Global Privacy Policy
1. Who We Are
JobsitePilot is operated by Tmi J Juuso (Business ID 2721234-5), Keimolantie 88, 01750 Vantaa, Finland. Contact: hello@getjobsitepilot.com. Tmi J Juuso is the controller of account, billing-administration, support, and website-related personal data described in this Policy. When a business customer determines the purposes and means of processing personal data contained in its project content, the customer acts as controller and JobsitePilot acts as its processor. Our Data Processing Addendum addresses that processing relationship.
2. Scope
This Policy applies to the JobsitePilot website, application, accounts, AI-assisted reporting, support, authentication emails, subscription administration, and related services. It does not govern third-party sites or services independently controlled by others.
3. Information We Process
Depending on use, we may process: account information such as name and email address; authentication and session data; company/profile information; project names and project details; field notes and dictated or typed descriptions; temporary audio recordings submitted for transcription; photographs and files; report contents and generated reports; usage information such as report counts and feature interactions; subscription status and transaction identifiers; support and feedback communications; technical information such as IP address, browser/device information, logs, timestamps, and security events; and preferences such as units, timezone, and report settings.
4. Sensitive and Third-Party Information
Construction records and photographs may incidentally contain personal or confidential information about employees, subcontractors, visitors, customers, locations, incidents, or other persons. Customers are responsible for determining whether they are permitted to upload such information and for providing notices or obtaining permissions required by applicable law. Users should avoid uploading unnecessary sensitive personal data.
5. Purposes of Processing
We process information to create and administer accounts; authenticate users; provide projects, reports, AI-assisted features and PDFs; store and retrieve customer content; apply plan limits; process and administer subscriptions; send transactional and security communications; provide support; prevent abuse and protect the Service; diagnose errors; maintain and improve functionality; comply with legal obligations; establish, exercise, or defend legal claims; and communicate material Service or policy changes.
6. Legal Bases for EEA/UK Users
Where GDPR or comparable UK rules apply, processing may rely on: performance of a contract or steps requested before entering a contract; legitimate interests in operating, securing, supporting, and improving a B2B software service, balanced against affected rights; compliance with legal obligations; and consent where consent is required and requested. The specific basis depends on the processing activity.
7. AI and Voice Processing
Information submitted for AI-assisted features may be transmitted to AI service providers for processing necessary to generate the requested output. JobsitePilot currently uses OpenAI technology. When a user chooses voice input, the browser records the audio and sends it through JobsitePilot to OpenAI for transcription. The application processes the recording in memory and does not intentionally store the audio in the JobsitePilot database; the resulting transcript becomes Customer Content when it is added to the field note. OpenAI may retain or otherwise process transient API data according to the applicable service configuration and terms. JobsitePilot does not use Customer Content to train its own general-purpose AI models. OpenAI states that data submitted through its API is not used to train its models unless the API customer expressly opts in. Users must not submit information unless authorized to do so and must review transcripts, especially names, quantities, times and technical terms. AI output may be inaccurate and is subject to mandatory human review.
8. Service Providers and Recipients
We use service providers to operate JobsitePilot. Current principal providers include Supabase for database, storage and authentication infrastructure; OpenAI for AI processing; Stripe for subscription and payment processing; Resend for transactional email delivery; and Render for application hosting. Our current list and processing details are published on the Subprocessors page. We may also disclose information where required by law, to protect rights or security, in connection with a business reorganization or transfer, or at the customer's direction. Providers receive information only as reasonably necessary for their functions and subject to applicable agreements and legal obligations.
9. Payment Information
Payment-card details are processed by Stripe or the applicable payment processor. JobsitePilot does not need to store full payment-card numbers in its application database. We may receive billing-related information such as customer identifiers, subscription status, plan, payment status, transaction references, and limited billing details needed to administer subscriptions.
10. Transactional Email
Account confirmation, password reset, security, and other transactional messages may be delivered using Supabase authentication functionality and Resend email infrastructure. Support or feedback messages may be routed to the business contact channels configured by JobsitePilot.
11. International Transfers
JobsitePilot is operated from Finland, while some service providers or their infrastructure may process data in the United States or other countries. Where GDPR or other law requires safeguards for international transfers, we rely on applicable mechanisms made available by providers and law, such as adequacy decisions, Standard Contractual Clauses, or other lawful safeguards as appropriate. Customers should review their own obligations where they upload personal data on behalf of others.
12. Data Retention
We retain account and Customer Content while the account is active and as needed to provide the Service. After a verified deletion or account-closure request, we delete or de-identify active account and Customer Content within 30 days unless retention is required for security, fraud prevention, dispute resolution, or law. Backup copies may remain until overwritten under provider backup cycles. Billing, tax, transaction and legal records may be retained for the period required by applicable law. Security and diagnostic logs are retained for a limited period appropriate to their purpose. Third-party processors may apply their documented retention periods to transient processing data.
13. Security
We use reasonable technical and organizational measures appropriate to a small B2B SaaS service, including managed authentication, access controls, encrypted network transport where supported, provider security controls, and restricted administrative credentials. No internet service or storage system can guarantee absolute security. Customers are responsible for account security and appropriate handling of exported reports.
14. Cookies and Local Storage
The Service may use browser storage, session storage, cookies, or similar technologies necessary for authentication, session persistence, preferences, security, and core application operation. If non-essential analytics, advertising, or tracking technologies are introduced, JobsitePilot will update its notices and consent mechanisms where required.
15. Marketing Communications
Transactional account and security emails are separate from marketing communications. Where JobsitePilot sends marketing email, applicable consent, identification, opt-out, and suppression requirements will be followed. Unsubscribing from marketing does not prevent necessary transactional or security messages.
16. Your Rights and Automated Decisions
Depending on applicable law and your location, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to lodge a complaint with a competent data-protection authority. Send a request to hello@getjobsitepilot.com. We may verify identity and authority before acting. Rights may be limited by legal exceptions and by whether JobsitePilot acts as controller or processor for particular data. Business customers generally handle requests relating to personal data they control within project content, and we will assist them as required by the DPA. JobsitePilot does not make decisions based solely on automated processing that produce legal or similarly significant effects about individuals.
17. EEA Supervisory Authority
Individuals in the EEA may have the right to complain to the data-protection authority in their country of residence, work, or the place of an alleged infringement. Because JobsitePilot is operated from Finland, Finland's competent data-protection authority may also be relevant where Finnish jurisdiction applies.
18. United States Privacy Rights
Some U.S. states provide privacy rights subject to statutory thresholds, exemptions, and definitions. JobsitePilot will honor rights that legally apply to it. JobsitePilot does not state that every U.S. state privacy statute necessarily applies merely because a user resides in that state. We do not sell personal information for money. If our practices change in a way that triggers legally defined “sale,” “sharing,” targeted-advertising, or opt-out obligations, this Policy and required controls will be updated.
19. Children
The Service is a business and professional construction tool and is not directed to children. Users must be legally capable of entering the applicable business arrangement and must not create accounts for children.
20. Customer Responsibilities
Business customers are responsible for their own privacy notices, employee/worker notices, lawful bases, permissions, retention rules, and data-subject request processes for personal data they choose to place in JobsitePilot. JobsitePilot's Privacy Policy does not replace a customer's own obligations as an employer, contractor, controller, or business.
21. Changes to this Policy
We may update this Policy as the Service, providers, or law changes. The “Last updated” date will be revised, and material changes will be communicated where required by law.
22. Contact
Email: hello@getjobsitepilot.com
Operator and data controller: Tmi J Juuso
Business ID: 2721234-5
Address: Keimolantie 88, 01750 Vantaa, Finland