Privacy Policy

Privacy Policy — GroundWorks Manager Last updated: 1 October 2026 Version: 2026-10-01 This Privacy Policy explains how AutomatedForge Sp. z o.o. collects, uses, stores and protects personal data when you use the GroundWorks Manager website (groundworksmanager.com) and application (together, "the App" or "the Service"). Please read it together with our Terms of Service, Cookie Policy and Subscription Terms. 1. Who we are The operator of GroundWorks Manager and the data controller for the data described in sections 2–4 is: AutomatedForge Sp. z o.o. ul. Szlak 77/222, 31-153 Kraków, Poland Registered in the National Court Register (KRS) under number 0001242839 Tax ID (NIP): 6762721310 · REGON: 544915184 Contact for all privacy matters: info@automatedforge.com We have not appointed a Data Protection Officer because we are not required to do so under Article 37 of the GDPR. All privacy requests are handled by the company directly at the address above. 2. What data we collect We collect only the data needed to run the Service. Depending on how you use the App, this includes: Account data — your e-mail address, your full name and a password. Passwords are stored only in hashed form by our authentication provider; we never see or store them in plain text. Company and team data — the name of your company, the members of your team, their roles (Administrator, project manager, user), the e-mail addresses you invite to your company, and the dates members joined. Business data you enter — projects, tasks and their progress, calculations, material and equipment lists, work pricing, quotes and invoices, calendar events, recorded working hours, notes and plans drawn on the planning canvas. This data may contain personal data about your employees, subcontractors and clients (for example a client's name and site address on a quote). See section 5 on who is responsible for that data. Voice notes — if you use the voice note feature, the audio you record, the transcript produced from it and the task proposals generated from the transcript. Bug reports and support messages — the description you write, the contact e-mail you provide, any screenshots you attach, and any e-mail you send us. Technical data — your IP address, browser and device type, operating system, the pages and features you use, and the time of access. This data is generated automatically in the logs of our hosting and infrastructure providers and is used only for security, stability and troubleshooting. We do not run analytics or advertising trackers in the App. Preferences — your interface language and theme, stored in your browser's local storage. Billing data — when paid subscriptions launch, your company name, billing address and VAT number. Card and bank details will be handled entirely by an external payment provider and will never be stored by us (see the Subscription Terms). 3. Why we use your data and on what legal basis To create and run your account and your company workspace, and to provide the features you use (legal basis: performance of a contract — Article 6(1)(b) GDPR). To process voice notes into transcripts and task proposals, when you choose to use that feature (performance of a contract — Article 6(1)(b)). To answer bug reports, support requests and other messages you send us (performance of a contract and our legitimate interest in supporting users — Article 6(1)(b) and (f)). To keep the Service secure, prevent abuse, detect errors and improve stability (our legitimate interest — Article 6(1)(f)). To send service messages about your account, such as password resets, important changes to the Service or to these documents (performance of a contract and legal obligation — Article 6(1)(b) and (c)). To issue invoices and keep accounting records once subscriptions launch (legal obligation — Article 6(1)(c)). We do not sell personal data and we do not use it for advertising. We will not send marketing e-mails unless you separately agree to receive them. 4. Who we share data with We use a small number of service providers ("processors") who process data on our behalf and only on our instructions: Supabase, Inc. — database, authentication, file storage and server functions. Your data is stored in the Supabase region in Ireland (eu-west-1), within the European Union. Netlify, Inc. — hosting and delivery of the website and the web version of the App. Cloudflare, Inc. — network protection and delivery in front of our database provider. Deepgram, Inc. — speech-to-text transcription of voice notes (only if you use the voice note feature). Anthropic, PBC — processing of voice note transcripts into task proposals (only if you use the voice note feature). Transcripts are sent for processing and are not used by the provider to train its models under our agreement. Resend, Inc. — delivery of e-mails from the App, such as bug reports and support messages. Google LLC — the fonts used on the website are loaded from Google Fonts. When your browser loads a font, Google receives your IP address. No cookies are set by this. An external payment provider — once paid subscriptions launch. We will name the provider in the Subscription Terms before any payment is taken. We may also disclose data when required by law, or to protect our rights or the safety of users, and in connection with a merger or sale of the company (in which case you will be informed). 5. Data about your team and clients — who is responsible When you enter data about other people into the App (for example your employees' working hours, or a client's name and address on a quote), your company decides why and how that data is used. In GDPR terms your company is the controller of that data and we act as its processor. In that role we: - process the data only to provide the Service and on your documented instructions; - keep it confidential and allow access only to staff who need it; - use only the sub-processors listed in section 4 and will inform you before adding new ones; - help you respond to requests from the people concerned; - delete or return the data when your company's account ends, as described in section 6. Your company is responsible for having a lawful basis to enter this data and for informing the people concerned. 6. How long we keep data Account and company data — for as long as your account exists. If you ask us to delete your account, we delete it within 30 days of the request, except for records we must keep by law. Frozen companies — when the last Administrator leaves a company, the company is frozen and its data is kept for 30 days from the moment of freezing. If nobody takes over the Administrator role within that period, the company and all of its data are deleted and cannot be restored. Details are in section 11a of the Terms of Service. Voice notes — audio recordings, transcripts and proposals are kept with your project data until you delete the note or your account. Bug reports and support correspondence — up to 12 months after the matter is closed. Technical logs — for a short period needed for security and troubleshooting, typically no longer than 30 days. Invoices and accounting records — for the period required by Polish accounting and tax law (currently 5 years from the end of the financial year in which the document was issued). 7. International transfers Your data is stored in the European Union (Ireland). Some of our providers — Netlify, Cloudflare, Deepgram, Anthropic and Resend — are based in the United States and may process data there. For these transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place at info@automatedforge.com. 8. Your rights Under the GDPR (and, for users in the United Kingdom, the UK GDPR) you have the right to: - access the personal data we hold about you and receive a copy; - correct inaccurate or incomplete data; - have your data deleted ("right to be forgotten"); - restrict processing in certain circumstances; - receive the data you provided in a portable, machine-readable form; - object to processing based on our legitimate interests; - withdraw consent at any time where processing is based on consent, without affecting processing that took place before withdrawal. To exercise any of these rights, write to info@automatedforge.com. We will respond within one month; in complex cases we may extend this by a further two months and will tell you if so. We may ask you to confirm your identity first. There is currently no self-service "delete my account" button in the App. To delete your account, send a request from the e-mail address registered on the account to info@automatedforge.com. If you believe we are processing your data unlawfully, you can complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. In the United Kingdom it is the Information Commissioner's Office (ico.org.uk). You may also complain to the authority of the EU country where you live or work. 9. Security We protect your data with, among other measures: encrypted connections (TLS) between your device and our servers; passwords stored only in hashed form; database access rules that let each user see only the data of their own company; access to production systems limited to authorised staff; and regular backups made by our database provider. No system is completely secure, so please use a strong, unique password and keep it confidential. If you suspect your account has been accessed without authorisation, contact us immediately. 10. Children GroundWorks Manager is a business tool and is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it. 11. Changes to this policy We may update this policy as the Service develops. The date and version number at the top show when it was last changed. For significant changes we will notify you by e-mail or by a notice in the App before the changes take effect. 12. Contact AutomatedForge Sp. z o.o. ul. Szlak 77/222, 31-153 Kraków, Poland info@automatedforge.com