Last updated: October 26, 2026
We collect information you provide directly when creating an account (name, email, phone number, company name), information generated through your use of the Service (time entries, project data, photos, voice messages, GPS coordinates during clock-in, and while clocked in with the app open; time-off requests and their optional reason; work schedules; and certifications with their expiry dates), and technical information (device type, IP address, browser type) for security and diagnostics.
When crew members clock in or out, Constra may capture GPS coordinates and/or a photo for verification purposes. While someone is clocked in and has Constra open on their phone, it also checks their location every few minutes to notice when they leave or return to the job site's area; only the time, the job and the distance from the site are saved, not a trail of where they went. It stops at clock-out and never runs when the app is closed. This data is associated with the time entry and stored in your company's workspace. Only company administrators, project managers and foremen can see it. We do not share GPS or photo data with any third party, and it is never used for purposes beyond verifying attendance.
We use collected information to: (a) provide and improve the Service; (b) authenticate users and secure your account; (c) generate reports, invoices, and payroll exports as requested; (d) communicate with you about your account or the Service; (e) send push notifications you have explicitly opted into; and (f) comply with legal obligations. We do not use your data for advertising or marketing to third parties.
If you grant notification permission, Constra uses the Web Push API to deliver real-time alerts (such as crew clock-in events) to your browser or installed PWA. Your push subscription token is stored securely in our database and associated with your company. You can revoke notification permission at any time through your browser or device settings, or through the Constra Settings page. Revoking permission automatically removes your push subscription from our systems.
We do not sell your personal information. We share data only with: (a) infrastructure providers necessary to operate the Service (Supabase for database, file storage and authentication; Vercel for hosting; Resend for email; Groq, which processes the questions you ask the in-app assistant along with the relevant company data; Stripe for card payments on invoices; and Open-Meteo and OpenStreetMap, which receive job-site coordinates or addresses to look up weather and map locations) under their respective terms; (b) law enforcement or regulators when required by law; or (c) a successor organization if Constra is acquired or merged, with advance notice to you.
Constra only uses your microphone when you tap a mic button. Voice messages you record are stored in your company's workspace and are visible to the people you send them to. When you dictate into a form, your device's speech service (for example Apple or Google) turns the speech into text; Constra saves only the resulting text, not the recording.
We retain your data for as long as your account is active. After account termination, data is retained for 30 days to allow recovery, then permanently deleted. You may request earlier deletion by contacting us. Certain data may be retained longer where required by law.
We implement industry-standard security measures including encryption in transit (TLS) and at rest, row-level security policies ensuring your company's data is isolated from other tenants, and access controls that limit data access to authenticated users within your company. All API endpoints require authentication. No system is perfectly secure — report any suspected breach immediately.
Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict certain processing; and data portability. To exercise these rights, contact us through the app. We will respond within 30 days.
If you use Constra to manage employee or contractor records, you are the data controller for that information and Constra acts as a data processor. You are responsible for your own privacy notices to employees and for complying with applicable employment and data protection laws in your jurisdiction.
The Service is intended for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it.
We use session cookies and browser local/session storage to maintain your authenticated session and remember your preferences within the app. We do not use advertising cookies or third-party tracking cookies. We count page views with Vercel Analytics, which uses no cookies and does not identify you. You can disable cookies in your browser, but some features may not work correctly.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or by email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
For privacy-related questions, requests, or complaints, please contact us at hello@getconstra.com. We take all privacy concerns seriously and will respond within 30 days.