Privacy Policy

Introduction

SyteSense (“SyteSense”, “we”, “us”, or “our”) is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us.

This Privacy Policy describes how we collect, use, disclose, process, store, and safeguard personal data when you access or use:

• The SyteSense web platform
• Mobile applications
• Construction workflow management tools
• Field reporting and compliance tools
• Subcontractor coordination systems
• Project documentation and analytics services
• Any related services (collectively, the “Services”)

SyteSense provides enterprise-grade construction management software to contractors, subcontractors, and infrastructure stakeholders globally.

This policy applies to users in New Zealand, Australia, the European Economic Area (EEA), the United Kingdom, and other jurisdictions in which we operate.

What information we collect

We only collect what we need to run our services and respond to your enquiries. This section covers the website. For the mobile app, see the SyteSense Mobile App section below.

Form submissions

When you fill out a form on our site, we collect the information you provide:

• Your name
• Your company name
• Your email address
• Your phone number
• Any message or details you choose to share

Website analytics

We use Plausible Analytics, a privacy-first analytics tool that does not use cookies and does not collect personal data. It tells us things like which pages are popular and how people find us, nothing that identifies you personally.

• Pages visited and time spent on each page
• How far you scroll down a page
• Which buttons and links you click
• Your general location (country level, not street address)
• Browser type and device type (e.g. mobile or desktop)

What we do not collect

• We do not set cookies on your device
• We do not track you across other websites
• We do not build advertising profiles
• We do not sell or share your personal data with advertisers

How we use your information

We use the information we collect for straightforward purposes:

• Form submissions: To respond to your enquiry, provide information about SyteSense, and follow up if you have asked us to
• Analytics: To understand which pages and features interest visitors so we can improve the website

We never use your information for advertising, profiling, or selling to third parties.

Sharing and Disclosure

We may share personal data with:

• Cloud hosting and infrastructure providers
• Security and monitoring providers
• Payment processors
• Professional advisors (legal, audit, accounting)
• Regulatory authorities where required

All vendors are contractually bound to confidentiality and data protection obligations.

How we protect your data

We take practical steps to keep your information safe:

• HTTPS encryption on every connection. Your data is encrypted in transit
• Hosted on Vercel – enterprise-grade infrastructure with SOC 2 compliance
• No client-side storage of sensitive data. We do not store your details in browser storage
• Server-side validation on all form submissions to prevent injection attacks
• Rate limiting on form submissions to prevent abuse

How long we keep your data

• Form submissions: Retained while needed to respond to your enquiry and follow up. You can request deletion at any time.
• Analytics data: Aggregated and non-personal. Retained by Plausible per their privacy policy. No individual records are stored.

SyteSense Mobile App

The SyteSense mobile app collects additional information beyond what the website collects. This section explains what the app collects, why, and how it is handled.

Account and profile data

When you create an account and use the app, we store:

• Your name, email address, and phone number
• Your organisation name, role, and membership details
• Projects you are assigned to and your role on each project
• Your work schedule and crew assignments
• Profile photo, timezone, and language preferences

Time tracking and work records

When you clock in or out, the app records:

• Timestamps, duration, and any notes you add
• Photos you capture as part of time entries (see below)
• GPS coordinates at the moment of clock-in or clock-out (see below)
• Tasks, site diaries, and form submissions linked to your work

Photos

When you take a photo through the app for time tracking, the photo is:

• Saved on your device for offline access
• Compressed and uploaded to our cloud storage (Supabase), organised by your organisation and project
• EXIF metadata (including GPS coordinates, date, and time) is preserved in the uploaded photo

Location data

The app captures your GPS location only at specific moments: when you clock in, clock out, or take a photo. There is no ongoing or background location tracking. Location data is stored alongside your time entries on our servers.

Location data comes from one of three sources: the photo's EXIF metadata, your device's GPS, or manual entry. The app works without location permission. If you decline, location fields are simply left blank.

Financial data

If your organisation uses invoicing features, we store invoice details including subtotals, GST amounts, totals, and PDF documents. This data is scoped to your organisation and protected by role-based access controls.

Device permissions

The app requests the following permissions on your device. All are optional. The app will work with reduced functionality if you decline any of them.

• Camera: To capture photos for time tracking entries
• Location: To record GPS coordinates with your clock-in and clock-out entries
• Notifications: To send you schedule reminders, sync updates, and important alerts
• Photo library (iOS): To save time tracking photos to your device

Third-party services used by the app

The mobile app communicates with the following services. None of them use your data for their own advertising or marketing.

• Supabase – database, authentication, and file storage (hosts your account data, time entries, and uploaded photos)
• Firebase Cloud Messaging (Google) – delivers push notifications to your device
• Firebase Crashlytics (Google) – collects crash reports to help us fix bugs. Reports include your device model, OS version, app version, and error details. No personal identifiers are attached to crash reports.
• Firebase Analytics (Google) – collects anonymous usage data such as screen views, device type, and app version to help us understand how the app is used. No personal identifiers are collected.
• Apple Push Notification Service – delivers push notifications on iOS devices
• Resend – sends transactional emails such as notifications and invitations
• Sentry – server-side error tracking for our backend services

Where your data is stored

The app stores data both on your device and in the cloud:

• On-device: Photos, time entries, and app data are cached locally for offline access. This data stays on your device and syncs to the cloud when you have a connection.
• Cloud: Your data is stored in Supabase, which uses enterprise-grade infrastructure with row-level security to ensure you can only access data within your own organisation and projects.

How long we keep mobile app data

• Time entries, timesheets, and invoices: 7 years from the end of the relevant tax year, as required by New Zealand tax and employment law
• Work site photos: 7 years after project completion, to support legal liability and insurance requirements common in the construction industry
• GPS location data: Retained as part of time entry records for the same 7-year period
• Crash reports: 30 days
• Analytics data: 90 days
• Push notification tokens: Deleted when your device unregisters or after 90 days of inactivity

After the applicable retention period, data is securely deleted. If you delete your account, we remove your personal information (name, email, profile) within 30 days. Anonymised business records such as timesheets and invoices are retained for the legally required period.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of any inaccurate information
• Request deletion of your data

To exercise any of these rights, get in touch by email at support@sytesense.com or call us on +64 27 322 2347. We will respond within 20 working days, as required by the Privacy Act.

New Zealand Privacy Act 2020 Compliance

For individuals located in New Zealand, SyteSense complies with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs).

Under the NZ Privacy Act, individuals have the right to:

• Request access to personal information
• Request correction of personal information
• Be informed of the purpose of collection
• Expect reasonable safeguards to protect their data

We take reasonable steps to ensure personal information is:

• Collected for lawful and necessary purposes
• Not retained longer than required
• Protected against loss, misuse, or unauthorized disclosure

If you believe we have breached the Privacy Act 2020, you may contact us directly or lodge a complaint with the Office of the Privacy Commissioner of New Zealand.

Cookies and tracking

The short version: we do not use cookies. No cookie banner, no consent popups, no tracking scripts.

• sytesense.com does not set any cookies on your device
• Plausible Analytics is completely cookieless and privacy-compliant
• We do not use any cross-site tracking or advertising pixels

Children's privacy

SyteSense is a business tool for construction professionals. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

Changes to this policy

We may update this privacy policy from time to time. When we make changes, we will update the effective date at the top of this page. For material changes, we will add a notice on the website.

Contact us

If you have any questions about this privacy policy or how we handle your data, get in touch. We are happy to help.

• Email: support@sytesense.com
• Phone: +64 27 322 2347
• Privacy Officer: SyteSense Privacy Officer, contactable at the email and phone above