Last updated: July 30, 2026
We collect information you provide directly when creating an account (name, email, company name), information generated through your use of the Service (time entries, project data, photos, GPS coordinates during clock-in), and technical information (device type, IP address, browser type) for security and diagnostics.
When crew members clock in or out, Constra may capture GPS coordinates and/or a photo for verification purposes. This data is associated with the time entry and stored in your company's workspace. Only company administrators can access this data. We do not share GPS or photo data with any third party, and it is never used for purposes beyond verifying attendance.
We use collected information to: (a) provide and improve the Service; (b) authenticate users and secure your account; (c) generate reports, invoices, and payroll exports as requested; (d) communicate with you about your account or the Service; (e) send push notifications you have explicitly opted into; and (f) comply with legal obligations. We do not use your data for advertising or marketing to third parties.
If you grant notification permission, Constra uses the Web Push API to deliver real-time alerts (such as crew clock-in events) to your browser or installed PWA. Your push subscription token is stored securely in our database and associated with your company. You can revoke notification permission at any time through your browser or device settings, or through the Constra Settings page. Revoking permission automatically removes your push subscription from our systems.
We do not sell your personal information. We share data only with: (a) infrastructure providers necessary to operate the Service (Supabase for database and authentication, Vercel for hosting, Resend for email) under confidentiality agreements; (b) law enforcement or regulators when required by law; or (c) a successor organization if Constra is acquired or merged, with advance notice to you.
We retain your data for as long as your account is active. After account termination, data is retained for 30 days to allow recovery, then permanently deleted. You may request earlier deletion by contacting us. Certain data may be retained longer where required by law.
We implement industry-standard security measures including encryption in transit (TLS) and at rest, row-level security policies ensuring your company's data is isolated from other tenants, and access controls that limit data access to authenticated users within your company. All API endpoints require authentication. No system is perfectly secure — report any suspected breach immediately.
Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict certain processing; and data portability. To exercise these rights, contact us through the app. We will respond within 30 days.
If you use Constra to manage employee or contractor records, you are the data controller for that information and Constra acts as a data processor. You are responsible for your own privacy notices to employees and for complying with applicable employment and data protection laws in your jurisdiction.
The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it.
We use session cookies and browser local/session storage to maintain your authenticated session and remember your preferences within the app. We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser, but some features may not work correctly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or by email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
For privacy-related questions, requests, or complaints, please contact us at hello@constra.app. We take all privacy concerns seriously and will respond within 30 days.