Privacy policy

1. Who is responsible

DocuSite is a service of Projectum Oficina Tecnica Online S.L. («DocuSite» or «we»), tax ID (NIF) B67406009, registered address C/ Ciutat d'Elx, 19, 08027 Barcelona (Spain).

For any privacy matter, write to [email protected].

This policy applies to the DocuSite app for iOS and Android, to each organisation's website at docusiteapp.com and to the public site at docusite.ai and direcciondeobra.com.

2. Controller and processor: DocuSite's two roles

DocuSite is contracted by organisations (architecture practices, engineering firms, contractors, developers…). Our role depends on the data:

• We are the controller of your account data (name, email, phone number if you use it to sign in), billing, service security, support and the enquiries you send us from the public site.
• We are a processor of the project data your organisation uploads to DocuSite (projects, parties, reports, photos, notes, signatures). Your organisation is the controller: it decides what is uploaded, who sees it and how long it is kept, and we process it only to provide the service, under a data processing agreement as required by Article 28 GDPR.

If your request concerns project data (for example, you appear as a party in a report), address it to the organisation that manages it. If you write to us, we will pass it on and help them respond.

3. What data we process

• Account: name, email address and, if you use it to sign in, your mobile number; your chosen language, the organisations you belong to and your role in each. DocuSite has no passwords: you sign in with a one-time code.
• What you capture on site visits: photos (with their capture date and time), voice notes and their transcription, and written notes. The app keeps them on the phone until there is a connection and then uploads them.
• Location: only while the app is open and if you allow it, to check that you are on site and to place the setting-out map. The app does not use location in the background or record your movements.
• Device: the device name, its operating system and the app version, to show you the list of open sessions so you can close them.
• Contacts read from a QR code: when you scan a contact card's QR code to add someone to a project, we process the data that QR code contains (name, company, email, phone…). The app does not access your phone's address book.
• Organisation data: projects (address, coordinates, cadastral reference and other site data), parties and contacts (name, company, role, email, phone and, for signatories, their national ID or tax number), reports, comments, documents, signatures and acknowledgements of receipt.
• Billing: the organisation's tax details and its payment and invoice history. Card details are handled directly by Stripe: DocuSite neither sees nor stores them.
• Usage and security: technical access logs (IP address, date, browser or app), the audit log of actions taken in each organisation and usage of the artificial intelligence features.
• Enquiries and support: what you send us through the public site's contact form (name, email and, if you provide them, company, job title, team size, phone and message) or by email to support.

4. What we use it for

• Providing the service: your account, your organisations, projects, on-site capture, sync between the app and the website, and generating Word and PDF documents.
• Sending you sign-in codes and service notifications (invitations, pending signatures, changes to a report) by email and, where used, by SMS or WhatsApp.
• Drafting with artificial intelligence: transcribing voice notes, describing photos and preparing the report draft, which a person always reviews before it is accepted.
• Charging for plans and issuing invoices.
• Providing support and answering enquiries from the public site.
• Protecting the service: preventing unauthorised access and abuse, limiting attempts, keeping the audit log and meeting our legal obligations.

We do not sell data, share it for advertising or build advertising profiles. We do not authorise our artificial intelligence providers to use your content to train their models.

5. Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): the account, the service, sign-in codes, billing and support.
• Legitimate interest (Art. 6(1)(f)): service security, fraud prevention, auditing and notices about the service itself.
• Legal obligation (Art. 6(1)(c)): keeping invoices and responding to requests from the authorities.
• Consent (Art. 6(1)(a)): enquiries from the public site's form and access to location, camera and microphone, which you grant and withdraw in your phone's system permissions. Without them the app keeps working, except for the feature that needs them.
• For project data, the legal basis is decided by your organisation as controller; we process it on its behalf.

6. Who else processes the data

To provide the service we rely on these providers, acting as processors (or sub-processors) under a contract that requires them to process data only on our instructions:

• Our own server hosted in the European Union: DocuSite's API and database.
• Cloudflare: storage of photos and documents (R2), content delivery and traffic protection, and bot verification (Turnstile) at sign-up.
• Amazon Web Services: sending email (Amazon SES, EU region).
• Google Cloud: speech transcription (Speech-to-Text, in the EU multi-region) and Google Maps (address search, location map and street view).
• Anthropic: the Claude model, to draft reports and describe photos.
• Stripe: payments and billing, on the website only.
• An SMS or WhatsApp messaging provider, when sign-in codes are sent that way.

Authorities may also access data where required by law.

7. International transfers

Some of these providers are US companies or have part of their infrastructure there. When data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework (where the provider is certified) or on the standard contractual clauses approved by the European Commission, with any additional safeguards required.

8. How long we keep it

• Your account data: while the account is active. When you delete it, it is erased, except what we must keep by law.
• Organisation data: while the organisation uses the service. When it cancels, it stays read-only for 30 days so it can export everything; it is then closed, kept for a further 90 days in case it returns and, after that, deleted completely (we give notice 30 and 7 days before).
• Trash: anything deleted in DocuSite can be restored for 30 days; it is then erased.
• Invoices and audit: for as long as commercial and tax law requires and as needed to deal with possible liabilities.
• Backups: renewed by rotation, so deleted data also disappears from them at the end of their cycle.
• Enquiries from the public site: for as long as needed to answer and follow them up.

9. Security

Communications are encrypted (HTTPS). Each organisation sees only its own data: the separation is enforced in the database itself. You sign in with one-time codes, sessions can be reviewed and closed from the device list, service credentials are stored encrypted and relevant actions are recorded in an audit log.

10. Your rights

You can ask to access your data, rectify or erase it, object to its processing, restrict it or receive it in a portable format, and withdraw any consent you have given. Write to [email protected] from your account's email address; we will reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

11. How to delete your account

You can delete your account at any time at app.docusiteapp.com/account/delete (sign in with your email and a code) or from the app itself, in your account menu.

If you are the only person with the Administration role in an organisation, you will first need to hand that role to someone else or close the organisation, so that nobody is left unable to manage it. What you contributed to an organisation's projects (reports, photos, notes) belongs to that organisation and stays with it.

12. Cookies and browser storage

The public site (docusite.ai and direcciondeobra.com) does not use cookies or any analytics or advertising tools. It only stores in your browser whether you prefer the light or dark theme.

The DocuSite web app (docusiteapp.com) uses a technical session cookie, essential to keep you signed in, and stores your language and theme in the browser. Cloudflare may use its own technical cookies to protect the service against abuse. None of them is used for advertising.

The app does not include any third-party analytics or advertising tools.

13. Children

DocuSite is a professional service and is not directed at children under 16. We do not knowingly process children's data.

14. Changes to this policy

If we change anything significant, we will tell you in the app or by email before it applies. The date above shows the latest version. See also the terms of use.