Privacy Policy

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Application refers to OnsiteSync, the mobile application provided by the Company, available on iOS and Android platforms.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to OnsiteSync LLC.
• Country refers to: Florida, United States.
• Device means any device that can access the Service such as a mobile phone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Application and/or the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
• Website refers to OnsiteSync, accessible from onsitesync.com
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Phone number (used for account recovery and security verification through AWS Cognito; not displayed to other users)
• Company name
• Trade or profession
• Number of employees
• Profile photo
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), device type, operating system version, the features of our Service that You use, the time and date of Your use, the time spent on those features, unique device identifiers, and other diagnostic data.

When You access the Service through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, Your mobile operating system, device manufacturer, device model, screen dimensions, locale, timezone, and other diagnostic data.

Information Collected While Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Information regarding Your location (GPS coordinates), used to auto-fill project addresses and tag photos with location data
• Pictures and other information from Your Device's camera and photo library, including photo metadata (EXIF data) such as GPS coordinates, date/time, and camera settings embedded in Your photos
• Push notification tokens to deliver notifications to Your device

The Application also includes an optional voice dictation feature for entering text into comment and description fields. We do not collect, record, transmit, or store the audio from Your microphone. Dictation is performed entirely on Your Device by Your operating system, and only the resulting text is submitted to Our servers. See "Voice Dictation" below for details.

We use this information to provide features of Our Service, to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be stored on Your device for offline access.

You can enable or disable access to this information at any time, through Your Device settings.

Photo and Location Metadata

When You capture or upload photos through the Application, We may extract metadata (EXIF data) from those photos, including GPS coordinates, timestamps, and camera settings. EXIF data, including any GPS coordinates embedded in the photo, is preserved and may be stored alongside the photo in Our systems for the purpose of associating photos with project locations. If Your Device has location services enabled, We may also use reverse geocoding to convert GPS coordinates into a readable address (street, city, state, zip code, country) that is stored with the photo record. After upload, our backend systems generate multiple resized variants of the photo (thumbnail, medium, and compressed) to optimize delivery; the original photo and all variants remain associated with Your project until You or a Project Owner deletes them.

Voice Dictation

The Application offers an optional voice dictation feature that allows You to dictate text into comment and description fields. When You use this feature, the audio captured by Your Device's microphone is processed entirely on Your Device by Your operating system's built-in speech recognition — Apple's Speech framework on iOS or Android's SpeechRecognizer service on Android. The Company does not collect, record, transmit, or store the audio. The audio never leaves Your Device. Only the resulting transcribed text is inserted into the field You are editing, and only that text is submitted to Our servers when You save Your comment or description. Because speech recognition is performed by Your Device's operating system, that processing may be subject to Your Device manufacturer's privacy policy (Apple or Google); please refer to Your Device manufacturer's documentation for details on how they handle on-device speech recognition.

Biometric Authentication Data

The Application offers optional biometric authentication (Face ID, Touch ID, fingerprint) for convenient sign-in. If You enable this feature, Your login credentials (email and password) are stored in Your Device's platform-specific secure storage (iOS Keychain or Android Encrypted Shared Preferences). Biometric data itself (e.g., Your fingerprint or facial scan) is processed entirely on Your Device by the operating system and is never collected, accessed, or transmitted by the Application.

Device Registration Data

When You enable push notifications, We collect and store Your device token, platform type (iOS or Android), device name, and device model to deliver notifications to Your device. You may have per-device notification preferences for assignments, comments, status changes, and team updates.

Feedback Data

If You submit feedback through the Application, We may collect Your feedback message along with device diagnostic information such as app version, device platform, OS version, device model, manufacturer, screen dimensions, locale, and timezone to help Us diagnose and resolve issues.

Content Reports

If You report another user's comment as objectionable through the Application, We collect and store: Your identity as the reporter (user ID, name, and email), the reported comment's content and author, the project and parent item (activity or todo) the comment belongs to, the reason category You selected (Spam, Harassment, Inappropriate, Threat, or Other), any optional notes You provide, the report's status, and the date and time of the report. This information is used solely for content moderation, enforcement of our Acceptable Use Policy, and any legal obligations that may apply. Report records may be retained even after the underlying comment is deleted.

Offline and Locally Stored Data

The Application stores a local copy of Your data (including projects, activities, todos, comments, photos, and notifications) on Your Device using a local SQLite database to enable offline access and improve performance. This local database relies on the encryption-at-rest provided by Your Device's operating system — iOS Data Protection on Apple devices and File-Based Encryption on Android devices — to protect the data while Your Device is locked. The Company does not apply an additional application-level encryption layer to this local database. Locally stored data is synchronized with Our servers when an internet connection is available. When You sign out of the Application or delete Your Account, the local database is cleared from Your Device.

