Privacy Policy
Effective date:
This Privacy Policy explains how Axioric Inc. ("OnSiteCapture", "we", "us") collects, uses, shares and protects personal information when you use the OnSiteCapture mobile apps for iOS and Android, the web app at app.onsitecapture.com, and related services (together, the "Service").
Personal information means any information that identifies you or can reasonably be linked to you, such as your name, email address, device identifier or photos that show you. It does not include information that has been anonymized so it cannot be linked to a person.
OnSiteCapture is a business tool. Field teams use it to capture photos, measurements, notes, tasks and floor plans for job sites, and to share that work with colleagues and with their own customers.
Who controls your information
- Your account. We decide how your account information is used, as described in this policy.
- Project content. When you work inside an organization (a company workspace), that organization decides what happens to its projects and the content in them. We process project content on the organization's behalf, following its instructions and this policy. An organization that needs particular data processing terms can contact us at support@onsitecapture.com. If you have a question about content in an organization's project, you can contact that organization. We will help it respond.
Your choices and rights
- Update your profile: in Settings in the app.
- Delete your account:
- In the mobile app, go to Settings → Profile → Delete account, or email support@onsitecapture.com.
- If you own an organization, first transfer ownership to another member or contact us. Do the same with any projects that belong only to you.
- Withdraw consent: you can turn off camera, photo, Bluetooth and notification access at any time in your device settings. Turning these off disables only the features that need them.
- Privacy rights: depending on where you live, including the EEA, the UK, California and other US states, you may have the right to:
- access your information
- correct it
- delete it
- receive a portable copy of it
- object to or restrict certain processing
- appeal our decision on your request
To use these rights, email support@onsitecapture.com. We verify your identity before acting, respond within the time the law requires, and never treat you differently for exercising your rights. An authorized agent may make a request for you with your written permission. You may also complain to your local data protection authority.
- California and other US state privacy laws: where they apply, the categories of personal information we collect, the sources, the purposes, the recipients and the retention periods are the ones described in this policy. We do not sell personal information or share it for cross-context behavioral advertising.
- Do Not Track and Global Privacy Control: we do not sell personal information or share it for advertising, so there is nothing to opt out of. These browser signals do not change how the Service works.
Information we collect
Information you give us
- Account information: your name, email address, username and password when you sign up, plus a phone number or profile photo if you add one. Our sign-in provider stores your password in hashed form. We never see it in plain text.
- Organization information: organization name, logo, city, type of work, and each member's role.
- Project content: project names, descriptions and site addresses; client names; photos and images you capture or import; markups, notes, comments, tasks and checklists; measurements; floor plans and room-scan geometry; and the PDF, ZIP or drawing exports you create.
- Information about other people: email addresses of people you invite, names and addresses of your clients, and anything else you choose to record in a project. Photos you take may show people or private property. You are responsible for having the right to collect and share that information (see our Terms of Service).
- Messages: text you write when you share a project by email or invite someone, and feedback such as bug reports and feature suggestions. Feedback includes your login email, user identifier, workspace and organization context, platform, and app version/build so we can understand and respond to your request.
Information from invited customers
When a business invites its customer to a project through a customer link, the customer enters an access code, and we create a guest session without asking for an account. We collect the photos and measurements the customer submits, plus the time their session was last active.
Information collected automatically
- Device and app information: device model, operating system, app version, a device identifier our app creates, and a push-notification token if you allow notifications.
- Log and network information: IP address, browser type, the pages and features requested, and the date and time of each request. Our monitoring provider may estimate your city and region from your IP address.
- Diagnostics: crash reports, error details, and performance measurements. When an error happens in the web app, our error-reporting provider may record a replay of the page as it looked at that moment. All text in the replay is masked, and images and media are blocked.
- Usage analytics (mobile apps): app events such as app opened, backgrounded, installed or updated, linked to an internal user ID after you sign in. These events may start when you open the app, before you sign in.
- Share-link views: when someone opens a public share link, we record the time, a value derived from their IP address, their browser type, and their account if they are signed in.
- Laser meters: if you pair a Bosch laser distance meter, the meter's Bluetooth name and identifier are stored on your device.
Cookies and similar technologies
The web app uses only cookies needed to run it: sign-in session cookies from our sign-in provider, short-lived cookies that remember your role or a pending invite, guest-session cookies for customer links, and one display preference. We do not use advertising or cross-site tracking cookies. The mobile apps store an analytics identifier and your sign-in session on your device.
Information we do not collect
- Location: the Service does not read your device's location. On Android 11 and earlier, the system requires location permission for Bluetooth scanning. We ask for it only to find laser meters and never read your location.
- Contacts and microphone: we do not access your contacts or your microphone.
- Advertising: we do not use advertising identifiers or track you across other companies' apps and websites.
