Privacy Policy

1. Controller

Conaprojekt, Luka Godnič s.p.
Trstenik 74, 4204 Golnik, Slovenia
Registration no.: 6311130000 · VAT ID: SI78923115
Email: info@conaplan.app

We have not appointed a data protection officer (DPO), as this is not legally required given the nature and scale of our processing. Send any data protection question to the address above.

2. Data we process

• Account and organisation: email address, name, password (stored only as a hash by the authentication provider), organisation name, logo, role in the organisation (owner, manager, field).
• Team invitations: the invitee's email address, role, one-time code and invitation status.
• Schedules and projects: projects, activities, phases, durations, dependencies, deadlines, crews and their availability, schedule versions, change history (who, when, what), change proposals with reasons, and imported schedule files (processed during import, not kept).
• Status from site: progress entries (date, percentage, actual start and finish, note, author), problem reports with a reason and comment, approvals and rejections.
• Site reports: voice recordings, their transcripts, AI-structured report content and translations, photos, approximate location at the time a report is created (solely to retrieve weather data for the site), weather data, generated PDF documents and report recipients' email addresses.
• Subcontractor links: crew name and answers on activities (confirm / problem / not sure yet) with a note; the link token is stored only as a hash. Subcontractors need no account to use a link.
• Weekly report emails: recipients chosen among the organisation's members and up to five extra email addresses (e.g. client, supervision), unsubscribe status and a send log.
• Subscription and payment: subscription id, plan, period, payment status and billing details (including VAT ID). We do not store card numbers — you enter them directly with Stripe.
• Technical data: IP address, device and browser type, access and error logs — for operation, security and abuse prevention (e.g. rate limiting on public links).
• Website: your cookie choice and — only with consent — visit analytics (Google Analytics 4).

The Service is intended for business use and not for persons under 18.

3. Purposes and legal bases

4. Your organisation's content — you are the controller

Content your organisation creates in the Service (schedules, reports, recordings, photos, crew and subcontractor data, report recipients) remains yours. Where it contains personal data of third parties — for example workers' names, photos of people on site, voices in recordings, recipients' email addresses or subcontractors' answers — you act as the controller for that processing and we act as a processor, processing the data only on your instructions and to provide the Service.

You are responsible for an appropriate legal basis and for informing those persons. The same applies to team invitations, subcontractor links and extra weekly-report recipients: we send addresses and links on your instruction. Extra weekly-report recipients can unsubscribe at any time through the link in every message.

For business users we conclude a data processing agreement (DPA) under Art. 28 GDPR on request — email info@conaplan.app.

5. Artificial intelligence and automated decisions

For site reports we use AI for speech transcription, structuring the report content and translation. The result is a draft the user reviews and expressly confirms before sending; without confirmation no report is sent. We do not use your content to train AI models.

The schedule, critical path, finish forecast and schedule health are calculated by a deterministic algorithm without AI.

We make no decisions with legal or similarly significant effects on individuals based solely on automated processing within the meaning of Art. 22 GDPR.

6. Processors and place of processing

To run the Service we work with the following processors, who process personal data only on our instructions:

• Supabase Pte. Ltd (Singapore) — database, authentication and file storage (recordings, photos, PDFs, logos). Data is stored in Frankfurt, Germany (EU).
• Railway Corp. (USA) — hosting of the application server (API) in Amsterdam, Netherlands (EU). Data is processed there while requests are handled and is not stored.
• Hetzner Online GmbH (Germany) — a server in Nuremberg, Germany (EU): report and email automations, PDF generation, schedule file conversion during import, hosting of the website and web app, and encrypted backups.
• Plus Five Five, Inc. (Resend, USA) — email delivery (sign-in and password-reset codes, invitations, site reports, weekly reports).
• OpenAI (USA) — transcription of voice recordings.
• Anthropic PBC (USA) — structuring and translation of report content.
• OpenWeather Ltd (United Kingdom) — weather data for the approximate site location.
• Google Cloud EMEA Limited (Ireland) — business mailbox (Google Workspace) for support and data subject requests and — only with consent — website analytics (Google Analytics 4); processing may also take place at Google LLC (USA).
• AVANT.SI d.o.o. (NEOSERV, Slovenia) — web endpoint that starts the payment flow and logs cookie consents.

In addition, Stripe, Inc. (USA, with its European entity Stripe Payments Europe, Limited, Ireland) receives data to process subscriptions and payments. For payment services Stripe acts as an independent controller, as it also processes data for its own legal obligations (fraud prevention, payment and anti-money-laundering law); Stripe's privacy policy applies. Apple and Google process data as independent controllers when you download the mobile app from their stores.

Where data is transferred to or accessible from outside the European Economic Area (e.g. with providers based in the USA or Singapore), the transfer complies with Art. 44–49 GDPR: on the basis of an adequacy decision (including the EU–US Data Privacy Framework where the provider participates) or the European Commission's standard contractual clauses (SCCs). We update this list whenever processors change; for customers with a DPA the notice procedure in the DPA applies.

7. Retention

• Account, organisation and Service content: while the account is active. After account deletion or the end of the relationship we delete or anonymise the data within a reasonable period, unless the law requires otherwise.
• Schedule versions, change history and progress entries: as part of the project, for as long as the project exists; deleted with the project.
• Subcontractor links: valid for 90 days or until revoked; answers remain part of the project.
• Invitations: the code is valid for 7 days; the invitation record remains as a membership record.
• Accounting and payment data: up to 10 years (tax and accounting law).
• Backups: the database and stored files are backed up daily, encrypted. Deleted data may remain in backups for up to 14 days and is then irreversibly removed.
• Technical logs: 7 days at the application-server provider, at most 30 days on our servers.
• Website analytics: up to 2 years (Google Analytics setting), only with consent.

Cancelling a subscription does not delete the account automatically — request deletion separately. The procedure is described on Account & Data Deletion.

8. Mobile app

• The microphone is used only while you record a voice report.
• The camera and photos only when you add a photo to a report.
• Location is read only when a report is created and only for weather data; location is never tracked in the background.
• Local storage on the phone keeps your sign-in and the queue of reports, confirmations and problem reports waiting for a connection; the queue is emptied once they are sent.
• Notifications are local (e.g. about queued entries being sent); no push notification service is used.

9. Your rights

Under Art. 15–22 GDPR you have the right of access, rectification, erasure, restriction, portability, objection and to withdraw consent. Exercise them at info@conaplan.app; we reply within one month at the latest.

If you are a member of an organisation or a subcontractor and the request concerns the organisation's content, we forward it to the controller (your organisation) and help it respond.

You may lodge a complaint with the supervisory authority — the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (www.ip-rs.si).

10. Security

• encryption in transit (HTTPS/TLS) for every connection;
• separation of data by organisation at database level (RLS) and server-side permission checks on every request;
• passwords only as hashes; link and unsubscribe tokens only as hashes;
• backups encrypted with a public key the server itself cannot decrypt;
• two-factor authentication for internal systems, restricted access and regular updates.

11. Cookies and browser storage

The website and the web app use strictly necessary browser storage; website analytics loads only with consent. Details in the Cookie Policy.

12. Changes and contact

We may update this policy; we will notify you of material changes by email or in the app. The date of the last update is shown at the top.

Contact: info@conaplan.app · Trstenik 74, 4204 Golnik, Slovenia