Third-Party Service Providers

We use the following third-party Service Providers to operate and improve Our Service. These providers may have access to Your Personal Data only to perform tasks on Our behalf and are obligated not to disclose or use it for any other purpose:

Amazon Web Services (AWS)

We use AWS to host Our backend infrastructure, including:

• AWS Cognito — for user authentication and identity management
• AWS AppSync and DynamoDB — for data storage and synchronization via GraphQL API
• AWS S3 — for storing photos and profile images (multiple size variants are generated including thumbnail, medium, compressed, and original)
• AWS SNS — for push notification delivery

Your data is stored in the US East (N. Virginia) region. For more information, see the AWS Privacy Policy.

Firebase (Google)

We use Firebase Cloud Messaging (FCM) to deliver push notifications to Your Device. This requires collecting and transmitting Your device token to Firebase servers. For iOS devices, Apple Push Notification service (APNs) is also used. For more information, see Firebase Privacy Information.

Mixpanel

We use Mixpanel for analytics to understand how users interact with Our Service and to improve the user experience. Mixpanel collects Usage Data such as which features You use, screen views and navigation patterns, time spent on screens, session duration, and outcomes of in-app actions (for example, whether a sign-up attempt succeeded or what error type occurred). We associate this Usage Data with a non-identifying user ID and a limited set of profile attributes, namely Your platform (iOS or Android), trade, company name, and aggregate usage metrics such as Your project count and number of consecutive active days. We do not send Your email address or name to Mixpanel. You may opt out of Mixpanel analytics at any time from the Settings screen of the Application. For more information, see the Mixpanel Privacy Policy.

Data Shared Through Collaboration Features

OnsiteSync is a collaborative project management tool. When You create or join a project, certain data is shared with other project collaborators based on their assigned role (Owner, Manager, Contributor, or Viewer):

• Your name, email, and profile photo are visible to other project collaborators
• Project details, activities, todos, comments, and photos are visible to all collaborators on that project
• When You invite someone to a project, their email address is used to send the invitation

You control who has access to Your projects through the collaborator management features within the Application.

Public Share Links

The Application allows You to generate public share links for individual activities or todos within a project. When You create a share link:

• The link is publicly accessible to anyone who has the URL, without requiring a login or account
• The content exposed by the link may include the title and description of the shared activity or todo, photos attached to it (including any location data associated with those photos), and comments on it, depending on the options You select when generating the link
• The link expires automatically after a duration You select at creation time (1, 7, 14, or 30 days; the default is 7 days)
• The Company tracks the number of views the link receives
• You may revoke a share link at any time from within the Application, which immediately disables access to the link

Because share links are public, You are responsible for deciding what content is appropriate to share and with whom You distribute the link. Anyone with the link, whether or not they were Your intended recipient, will be able to view the content for as long as the link is active.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including to monitor the usage of Our Service.
• To manage Your Account: to manage Your registration as a user of the Service.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
• To contact You: To contact You by email or push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide You with news, special offers and general information about other goods, services and events which We offer that are similar to those that You have already purchased or enquired about, unless You have opted not to receive such information.
• To manage Your requests: To attend and manage Your requests to Us.
• For analytics: To understand how our Service is used, identify trends, and improve the user experience through aggregated and individual usage analysis.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets.
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and Your experience.

We may share Your personal information in the following situations:

• With Service Providers: We may share Your personal information with Service Providers (as listed above) to operate, monitor, and analyze the use of Our Service, and to contact You.
• With project collaborators: When You participate in shared projects, Your profile information and project contributions are visible to other collaborators as described above.
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Photos and files uploaded to the Service are retained for as long as Your Account is active or as needed to provide the Service. Upon account deletion, We will delete Your data as described in the "Delete Your Personal Data" section below.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and on servers located in the United States (AWS US East region). It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may delete Your Account at any time from within the Application's settings. When You delete Your Account:

• All projects that You own will be permanently deleted, which will also affect any collaborators on those projects
• Your collaborations on other users' projects will be removed
• Your profile information, uploaded photos, activities, todos, and comments will be deleted from Our servers
• Your device registrations and push notification tokens will be removed
• A minimal audit record may be retained for legal and compliance purposes

This action is permanent and cannot be undone. You may also contact Us to request access to, correct, or delete any personal information that You have provided to Us.

Please note that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us. We employ industry-standard security measures to protect Your data, including:

• All data transmitted between the Application and Our servers is encrypted using TLS/SSL
• Passwords are securely hashed and managed through AWS Cognito using the Secure Remote Password (SRP) protocol
• Biometric credentials are stored in platform-specific encrypted storage (iOS Keychain, Android Encrypted Shared Preferences)
• Photos stored in AWS S3 are encrypted at rest
• Local data on Your Device is stored in an encrypted database

While We strive to use commercially acceptable means to protect Your Personal Data, remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. We cannot guarantee its absolute security.

Tracking Technologies and Cookies

Our Website may use cookies and similar tracking technologies to improve Your browsing experience. A cookie is a small file placed on Your Device by a website.

