Privacy Policy

Introduction

SyteSense (“SyteSense”, “we”, “us”, or “our”) is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us.

This Privacy Policy describes how we collect, use, disclose, process, store, and safeguard personal data when you access or use:

• The SyteSense web platform
• Mobile applications
• Construction workflow management tools
• Field reporting and compliance tools
• Subcontractor coordination systems
• Project documentation and analytics services
• Any related services (collectively, the “Services”)

SyteSense provides enterprise-grade construction management software to contractors, subcontractors, and infrastructure stakeholders globally.

This policy is written for users in New Zealand and Australia. If you are accessing the site from another jurisdiction, your local laws may grant you additional rights — please contact us if you have any questions about how we handle your data.

What information we collect

We only collect what we need to run our services and respond to your enquiries. This section covers the website. For the mobile app, see the SyteSense Mobile App section below.

Form submissions

When you fill out a form on our site, we collect the information you provide:

• Your name
• Your company name
• Your email address
• Your phone number
• Any message or details you choose to share

Website analytics

We use Google Analytics 4 (provided by Google) to understand how visitors use our website so we can improve it. Google Analytics uses cookies and similar technologies. The data collected includes:

• Pages visited and time spent on each page
• How far you scroll down a page
• Which calls-to-action and links you click
• A randomly generated identifier (stored in a cookie) used to recognise return visits within Google Analytics
• Approximate location derived from your IP address (typically city or region level), and device, browser, and operating system
• Referring website or marketing campaign that brought you here

Some of this processing involves transfers to Google's servers outside New Zealand. For details on how Google handles analytics data, see Google's privacy policy.

How we limit Google Analytics

For Google Analytics we have explicitly set all of Google's advertising-related consent signals (ad_storage, ad_user_data, and ad_personalization) to denied at the code level. This means:

• Google Analytics does not use your on-site activity to build Google remarketing audiences or to personalise Google ads
• We do not sell your personal data, and we do not share it with data brokers
• You can clear analytics cookies at any time via your browser's settings (see Cookies and tracking below)

Advertising and conversion measurement

We advertise SyteSense on platforms including Meta (Facebook and Instagram) and Google. To understand whether those ads lead people to sign up, our website uses the Meta pixel and Google Ads conversion tags.

The Meta pixel loads on our website and reports events to Meta — for example, viewing a campaign landing page or starting a sign-up — along with your IP address and device and browser details, and it sets a cookie (_fbp). This lets us measure how our ads perform and allows Meta to attribute conversions and, in line with Meta's own data policy, build advertising and measurement audiences. For how Meta uses this data, see Meta's privacy policy.

You can control ad tracking through your Meta ad preferences, your Google ad settings, or by blocking these cookies in your browser.

How we use your information

We use the information we collect for straightforward purposes:

• Form submissions: To respond to your enquiry, provide information about SyteSense, and follow up if you have asked us to
• Analytics: To understand which pages and features interest visitors so we can improve the website
• Advertising measurement: To measure whether our ads led you to sign up, using the Meta pixel and Google Ads tags (see Advertising and conversion measurement above)

We do not sell your personal information to third parties. Aside from the advertising measurement described above, we do not use it to build marketing profiles of you.

Sharing and Disclosure

We may share personal data with:

• Cloud hosting and infrastructure providers
• Security and monitoring providers
• Payment processors
• Analytics and advertising platforms (Google and Meta) that measure how our website and our ads perform, as described in Website analytics and Advertising and conversion measurement above
• Professional advisors (legal, audit, accounting)
• Regulatory authorities where required

Our service vendors are contractually bound to confidentiality and data protection obligations. Analytics and advertising platforms such as Google and Meta process the data they receive under their own privacy policies, which we link to above.

How we protect your data

We take practical steps to keep your information safe:

• HTTPS encryption on every connection. Your data is encrypted in transit
• Hosted on Vercel – enterprise-grade infrastructure with SOC 2 compliance
• No client-side storage of sensitive data. We do not store your details in browser storage
• Server-side validation on all form submissions to prevent injection attacks
• Rate limiting on form submissions to prevent abuse

How long we keep your data

• Form submissions: Retained while needed to respond to your enquiry and follow up. You can request deletion at any time.
• Analytics data: Stored by Google Analytics per our configured retention setting in Google Analytics 4. You can clear analytics cookies at any time via your browser's settings.

SyteSense Mobile App

The SyteSense mobile app collects additional information beyond what the website collects. This section explains what the app collects, why, and how it is handled.

Account and profile data

When you create an account and use the app, we store:

• Your name, email address, and phone number
• Your organisation name, role, and membership details
• Projects you are assigned to and your role on each project
• Your work schedule and crew assignments
• Profile photo, timezone, and language preferences

Time tracking and work records

When you clock in or out, the app records:

• Timestamps, duration, and any notes you add
• Photos you capture as part of time entries (see below)
• GPS coordinates at the moment of clock-in or clock-out (see below)
• Tasks, site diaries, and form submissions linked to your work

Photos

When you take a photo through the app for time tracking, the photo is:

• Saved on your device for offline access
• Compressed and uploaded to our cloud storage (Supabase), organised by your organisation and project
• EXIF metadata (including GPS coordinates, date, and time) is preserved in the uploaded photo

Location data

The app captures your GPS location only at specific moments: when you clock in, clock out, or take a photo. There is no ongoing or background location tracking. Location data is stored alongside your time entries on our servers.