Photo metadata
Photos can contain metadata your device adds, such as the time taken, the device model, or a location if your camera records one. Our apps re-encode most photos as they process them, which usually removes this metadata. We do not guarantee removal for every image, for example images attached to notes.
Room scanning
Room scanning uses your device's camera and depth sensor through Apple RoomPlan/ARKit on iOS or Google Play Services for AR (ARCore) on Android. The scan is processed on your device. We save only the resulting room geometry: walls, openings and dimensions. We do not store the camera feed. On Android, ARCore is provided by Google and governed by the Google Privacy Policy.
How we use information
We use personal information to:
- provide the Service: create and secure your account, store and sync your work across devices, and generate exports
- share your work the way you direct, including organization access, share links, customer links and emails
- send service messages: verification codes, invitations, shared-project emails, and push notifications you allow
- keep the Service secure: verify sign-ins, limit abuse with rate limits, and investigate suspicious activity
- diagnose crashes and errors, and measure performance
- understand how features are used, so we can improve them
- meet legal obligations and enforce our Terms of Service
We do not sell personal information. We do not use it for advertising. We do not use your project content to train artificial-intelligence models.
Legal bases (EEA, UK and Switzerland)
Where these laws apply, we rely on:
- Contract: to provide the Service you signed up for.
- Legitimate interests: to secure the Service, diagnose problems, and understand feature use. We weigh these interests against your rights.
- Consent: where we ask for it, such as camera, photo, Bluetooth and notification permissions. You can withdraw consent at any time.
- Legal obligation: where the law requires us to keep or disclose information.
Service providers
| Provider | What it does for us | Information it receives |
|---|---|---|
| Clerk | Sign-in and account management | Name, email, username, hashed password, phone if added, session and device details, IP address |
| Supabase | Database, file storage, server functions, real-time updates | All account and project information |
| Cloudflare | Storage and delivery of photos and files, and backups | Photos, images, exports, organization logos |
| Vercel | Hosting the web app | IP address, request details, server logs, and older exports created before we moved export storage |
| Fly.io | Generating PDF and ZIP exports | The project content included in an export |
| Upstash | Rate limiting and short-lived access caching | IP addresses and hashed access tokens |
| Sentry | Error and crash reporting | Error details, device or browser details, internal user ID, masked web error replays |
| New Relic | Performance monitoring and logs | Device and network details, crash data, logs, approximate city and region, a device identifier |
| PostHog | Usage analytics in the mobile apps | App events, internal user ID, device details, an analytics identifier |
| Expo | App updates and push-notification registration | Device and app details, IP address, push token |
| Apple and Google | Delivering push notifications | Push token and notification text |
| Resend | Sending email | Recipient email address and message content |
Each provider may use the information only to provide its service to us. Each is bound by contractual confidentiality and security obligations that protect your information at least as well as this policy does.
International transfers
We store and process information in the United States. Some providers deliver content through servers in other countries. If you use the Service from outside the United States, your information is transferred to the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep information
- Account information: for as long as your account exists. When you delete your account, there is a 30-day period during which you can cancel. After that, your sign-in identity and profile are permanently deleted.
- Project content: for as long as the project exists. Content you created in an organization's projects belongs to that organization and stays after you leave or delete your account, no longer linked to your account.
- Deleted projects: held in Recently Deleted for 30 days, then permanently deleted from our database and file storage.
- Customer guest sessions: removed after 90 days without activity.
- Integration records: API key audit records are kept for 90 days. Webhook delivery logs are kept for 14 days.
- Organization invitations: expire after 7 days.
- Share links: active until the person who created them turns them off or they reach the expiry date that person set. View records are deleted with the link.
- Backups: kept for a limited period set by our hosting providers, then deleted on a rolling basis. A deleted item can remain in backups until they expire.
- Diagnostics, logs and analytics: kept for the limited periods set by our providers' retention settings, then deleted automatically.
- Security and audit records: may be kept after an account is deleted when we need them for security, fraud prevention or legal obligations. They contain only what those purposes require.
Security
We protect information with:
- encryption in transit
- database access rules that limit each person to the data their role allows
- links to photos and files that expire after a few minutes
- sign-in protections from our sign-in provider
Offline copies of photos on your phone are excluded from iCloud and Android device backups. No system is perfectly secure, and anyone holding a public share link can view what it shares, so set a password and an expiry date on links that need them.
If a security incident affects your personal information, we will investigate, take steps to contain it, and notify you and the authorities as the law requires.
Children
The Service is for business use by people aged 18 or older. It is not directed to children, and we do not knowingly collect information from anyone under 13, or under 16 in the EEA and UK. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
We may update this policy. We will post the new version with a new effective date. If a change is material, we will tell you in the app or by email at least 7 days before it takes effect.
Contact us
Axioric Inc.
8 The Green, Suite B, Dover, DE 19901
Privacy questions and requests: support@onsitecapture.com