The mobile Application does not use browser cookies. Instead, the Application uses analytics services (as described in the Third-Party Service Providers section) to collect Usage Data.

Cookies used on the Website may include:

• Necessary / Essential Cookies
  Type: Session Cookies · Administered by: Us
  Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features.
• Functionality Cookies
  Type: Persistent Cookies · Administered by: Us
  Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference.

You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Website.

Your Privacy Rights

Depending on Your jurisdiction, You may have certain rights with respect to Your Personal Data. The Company honors the rights described below regardless of where You reside, to the extent reasonably practicable, and provides the specific protections required by California and European Union law as described in the subsections that follow.

In general, You may:

• Access the Personal Data We hold about You
• Correct inaccurate or incomplete Personal Data, either directly through the Application's profile settings or by contacting Us
• Delete Your Personal Data by deleting Your Account from within the Application, or by contacting Us
• Opt out of analytics tracking at any time from the Settings screen of the Application
• Withdraw consent for any processing that is based on Your consent, at any time

To exercise any of these rights, please contact Us at support@onsitesync.com. We may need to verify Your identity before fulfilling Your request and will respond within the timeframes required by applicable law.

Notice to California Residents (CCPA / CPRA)

If You are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), provides You with additional rights regarding Your Personal Data. These include the right to know what categories of Personal Data We collect, the categories of sources from which it is collected, the business or commercial purposes for which it is used, and the categories of third parties with whom it is shared; the right to access the specific pieces of Personal Data We have collected about You; the right to request correction of inaccurate Personal Data; the right to request deletion of Your Personal Data, subject to certain legal exceptions; the right to opt out of the "sale" or "sharing" of Your Personal Data, as those terms are defined under the CCPA; the right to limit the use and disclosure of sensitive Personal Data; and the right not to receive discriminatory treatment for exercising any of these rights.

No Sale of Personal Data. The Company does not sell Your Personal Data for monetary consideration. The Company does not share Your Personal Data for cross-context behavioral advertising. The Personal Data We collect is used to provide and improve the Service as described in this Privacy Policy and is shared only with the Service Providers and project collaborators identified above.

Categories of Personal Data Collected. Over the preceding twelve (12) months, We have collected the following categories of Personal Data as defined by the CCPA: identifiers (such as name, email address, phone number, and device identifiers); commercial information (such as Your company name and trade); internet or other electronic network activity information (such as Usage Data and interactions with the Service); geolocation data (when You permit location access); audiovisual information (photos You upload); professional or employment-related information (such as Your trade and number of employees); and inferences drawn from the foregoing for analytics purposes.

Exercising Your CCPA Rights. To exercise Your right to know, correct, delete, or limit, please contact Us at support@onsitesync.com. We will respond to verifiable consumer requests within 45 days as required by the CCPA. You may also designate an authorized agent to make a request on Your behalf; We may require proof of the agent's authority and verification of Your identity before fulfilling the request.

Notice to Users in the European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If You are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR") and equivalent national laws provide You with the following rights with respect to Your Personal Data: the right of access; the right to rectification of inaccurate Personal Data; the right to erasure ("right to be forgotten"); the right to restrict processing; the right to data portability in a structured, commonly used, machine-readable format; the right to object to processing based on Our legitimate interests or for direct marketing purposes; the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and the right to withdraw Your consent at any time where processing is based on consent.

Lawful Bases for Processing. We process Your Personal Data on the following lawful bases: (i) performance of a contract, where processing is necessary to provide the Service You have requested (for example, processing Your account information and project data); (ii) legitimate interests, where We have a legitimate business interest that is not overridden by Your rights (for example, improving the Service, securing Our systems, and responding to support requests); (iii) consent, where You have given Us specific consent to process Your Personal Data for a particular purpose (for example, granting access to Your camera, microphone, location, or photo library); and (iv) legal obligation, where processing is necessary to comply with a legal requirement to which We are subject.

International Transfers. The Personal Data We collect is processed and stored on servers located in the United States. Where We transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to the United States, We rely on appropriate safeguards as required by applicable law, including the European Commission's Standard Contractual Clauses with Our Service Providers.

Data Controller. For purposes of the GDPR, the data controller of Your Personal Data is Onsitesync LLC, located at 796 NW 9 St, Homestead, FL 33030, United States. You may contact Us at support@onsitesync.com.

Right to Lodge a Complaint. If You believe that Our processing of Your Personal Data infringes the GDPR or applicable national law, You have the right to lodge a complaint with the supervisory authority in the European Union Member State, United Kingdom region, or Swiss canton of Your habitual residence, place of work, or place of the alleged infringement.

Response Time. We will respond to requests to exercise Your GDPR rights without undue delay and in any event within one month of receipt, subject to any extensions permitted by law.

Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 18 without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, You can contact us:

• By email: support@onsitesync.com