, email, phone number, role (admin, partner, worker), organization membership.
- CRM you enter: client names, phones, addresses, KVK/VAT/IBAN, project budgets, notes, calendar events.
- Photos and files: site photos, receipts, documents you upload.
- Chat messages and attachments inside your organization.
- Voice input: audio is processed on-device / by the speech APIs of your phone to turn speech into text. We do not keep a separate voice archive.
- Device: push token (FCM) so we can send work notifications you enable.
- App activity: which screens you open (counts per day), used to improve the product and support.
- Support emails you send to info@atplot.com.
- Technical records: app version, platform, last-seen time per device, and error reports (error text, app version) to keep the app working. Error reports are kept for 90 days.
- Photos taken or picked in the app are re-encoded before upload; location (GPS) metadata is removed.
We do not use advertising SDKs, we do not sell personal data, and we do not track you across other companies’ apps.
3. Why we process data (legal bases)
- Contract: to run your account, organization, and CRM.
- Legitimate interest: security, abuse prevention, product reliability, screen-visit counts.
- Consent: optional camera, microphone, photo library, and notifications on your device; marketing banners only as in-app product messages.
4. Processors and third parties
- Supabase (database, auth, storage, push token store; hosted in London, United Kingdom — covered by the EU adequacy decision for the UK) — app backend.
- Google Gemini (Google LLC) — AI assistant and receipt scanner. Before your first AI request or receipt scan, AtPlot asks for your explicit permission. When you use AI, your prompt, attached photos/receipts/PDFs, and a snapshot of relevant CRM context (client names, phone numbers, addresses, project titles, tasks, schedule; budgets only for admins) are sent to Google to generate a proposal. Google processes it as our processor; this can involve transfer outside the EEA under the EU-US Data Privacy Framework / Standard Contractual Clauses. Nothing is written to your CRM until you tap Confirm. Workers only reach the assistant if their admin enables it.
- Firebase Cloud Messaging — push delivery.
- Polar.sh / Lemon Squeezy / Stripe — B2B organization invoicing and subscription status processing. We store the subscription status and a minimal event log (no card data) for 90 days.
- Geocoding (PDOK, Nominatim/OSM, Photon) — converting typed addresses to a map point. We do not collect GPS from the device.
This website counts page visits only after you allow it in the banner (page path, referring site, browser/OS/device type, language and a random visitor ID kept in your browser; no cookies, kept 13 months; "Do Not Track" and Global Privacy Control are respected). Change my analytics choice.
The public website also stores a login session in the browser (localStorage) if you sign in there to manage billing. The site admin panel uses a separate password hash in our database, not your app account password.
5. Retention
Account and CRM data stay until you delete the account or your organization admin removes you. If you are the last admin of an organization, deleting your account also deletes that organization and its CRM (clients, projects, photos, chat, calendar). Push tokens, device records and error reports are removed with the account. Messages, hours and photos you created inside another company’s organization stay part of that company’s records, but your name is replaced by “Deleted user”. An active subscription of an organization that is deleted this way is cancelled. Backups may linger for a short operational period (up to 30 days).
6. Your rights
You may access, correct, export, restrict, or object to processing, and request erasure. Use Settings → Delete account in the app, or email info@atplot.com. You may lodge a complaint with your local data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).
7. Children
AtPlot is a professional tool. It is not directed at children under 16.
8. Security
Access is limited by organization membership and role. Transport uses HTTPS. You are responsible for who you invite into your organization.
9. Changes
We will update this policy on the website and in the app when it changes. Continued use after an update means you accept the revised policy.
10. Contact
AtPlot / Roman Vasilenko
Email: info@atplot.com
Web: atplot.com/privacy