AtPlot
Privacy Policy
This policy explains what AtPlot collects when you create an account in the construction CRM app, how we use it, and your rights under the GDPR.
1. Who we are
AtPlot is a business (B2B) workspace for construction teams: clients, projects, calendar, chat, photos, time tracking, and an AI assistant. We process personal data to provide that service.
2. Data we collect
- Account: name, email, phone number, role (admin, partner, worker), organisation membership.
- CRM you enter: client names, phones, addresses, KVK/VAT/IBAN, project budgets, notes, calendar events.
- Photos and files: site photos, receipts, documents you upload.
- Chat messages and attachments inside your organisation.
- Voice input: audio is processed on-device / by the speech APIs of your phone to turn speech into text. We do not keep a separate voice archive.
- Device: push token (FCM) so we can send work notifications you enable.
- App activity: which screens you open (counts per day), used to improve the product and support.
- Support emails you send to info@atplot.com.
We do not use advertising SDKs, we do not sell personal data, and we do not track you across other companies’ apps.
3. Why we process data (legal bases)
- Contract: to run your account, organisation, and CRM.
- Legitimate interest: security, abuse prevention, product reliability, screen-visit counts.
- Consent: optional camera, microphone, photo library, and notifications on your device; marketing banners only as in-app product messages.
4. Processors and third parties
- Supabase (EU-hosted database, auth, storage, push token store) — app backend.
- Google Gemini — AI assistant. If you use AI, a snapshot of relevant CRM context (names, addresses, project titles, tasks) is sent to Google to generate a proposal. Nothing is written to your CRM until you tap Confirm.
- Firebase Cloud Messaging — push delivery.
- Stripe — organisation subscription billing on the website (when you upgrade).
- Geocoding (PDOK, Nominatim/OSM, Photon) — converting typed addresses to a map point. We do not collect GPS from the device.
The public website stores a login session in the browser (localStorage) if you sign in there to manage billing. The site admin panel uses a separate password hash in our database, not your app account password.
5. Retention
Account and CRM data stay until you delete the account or your organisation admin removes you. If you are the last admin of an organisation, deleting your account also deletes that organisation and its CRM (clients, projects, photos, chat, calendar). Push tokens and AI usage counters are removed with the account. Backups may linger for a short operational period (up to 30 days).
6. Your rights
You may access, correct, export, restrict, or object to processing, and request erasure. Use Settings → Delete account in the app, or email info@atplot.com. You may lodge a complaint with your local data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).
7. Children
AtPlot is a professional tool. It is not directed at children under 16.
8. Security
Access is limited by organisation membership and role. Transport uses HTTPS. You are responsible for who you invite into your organisation.
9. Changes
We will update this policy on the website and in the app when it changes. Continued use after an update means you accept the revised policy.
10. Contact
AtPlot / Roman Vasilenko
Email: info@atplot.com
Web: atplot.com/privacy