Privacy policy

The data controller responsible for your personal data is SiteTrack.

For privacy-related questions, contact us at hello@yourcompany.fi.

Postal address: Mannerheimintie 1, 00100 Helsinki, Finland.

This privacy policy applies to visitors of our public website, users who register or sign in, workers and subcontractors using project dashboards, contractors and data center partners, and anyone who contacts us or uses Chat with Engineer on SiteTrack.

SiteTrack is a construction installation tracking platform. Some project data may be entered by your employer, contractor, or project administrator. Where they decide why and how your data is processed for a specific project, they may act as an independent controller for that processing. This policy describes processing carried out by SiteTrack as controller or processor as applicable.

Depending on how you use SiteTrack, we may process the following categories of personal data:

• Identity and contact data: name, email address, phone number, company name, business ID, postal address, country, and city.
• Account and authentication data: password (stored hashed), one-time login codes, Google account identifier and profile photo when you choose Google sign-in, email verification status, and session identifiers.
• Professional and profile data: trade categories, professions, company description, profile documents, and avatar images you upload.
• Project and site activity: assigned projects, apartments, tasks, readings, photos, files, comments, feedback, articles, and related metadata such as timestamps and status.
• Attendance and work time: QR check-in and check-out times, work dates, project association, and calculated working hours where attendance features are enabled.
• Chat with Engineer and support: chat messages, conversation history, knowledge queries, optional feedback, and technical metadata needed to deliver grounded answers.
• Contact and inquiry data: information you submit through contact forms, including message content, and limited technical data such as IP address and language preference.
• Technical and usage data: browser type, device information, log files, security events, cookie identifiers, and approximate usage patterns needed to operate and secure the service.

• Directly from you when you register, update your profile, submit forms, scan QR codes, upload files, or use chat features.
• From your organization when a contractor, subcontractor, or administrator invites you to a project or maintains project records.
• From authentication providers such as Google when you connect or sign in with Google.
• From automated systems that record service activity, security events, and feature usage.

We process personal data only when we have a valid legal basis under Article 6 GDPR:

Providing the service

Creating and managing accounts, project access, installation tracking, attendance, document handling, and Chat with Engineer. Legal basis: performance of a contract or steps prior to entering a contract (Art. 6(1)(b)).

Authentication and security

Verifying identity, preventing fraud and abuse, protecting accounts, and maintaining service integrity. Legal basis: legitimate interests (Art. 6(1)(f)), and where required, compliance with legal obligations (Art. 6(1)(c)).

Communication

Sending service emails such as login codes, invitations, notifications, and responses to contact requests. Legal basis: contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)).

Improving knowledge search and chat quality

Indexing permitted project and data center documents, generating embeddings, retrieving relevant sources, and logging queries to operate Chat with Engineer. Legal basis: legitimate interests (Art. 6(1)(f)) and contract where the feature is part of subscribed use.

Analytics and product development

Aggregated or pseudonymized usage insight to understand feature adoption and reliability. Legal basis: legitimate interests (Art. 6(1)(f)).

Legal compliance

Record keeping, responding to lawful requests, and enforcing terms where applicable. Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

Where we rely on consent, for example for optional non-essential cookies if offered separately, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

SiteTrack uses cookies and similar storage technologies that are necessary to keep you signed in, remember language preferences, protect forms, and maintain session security. These are strictly necessary for the service and do not require consent under the ePrivacy rules where an exemption applies.

We may store a session token in your browser local storage for public Chat with Engineer so you can continue a conversation during the same visit when you accept optional cookies.

You can control cookies through your browser settings or the cookie banner. Blocking strictly necessary cookies may prevent sign-in and core features from working. See our cookie policy for a full list and preference controls.

We do not sell your personal data. We share data only as needed to operate SiteTrack:

• Hosting and infrastructure providers that store application data and files.
• Email delivery providers used to send verification codes, invitations, and service messages.
• Google when you choose Google sign-in or when Google AI services are configured for chat features.
• AI and embedding providers such as OpenAI, Azure OpenAI, or Google Gemini when enabled by administrators to power Chat with Engineer and knowledge search.
• Vector database services such as Qdrant when configured to store searchable knowledge embeddings.
• Other project participants who are authorized to view project, task, attendance, or chat-related records within their role.
• Professional advisers or authorities when required by law or to protect legal rights.

Where we use processors, we impose contractual data protection obligations consistent with Article 28 GDPR.

We aim to process and store personal data within the European Economic Area (EEA), including Finland where partner data centers and hosting may be located.

If a subprocessors processes data outside the EEA, for example certain AI or cloud providers, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses, adequacy decisions, or other mechanisms permitted under Chapter V GDPR.

You may request more information about transfer safeguards by contacting us at the address above.

We keep personal data only for as long as necessary for the purposes described in this policy, unless a longer period is required by law.

• Account and profile data: for the life of the account and a reasonable period afterward to handle disputes, backups, and legal obligations.
• Project, task, attendance, and uploaded files: according to project lifecycle and customer configuration, typically until the project is archived or deleted by authorized users, subject to contractual requirements.
• Chat and knowledge query logs: for operational, security, and quality purposes for a limited period unless anonymized earlier.
• Contact form submissions: until the inquiry is resolved and for internal record keeping thereafter.
• Security and server logs: for a limited rolling period unless needed for incident investigation.

We apply appropriate technical and organizational measures to protect personal data, including access controls, encrypted transport (HTTPS), hashed passwords, role-based permissions, and monitoring for abuse.

No online service can guarantee absolute security. Please use a strong unique email account, protect your devices, and notify us promptly if you suspect unauthorized access.

If you are in the EEA, UK, or another jurisdiction with similar rights, you may have the following rights regarding your personal data:

• Right of access to a copy of your data and information about processing.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure in certain circumstances.
• Right to restriction of processing in certain circumstances.
• Right to data portability for data you provided, where processing is based on contract or consent and carried out by automated means.
• Right to object to processing based on legitimate interests, including profiling where applicable.
• Right to withdraw consent at any time where processing is based on consent.

To exercise your rights, contact hello@yourcompany.fi or use Profile > Privacy & data when signed in. We may need to verify your identity before responding. We aim to reply within one month as required by GDPR.

You can update much of your profile information directly in your SiteTrack account settings where available.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu). Contact details are available at tietosuoja.fi.

SiteTrack is a business service for construction projects and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us so we can delete it.

Chat with Engineer uses automated retrieval and language models to suggest answers based on indexed documents and your project context. Outputs are assistive and do not by themselves produce legal or contractual effects concerning you.

SiteTrack does not use solely automated decision-making that produces legal or similarly significant effects about individuals within the meaning of Article 22 GDPR.

We may update this privacy policy to reflect legal, technical, or business changes. We will publish the revised version on this page and update the "Last updated" date. Material changes may also be communicated through the service or by email where appropriate.

For privacy requests or questions about this policy, email hello@yourcompany.fi or use our contact form.