Privacy policy

The controller of your account data is the provider of the service, identified under Who we are at the end of this page.

When a company uses PainelObra to manage its team, that company is the controller of the data it records about its workers and clients — hours, clock-in locations, reports, photos. We act as its processor: we handle that data only to provide the service, following the company's instructions and the rules in the “Processing data on behalf of the company” section of the Terms of use.

If you work for a company that uses PainelObra and have a question about your work data, speak to your company first — it decides about that data. We help it answer.

We have not appointed a data protection officer, as we are not required to. Any privacy request goes to the contact given at the end of this page.

• Account: email, password (stored encrypted, never in plain text), name, phone, country and language. If you sign in with Google, we receive from Google the name, email address and profile picture of that account.
• Company: name, join code and, if you fill them in, address, tax number, phone, email and logo for the letterhead on reports.
• Work: sites (name, client, location, budget, notes), daily reports, snags and incidents, materials, costs, schedule, safety records and documents.
• Photos: the images and captions, with the visibility level you give them (team, client or management).
• Measurement sheets: the Excel files the company creates or uploads for each site, including previous versions of each one.
• Time tracking: clock-in and clock-out time, site, and GPS coordinates of each clock-in — see the next section.
• Pay: the hourly rate the company sets for each member. Only owners and managers can see it.
• Fleet: vehicles, number plates, mileage, inspection, insurance and service dates, refuelling and assigned driver.
• Site clients: the email addresses of the people the company invites to the client portal, where they see the photos the company marks for them.
• Payment: billing details are handled by Stripe. We only receive the subscription status and the last digits of the card; never the full number.
• Audit log: who did what and when, within the company.
• Technical: IP address and request data in server logs, kept briefly for security and troubleshooting.

When someone clocks in, we store the coordinates at that moment and the distance to the site. It serves one purpose only: showing managers whether the clock-in happened at the site or away from it, so it can be validated.

What we do not do: we do not follow anyone in real time, we do not store routes, and we do not collect location outside the moment of clocking in or while the app is closed.

Location is collected by the phone only with the operating system's permission, which you can withdraw at any time in the device settings. Without it, clocking in still works and is flagged as having no location.

For the company using this record: monitoring workers has its own rules in each country. In Portugal, workers must be informed in advance and the limits of the Labour Code respected; in Brazil, the CLT and the LGPD apply. Complying with those rules is the company's responsibility.

• Providing the service: managing the account, storing and showing the team's work, syncing between the phone and the website. Basis: performance of our contract with you.
• Billing: processing subscriptions and issuing invoices. Basis: performance of the contract and legal invoicing obligations.
• Security and abuse prevention: technical logs, usage limits and the audit log. Basis: our legitimate interest in keeping the service secure and available.
• Service messages: notices about the account, the subscription and changes to these documents. Basis: performance of the contract. We do not send advertising without your consent.
• Sign in with Google: only if you choose that option. Basis: your request, within the contract.

We do not make automated decisions with legal effects on anyone, nor do we build profiles. We do not sell personal data, share it for advertising or use it to train artificial intelligence models.

We use a small number of providers, which process data on our behalf, each with its own role and bound by contract to protect it:

• Supabase — database, authentication and file storage. Data is kept on servers in the European Union (Frankfurt, Germany).
• Cloudflare — website hosting, content delivery and protection against attacks.
• Stripe — payment processing and invoicing.
• Google — sending the service's emails (account confirmation and password recovery) and, if you use it, the option to sign in with a Google account.

When we add or replace a provider, we update this list; if you are a customer company, we tell you beforehand so that you can object.

We do not share your data with anyone else, unless we are legally required to by a competent authority — and in that case only what is required.

The database and photos stay in the European Union. Cloudflare, Stripe and Google are companies based in the United States and may process some data outside the EU — for example, to route a request or deliver an email.

These transfers are protected by the EU–US Data Privacy Framework, which these companies have joined, and by the standard contractual clauses approved by the European Commission.

• Account and content: for as long as the account exists.
• When you delete your account: we delete your personal data and your photos. What belongs to the company and was created by you — a site report, for example — may remain with the company, without identifying you, because it is the company's work record.
• When a company stops paying: it moves to the free plan and the data stays where it is, read-only. Nothing is deleted for not paying.
• Billing: billing records are kept for as long as tax law requires — in Portugal, ten years.
• Technical logs: only as long as needed for security and troubleshooting.
• Backups: where they exist, they are replaced in cycles; deleted data disappears from them once they are replaced.

You have the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given, without affecting what was done on the basis of it.

Two of those you can exercise yourself, right now, without asking anyone: under Privacy and data there is a button to export everything as a JSON file and another to delete the account.

For the others, write to the contact at the end of this page. We reply within one month, which may be extended in the cases allowed by law.

If you are in Brazil, you also have the rights under article 18 of the LGPD, including confirmation that we process your data and information about the entities we share it with.

If you believe we have mishandled your data, you can complain to the supervisory authority: in Portugal the CNPD, in Brazil the ANPD.

We only use what is strictly necessary for the website to work:

• Session: cookies that keep you signed in.
• Language: a cookie that remembers the language you chose.
• Preferences: the browser's local storage remembers the light or dark theme, the notices you have dismissed and your recent path within the dashboard, so the Back button knows where to take you.
• Payments: on the payment pages, which belong to Stripe, Stripe uses its own cookies to prevent fraud.

We do not use advertising cookies or cross-site tracking, and there is no consent banner because there is nothing that needs one.

Access to data is decided on the server, row by row, by the database's rules — not only by what the screen shows. Photos and measurement sheets are kept in private storage, served through signed, temporary links.

All traffic is encrypted in transit and data is encrypted at rest. Passwords are stored with algorithms designed for that purpose and are never readable by us.

If a data breach occurs that puts your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay. If you are a customer company, we tell you, so that you can meet your own obligations.

The service is not intended for anyone under 16 and we do not knowingly collect children's data. If we learn of such an account, we delete it.

When this policy changes in a significant way, we give at least 30 days' notice by email or within the app. The version in force and the date it took effect are always shown at the top of this page.