Privacy Policy

1. Overview

This Privacy Policy explains how [PugBuild legal entity name] ("PugBuild", "we") collects, uses, shares and protects personal data when you use the PugBuild website, app and API (the "Service"). It applies to Customers (employer companies), their Administrators and Office staff, Workers, and visitors who request a demo. We wrote it to meet the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), United States federal and state privacy laws, and good practice in both countries.

2. Roles: who is responsible for your data

For Workers' time, location and pay records, your employer (the Customer) decides why and how that data is processed: it is the controller under the LGPD and the "business" under US state laws. PugBuild processes that data on the Customer's instructions as its processor / operator. Requests about those records should go to your employer first; we will help them respond.

For account, authentication, security, billing, support and demo-request data, PugBuild is the controller and makes its own decisions, as described below.

3. What we collect

Provided by you or your employer

• Identity and contact: name, mobile phone number, preferred language, optional email.
• Employment details entered by the Customer: role, job title, hourly rate, work status.
• Demo requests: name, phone, email, company, sector, city/state, team size, how you track hours today.
• Comments and photos you choose to attach to a punch.

Generated when you use the Service

• Time records: clock-in and clock-out times (server time and device time), the job site matched to the punch, distance to that site, review flags and corrections.
• Precise geolocation at the moment of each clock-in and clock-out, when your device permits it. We never collect location in the background.
• Pay records: weekly hours, gross amount computed from the rate set by the Customer, payment method, pickup note, and your confirmation or dispute.
• Audit log: who changed what and when, including changes made by the Customer's staff and by PugBuild support.
• Consent records: the version of the Terms and this Policy you accepted, when, from which IP address and device.
• Technical data: IP address, browser and device type, approximate timing of requests, error logs.

Cookies

We use only strictly necessary cookies: a session cookie that keeps you signed in and a cookie that remembers your language. We do not use advertising or cross-site tracking cookies.

4. Why we use it and our legal bases

• To provide the Service: record and display time, match punches to job sites, compute weekly totals, send sign-in codes and operational notices. Legal basis: performance of the contract with the Customer and, for Workers, the Customer's legitimate interest in managing work time and complying with labor law (LGPD art. 7, II, V and IX; US laws permitting employment record-keeping).
• To secure accounts: one-time codes, rate limiting, fraud and abuse prevention. Legal basis: legitimate interest and legal obligation.
• To keep legally required records: wage and hour records the Customer must keep. Legal basis: compliance with legal obligations (LGPD art. 7, II).
• To respond to demo requests and support. Legal basis: steps taken at your request before a contract, and legitimate interest.
• Text messages and geolocation rely on your consent, which you give when you sign in and accept this Policy and which you can withdraw as described in section 9.

We do not sell personal data and we do not use it for advertising or profiling with legal effects.

5. Who can see your data

Within your employer's account, Administrators and Office staff can see Workers' time records, punch locations, photos, comments, pay records and confirmations. Workers see only their own records and the list of active job sites. PugBuild staff access account data only to provide support, fix problems or as required by law; such access is logged.

6. Sub-processors and sharing

We share data only with providers that help us run the Service, under contracts that protect it:

• Vercel (hosting and application runtime, United States)
• MongoDB Atlas (database, United States)
• Twilio (text messages, United States)
• Resend (transactional email, United States)
• OpenStreetMap / Nominatim (map tiles and converting addresses to coordinates; we send only job-site addresses and approximate coordinates, never names)
• Vercel Blob (photo storage, when photos are enabled)

We may also disclose data when the law requires it, to protect the rights, safety or property of PugBuild, our users or others, or in a merger or acquisition (with notice to Customers). We do not share Workers' data between different Customers.

7. International transfers

The Service is hosted in the United States. If you are in Brazil, your data is transferred internationally on the basis of LGPD articles 33 to 36: the transfer is necessary to perform the contract with you or your employer, is covered by contractual clauses with our providers, and you consent to it when you accept this Policy. Our providers maintain security measures that meet or exceed the requirements of the LGPD and the standards expected by the Brazilian National Data Protection Authority (ANPD).

8. How long we keep data

• Time, location and pay records: for as long as the Customer's account is active and then for the retention period the Customer needs under labor and tax law (typically at least 3 years under the US Fair Labor Standards Act and state laws; longer where state law requires). When a Worker is deactivated, their history is kept for the same period; it is not deleted on deactivation because the Customer must keep it.
• Precise location attached to a punch is kept with the punch; we do not keep separate location history.
• Photos: kept with the punch for the same period, unless the Customer deletes them sooner.
• Sign-in codes: deleted automatically after 10 minutes. Rate-limit counters: deleted within 1 hour.
• Audit log and consent records: for the life of the account plus 5 years.
• Demo requests: 24 months after the last contact.
• After termination: 90 days for export, then deletion, except where retention is required as above.

9. Your rights

If you are in Brazil (LGPD)

You may request, free of charge: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; information about sharing; information about the consequences of not giving consent; and revocation of consent. You may also object to processing based on legitimate interest and ask for review of automated decisions. Our Data Protection Officer (encarregado) can be reached at privacy@pugbuild.com. You may also file a complaint with the ANPD.

If you are in the United States

Depending on your state, you may have the right to know what personal data we hold, to access it, to correct or delete it, to obtain a copy, and to be free from discrimination for exercising these rights. We do not sell or share personal data for targeted advertising. Massachusetts residents will be notified of security breaches involving their personal information as required by M.G.L. c. 93H.

How to exercise your rights

Workers: ask your employer first for time and pay records; for account data or if your employer does not respond, email privacy@pugbuild.com from the phone number or email on your account. We answer within 15 days (Brazil) or 45 days (United States), and we may ask for information to verify your identity. Withdrawing consent for text messages (reply STOP) or for location (device settings) is possible at any time, but the Service cannot send sign-in codes or match punches to job sites without them.

10. Security

We protect data with encryption in transit (TLS) and at rest, signed session tokens in secure cookies, one-time codes that expire and are stored only as cryptographic hashes, rate limiting, strict separation of each Customer's data, role-based access, and a complete audit log of changes. No system is perfectly secure; if we learn of a breach affecting your data we will notify affected Customers and, where required, individuals and authorities without undue delay.

11. Children

The Service is for working adults and is not directed to anyone under 16. We do not knowingly collect data from children; if you believe a child has an account, contact us and we will remove it.

12. Changes to this Policy

We may update this Policy. Material changes will be announced in the app or by email at least 15 days before they take effect, and you will be asked to accept the new version at your next sign-in. The version and effective date appear at the top of this page.

13. Contact

Controller / operator: [PugBuild legal entity name], [address]. Privacy and Data Protection Officer (encarregado): privacy@pugbuild.com. Legal: legal@pugbuild.com.