Location data comes from one of three sources: the photo's EXIF metadata, your device's GPS, or manual entry. The app works without location permission. If you decline, location fields are simply left blank.

Financial data

If your organisation uses invoicing features, we store invoice details including subtotals, GST amounts, totals, and PDF documents. This data is scoped to your organisation and protected by role-based access controls.

Device permissions

The app requests the following permissions on your device. All are optional. The app will work with reduced functionality if you decline any of them.

• Camera: To capture photos for time tracking entries
• Location: To record GPS coordinates with your clock-in and clock-out entries
• Notifications: To send you schedule reminders, sync updates, and important alerts
• Photo library (iOS): To save time tracking photos to your device

Third-party services used by the app

The mobile app communicates with the following services. None of them use your data for their own advertising or marketing.

• Supabase – database, authentication, and file storage (hosts your account data, time entries, and uploaded photos)
• Firebase Cloud Messaging (Google) – delivers push notifications to your device
• Firebase Crashlytics (Google) – collects crash reports to help us fix bugs. Reports include your device model, OS version, app version, and error details. No personal identifiers are attached to crash reports.
• Firebase Analytics (Google) – collects anonymous usage data such as screen views, device type, and app version to help us understand how the app is used. No personal identifiers are collected.
• Apple Push Notification Service – delivers push notifications on iOS devices
• Resend – sends transactional emails such as notifications and invitations
• Sentry – server-side error tracking for our backend services

Where your data is stored

The app stores data both on your device and in the cloud:

• On-device: Photos, time entries, and app data are cached locally for offline access. This data stays on your device and syncs to the cloud when you have a connection.
• Cloud: Your data is stored in Supabase, which uses enterprise-grade infrastructure with row-level security to ensure you can only access data within your own organisation and projects.

How long we keep mobile app data

• Time entries, timesheets, and invoices: 7 years from the end of the relevant tax year, as required by New Zealand tax and employment law
• Work site photos: 7 years after project completion, to support legal liability and insurance requirements common in the construction industry
• GPS location data: Retained as part of time entry records for the same 7-year period
• Crash reports: 30 days
• Analytics data: 90 days
• Push notification tokens: Deleted when your device unregisters or after 90 days of inactivity

After the applicable retention period, data is securely deleted. If you delete your account, we remove your personal information (name, email, profile) within 30 days. Anonymised business records such as timesheets and invoices are retained for the legally required period.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of any inaccurate information
• Request deletion of your data

To exercise any of these rights, get in touch by email at support@sytesense.com or call us on +64 22 198 5603. We will respond within 20 working days, as required by the Privacy Act.

New Zealand Privacy Act 2020 Compliance

For individuals located in New Zealand, SyteSense complies with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs).

Under the NZ Privacy Act, individuals have the right to:

• Request access to personal information
• Request correction of personal information
• Be informed of the purpose of collection
• Expect reasonable safeguards to protect their data

We take reasonable steps to ensure personal information is:

• Collected for lawful and necessary purposes
• Not retained longer than required
• Protected against loss, misuse, or unauthorized disclosure

If you believe we have breached the Privacy Act 2020, you may contact us directly or lodge a complaint with the Office of the Privacy Commissioner of New Zealand.

Cookies and tracking

We use cookies on our website. We show a brief notice on your first visit so you know they're in use; this notice is for transparency, not consent management. The cookies in use are Google Analytics (for measuring how the site is used) and the Meta pixel (for measuring advertising conversions — see Advertising and conversion measurement above).

Analytics cookies set by Google Analytics

• _ga – distinguishes returning visitors. Expires after 2 years.
• _ga_<container-id> – maintains session state for our specific Google Analytics property. Expires after 2 years.

Advertising cookie set by the Meta pixel

• _fbp – set by the Meta pixel to measure advertising conversions and attribute them to Meta (Facebook and Instagram) ad campaigns. Expires after 90 days.

Other browser storage

We store a small entry in your browser's local storage (ss_cookie_notice_dismissed_v1) to remember that you've dismissed the cookie notice, so we don't show it on every visit. This entry is not used for tracking and is not sent to any server.

Controlling cookies

You can clear or block cookies at any time via your browser's settings. Clearing analytics cookies for sytesense.com will reset your Google Analytics identifier — your next visit will appear as a new visitor in our reports.

We use Google's Consent Mode v2 with all advertising signals (ad_storage, ad_user_data, ad_personalization) hard-coded to denied at all times. Even if you have a Google account, your visit cannot be used to build remarketing audiences or for ad personalisation.

What we do not use

• Beyond the Meta pixel described above, no other advertising or remarketing pixels (for example LinkedIn or X)
• We do not sell your personal data or share it with data brokers
• No fingerprinting beyond the standard browser metadata Google Analytics and the Meta pixel collect

Children's privacy

SyteSense is a business tool for construction professionals. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

Changes to this policy

We may update this privacy policy from time to time. When we make changes, we will update the effective date at the top of this page. For material changes, we will add a notice on the website.

Contact us

If you have any questions about this privacy policy or how we handle your data, get in touch. We are happy to help.

• Email: support@sytesense.com
• Phone: +64 22 198 5603
• Privacy Officer: SyteSense Privacy Officer, contactable at the email and phone above