Privacy and cookie statement

1. Who we are

SubstrX is a service of ProjectNet (sole proprietorship), Meidoornlaan 3, 4286 CV Almkerk, the Netherlands, Chamber of Commerce no. 98078062. For privacy questions: privacy@substrx.com. For other questions: support@substrx.com.

In this statement we explain which personal data we process, why, for how long and what rights you have.

2. Two roles

Controller: for users' account data, data for security and abuse prevention, and communication with us.

Processor: for the data that firms enter in the service themselves, such as projects, clients' contacts, photos and reports. The firm is responsible for that data; we process it only on the firm's behalf, in accordance with the data processing agreement in our terms and conditions. If you are a contact of a firm or its client, please contact that firm first with any questions.

3. What data, for what purpose and on what legal basis

Account: name, email address, password (stored in encrypted form only), language, role within the firm, the time you accepted the terms and, if you use two-step verification, the secret key for the codes (held by Supabase). Purpose: creating and managing your account and giving you access. Legal basis: performance of the contract.

Firm and profile details: company name, address, country, registration number (such as the Dutch KvK number) and VAT number, telephone number, website, logo, house style, inspectors' qualifications and certificates and, if an inspector draws one, their signature (which appears on reports they finalise). Purpose: showing these details in your reports. Legal basis: performance of the contract.

Email: confirmation emails, password resets, invitations for colleagues, report emails, reminders when a calibration or certificate expires within 30 days or has expired, and, for the owner of a new firm, a welcome email and one email halfway through the trial explaining how to use the service. Purpose: making the service work. Legal basis: performance of the contract. We do not send newsletters or advertising without your consent.

Change log: for inspections, tests, photos and attachments we record who changed what and when. Purpose: traceability of reports and evidence in a dispute. Legal basis: legitimate interest of the firm and performance of the contract. For notes and readings we only record that they changed, not their content. Retention: for as long as the firm has an account; for a deleted inspection, a further 90 days.

Invitations: the email address of a colleague being invited. Purpose: sending the invitation. Legal basis: legitimate interest of the inviting firm and of us. An invitation expires after 14 days.

Security and abuse prevention: IP address, browser and device data, times of logins and actions, and counters for limits. Purpose: securing the service and preventing intrusion, spam and overload. Legal basis: legitimate interest.

When you sign up, log in, accept an invitation or reset your password, we use Cloudflare Turnstile. It assesses, based on technical data from your browser and your IP address, whether you are a human. Legal basis: legitimate interest (protection against automated abuse).

Contact and support: whatever you send us, including via the feedback button in the app (your message, your name and firm, and the page you were on). Purpose: answering your question and improving the service. Legal basis: legitimate interest or performance of the contract. We keep messages sent via the feedback button for up to one year.

Invoicing: company details (name, address, country, registration number and VAT number) and payment details. Card and account details go directly to Stripe; we only see the type of payment method and the last digits. When the owner invites or removes a colleague, we record that the owner agreed to the subscription being adjusted (who, when and for which email address), for as long as the firm has an account. We check the VAT numbers of customers in the EU in VIES, the VAT Information Exchange System of the European Commission; we only pass on the VAT number. Purpose: invoicing, applying the correct VAT and keeping accounts. Legal basis: performance of the contract and legal obligation.

We do not sell personal data, do not use it for advertising and do not create profiles. No automated decision-making takes place.

4. Share links and report emails

A firm can share a report, the list of non-conformities or the handover dossier of a project through a link or have it emailed to contacts. Anyone opening a share link does not need an account; we set no cookies in that case. For security purposes our hosting processes the IP address and technical data of the request.

The addresses a report was emailed to are only visible to the firm itself, not via the share link.

5. Who we share data with

We engage the following processors. Data processing agreements are in place with each of them.

Supabase Inc. (US): database, file storage and sign-in. Data is stored in an EU data centre (Frankfurt, Germany).

Vercel Inc. (US): hosting of the website and the app. Processing takes place in the EU (Frankfurt) where possible; Vercel's global network may handle requests via other locations.

Resend Inc. (US): sending emails, such as confirmations, invitations and report emails.

Cloudflare Inc. (US): security check (Turnstile) against automated abuse when signing up and logging in, and storage of a daily backup of files (photos, documents, logos) in an EU data centre.

GitHub Inc. (US, part of Microsoft): management of the source code and running the daily backup job. Files are only passed through to the backup, not stored at GitHub.

Stripe Payments Europe, Ltd. (Ireland): payments, subscriptions and invoices. Payment details go directly to Stripe; Stripe is also a controller in its own right for processing payment details and preventing fraud.

ImprovMX Inc. (US): forwarding email sent to support@substrx.com and privacy@substrx.com to our mailbox. This only applies to messages you send us yourself.

Some of these parties are established in the United States. Transfers take place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission, with supplementary measures where necessary.

We only pass on data to others if the law requires us to.

6. How long we keep data

Account, firm and inspection data: for as long as the agreement runs. After it ends you can still access your data for 30 days; we then delete it within 60 days, including from backups.

File backup: a file you delete stays in the backup for another 30 days and is then deleted from it as well.

Security logs: up to 90 days. Counters for limits: up to 2 days. Unused invitations: 30 days after they expire.

Unconfirmed sign-ups: we delete accounts whose email address has not been confirmed after 30 days.

Invoices and the data needed for them: 7 years, due to the statutory retention obligation.

7. Security

We secure data with measures including encrypted connections (HTTPS), passwords stored in encrypted form, strict separation of data per firm in the database, a CAPTCHA against automated abuse, limits on the number of actions, and storage in data centres in the EU. Access to administrative functions is limited to those who need it.

8. Cookies and storage in your browser

We only use functional cookies and browser storage that are needed for the service to work. These do not require consent. We do not use analytics, tracking or advertising cookies and do not load fonts or scripts from advertising or analytics services.

Login session (cookies sb-…-auth-token, from Supabase): keeps you signed in. Kept until you log out or the session expires.

Language choice (cookie locale): remembers the chosen language. Retention period 1 year.

After signing up (cookie substrx_sent_to): remembers for 10 minutes which address the confirmation email was sent to, to show it on the thank-you page.

Security check (Cloudflare Turnstile): processes technical data from your browser to detect abuse, only on the sign-up, login, invitation and password reset pages. Turnstile does not use cookies for tracking or advertising.

Checklist (local storage substrx-setup-collapsed): remembers whether you collapsed the checklist.

Report language notice (session storage): remembers whether you closed a notice about the report language; cleared when you close the browser.

You can delete cookies and browser storage in your browser settings. Without the login cookie you cannot stay signed in.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to have processing restricted, to object to processing based on legitimate interest, and to receive your data in a common format (data portability). You can change or delete much of your data yourself in the app.

You can send a request to privacy@substrx.com. We respond within one month. We may ask you to prove your identity.

If the request concerns data a firm entered in the service, we forward your request to that firm.

If you have a complaint about how we handle your data, please let us know. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

10. Changes

We may change this statement, for example when we engage a new processor. The current version is always on this page. We inform users of important changes by email or in the app.