Privacy notice

What we collect

Names, work emails, phones, job titles, photos of the work, PDFs, and activity on the job book.

Why

Run data-center construction: punches, RFIs, drawings, photos, crew directory, and ball-in-court notices.

Contract / legitimate interest of the GC and trades named on the job. Accounts are invited, not scraped.

Cookies

Sign-in uses a necessary __Host- session cookie. No marketing pixels, no Google Fonts, no sale of the directory.

Sale and sharing

We do not sell or share personal information for advertising (CPRA). Field seats only receive people named on their jobs.

Terms of Use · Subprocessors / residency · California Do Not Sell or Share

Where the book lives

Each device keeps an offline copy (IndexedDB). The company copy lives on the database of the host that serves this app. Admins record an intended region under Admin → Company (This app host (not country-pinned); United States; Canada; European Union / EEA). Recording EU does not move bytes by itself — deploy the host in the EU if you need residency.

Your rights (GDPR / PIPEDA / CPRA)

• Access / portability: Admin or a manager downloads a DC Forge workspace backup (JSON). That file is your job book.
• Erasure: an admin uses Start empty on a device and publishes only after the company agrees the book should be wiped. Disabling a member seat stops further access.
• Correction: edit the person, punch, or drawing in the book. History keeps issued transmittals.

Contact: Your company admin in DC Forge (Admin → People).

DC Forge processing record

Recipients

Company members with a seat. Field seats only see jobs they are granted and not the full company roster. No ad networks. Fonts are self-hosted.

Transfers

Auth may use the Grok sign-in broker. Library links (SharePoint, Drive, Dropbox) stay at the URL the admin pasted. Job-site weather uses Open-Meteo (location string only, no account).

Retention

Until the company deletes the book or a member is disabled. Backups the GC downloads are under their control. Suspended companies cannot open the book.

Security

Invite-only accounts, role ACL, __Host- session cookies, CSRF isolation, PDF threat scan, snapshot caps, rate limits, no sale of the directory.

Residual

This notice is the product DPIA record. It is not a law-firm opinion or an ISO/SOC certificate.