Legal
Privacy Policy
Draft: this text has not been reviewed by a lawyer yet and may change before launch.
1. Who is responsible
- For account, billing and support data we are the controller: Placeholder Name (Base Rock Apps), Placeholder Address,support@punchlistcheck.com.
- For the content a company puts into PunchList: Check Site (plans, drawings, photos, comments, its team list) the company is the controller and we process it on its behalf. Questions about that data go to the company first.
2. What we collect
- Account: name, email, role, company name, a password hash (never the password itself).
- Content: projects, PDF drawings, plans, pins, comments and photos your team uploads. Photos may show people or places; the company decides what is uploaded.
- Sessions and devices: device name, platform and last activity for each signed-in device, so you can see and revoke them.
- Billing: Paddle, our Merchant of Record, collects payment details directly. We receive the subscription status, plan, country and invoice data, never the card number.
- Support: the emails you send us.
- Technical: server logs (IP address, time, request) and error reports, kept for security and to fix problems.
We do not sell data, show ads or track you across other sites or apps.
3. Why and on what basis
- To provide the Service under our contract with the company (accounts, content, sync, email notices).
- To bill and meet tax and accounting duties (legal obligation).
- To keep the Service secure, prevent abuse and fix errors (legitimate interest).
- To answer support requests (contract or legitimate interest).
4. Cookies and local storage
This website uses no cookies and no analytics. The web admin sets one strictly necessary cookie that keeps you signed in. The mobile app keeps your team's data on the phone in an encrypted database, and sign-in keys in the system's secure storage.
5. Who processes data for us
- Paddle (payments, invoices, taxes; Merchant of Record)
- Render (application servers)
- Neon (database)
- Cloudflare (file storage and website hosting)
- Resend (transactional email)
- Sentry (error reports)
The database and application servers are in the EU (Frankfurt). Some of these providers may process data outside your country, including in the United States. Where the law requires, the transfer is covered by standard contractual clauses or an equivalent safeguard.
6. How long we keep it
- While the company's subscription runs.
- 30 days after the subscription ends (or after signup if the company never subscribes), then the company's data is permanently deleted.
- 7 days after the owner deletes the company.
- When a member deletes their account or the owner erases a former member, their name and email are erased at once; plans they made stay with the company without them.
- Invoices and billing records are kept as long as tax law requires. Backups and logs roll over within a limited period.
7. Your rights
Depending on where you live, you may ask to access, correct, delete or export your personal data, object to or restrict its processing, and complain to a data protection authority. You can delete your account yourself (see Delete account) or write to support@punchlistcheck.com. For data a company controls, we will pass your request to it or help it answer.
8. Security
Traffic is encrypted (HTTPS), passwords are hashed with Argon2, the phone database is encrypted, and each company's data is kept separate. No system is perfectly secure; we will tell affected customers of a breach as the law requires.
9. Children
The Service is for businesses and is not meant for children.
10. Changes
We will publish changes here and email company owners about material ones.