Privacy Policy

1. Who We Are

ADRO is a construction workforce, jobsite check-in and site-reporting platform operated by Adrolog LLC, a Florida limited liability company ("Adrolog," "we," "us" or "our"). This Privacy Policy explains how we collect, use, disclose, retain and protect personal information in connection with our website and the ADRO web application, scanner and kiosk software, APIs and related services (the "Service").

2. Scope and Our Role

We handle two kinds of personal information, and our role differs for each:

• Service Data. Personal information about workers, subcontractor personnel, visitors and other individuals that our business customers (each a "Customer") collect and manage through the Service. For Service Data, the Customer is the controller (or "business") and decides what is collected and why; Adrolog acts as a processor (or "service provider") and processes Service Data only on the Customer's behalf and instructions, as described in our Terms of Service. The Customer's own privacy notice governs its use of Service Data, and individuals should direct requests about Service Data to the Customer. If we receive such a request directly, we will forward it to the relevant Customer where we can identify them.
• Business and Website Data. Personal information we collect for our own purposes, for example from visitors to our website, people who submit our contact or demo forms, and the business contacts and administrators of our Customers. For this information, Adrolog is the controller.

The Service is intended for business use. It is not directed at consumers.

3. Information We Collect

Depending on which features a Customer enables, the Service may process the following categories of information:

• Account and contact information: name, email address, phone number, job title, company, employer or subcontractor affiliation, trade, role and permissions, language preference, and password (stored only in hashed form) and two-factor authentication settings.
• Worker profile information: the projects and jobsites a person is assigned to, profile photo, training and certification levels, safety orientation completion records, and identifiers assigned by the Customer, such as access card codes and helmet sticker numbers.
• Check-in, attendance and manpower records: check-in and check-out times, duration, the project and jobsite location (and the scanner or kiosk used), the method used to check in (for example QR code, access card, helmet sticker or face match), spot check results, presence and absence records, and related notes.
• Biometric information: where a Customer enables face matching, facial images and a numerical facial geometry template (face encoding) derived from them. See our Biometric Information Policy.
• Health screening information: answers to fit-for-duty or health screening questions configured by the Customer, and whether a person was allowed on site.
• Incident and accident reports: descriptions of incidents, dates and times, severity, type of injury, whether medical attention was required, witnesses and actions taken.
• Visitor information: visitor name, phone number, company, the jobsite visited, check-in and check-out times and notes.
• Content: photos, documents, daily uploads, notes and attachments that users submit.
• Device, kiosk and technical information: IP address, browser and device type, operating system, login and logout history, audit trail entries showing who changed which record and when, and diagnostic logs sent by scanner and kiosk devices (such as device hostname and system logs).
• Integration data: project, location, contractor and trade information imported from, and records exported to, third-party systems such as Procore or CMiC when a Customer connects them.
• Billing information: billing contact details, invoices and payment history. Payment card details are collected and stored by our payment processor, Stripe; we store only limited details such as card brand, last four digits and expiration date.
• Website and contact form information: information you submit through our contact or demo request forms (such as name, email, company, phone and message) and basic usage information collected through cookies and similar technologies.

The Service does not use device GPS to track individuals' precise geolocation. Location information in the Service is limited to the jobsite or project where a check-in device is installed.

4. Sources of Information

We collect information directly from users and visitors; from Customers and their administrators, who create and manage worker and project records; from scanner, kiosk and mobile devices used at jobsites; from third-party systems a Customer connects to the Service; from our payment processor; and automatically through your use of our website and the Service.

5. How We Use Information

We use personal information to:

• provide, operate and maintain the Service in accordance with Customer instructions, including check-in, attendance, reporting, notifications and integrations;
• authenticate users, secure accounts, prevent fraud and abuse, and maintain audit trails;
• provide customer support and respond to inquiries and demo requests;
• send service-related communications, such as security codes, alerts, reports and billing notices;
• process payments and manage subscriptions;
• monitor, debug and improve the performance and reliability of the Service, using aggregated or de-identified information where practical;
• send our own marketing emails to business contacts, which you can opt out of at any time; and
• comply with legal obligations, enforce our agreements, and establish, exercise or defend legal claims.

We do not use Service Data to train generalized machine-learning models for use by others, and we never use biometric information for any purpose other than the face-matching check-in feature a Customer has enabled.

6. Legal Bases for Processing (EEA and UK)

Where the EU or UK General Data Protection Regulation applies to Business and Website Data, we rely on: performance of a contract; our legitimate interests in operating, securing and promoting our business (balanced against your rights); compliance with legal obligations; and your consent where required (for example for certain cookies or marketing). For Service Data, the Customer as controller is responsible for determining the legal basis for processing, including any explicit consent required for biometric or health data.

7. Biometric Information Policy

This section is our written, publicly available policy on biometric identifiers and biometric information, including for purposes of the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)), Texas Business and Commerce Code § 503.001, Washington RCW 19.375 and similar laws.

7.1 What we collect and why

When a Customer enables face matching, the Service captures a facial image of a worker during enrollment or check-in and converts it into a numerical facial geometry template. The template is compared against enrolled templates for that Customer solely to verify the person's identity when they check in or out of a jobsite, to prevent one person from checking in on behalf of another, and to keep accurate attendance records for that Customer. Face matching is processed by our own face-matching service running on our infrastructure; we do not send biometric information to third-party facial recognition providers.

7.2 Notice and written consent

The Customer (the employer or jobsite operator) is responsible for informing each individual in writing, before enrollment, that biometric information is being collected and stored, the specific purpose and length of time it will be collected, stored and used, and for obtaining the individual's written release or consent and any other consent required by law. The Customer is also responsible for offering an alternative check-in method (such as a QR code or access card) where required by law or its own policy. Enrollment in face matching should not occur until those steps are complete.

7.3 No sale or profit

We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information.

7.4 Disclosure

We do not disclose or disseminate biometric information to anyone other than: the Customer that collected it (and its authorized administrators); our hosting and infrastructure providers, solely to store and process it on our behalf under confidentiality and security obligations; or as required by federal, state or local law, regulation, or a valid warrant or subpoena; or with the individual's consent. Biometric templates are never exported to third-party integrations such as Procore or CMiC.

7.5 Retention and destruction schedule

Biometric identifiers and biometric information are permanently destroyed when the initial purpose for collecting them has been satisfied, such as when the individual is deactivated or removed from the Customer's account, the Customer disables face matching, or the Customer's account is terminated, or within three (3) years of the individual's last interaction with the Customer through the Service, whichever occurs first. A Customer may instruct us to delete an individual's biometric information sooner, and we will do so. Where a shorter period is required by applicable law, we apply that period. Deletion from routine backups occurs as those backups expire on their normal rotation, and backups are not used to restore biometric information that has been deleted.

7.6 Storage and protection

We store, transmit and protect biometric information using a reasonable standard of care within our industry, and in a manner that is the same as or more protective than the manner in which we store, transmit and protect other confidential and sensitive information. This includes encryption in transit, restricted access limited to personnel and systems that need it, and logical separation by Customer.

7.7 Questions

Individuals with questions about their biometric information, or who wish to withdraw consent or request deletion, should contact the Customer that operates their jobsite, or contact us using the details below and we will route the request to that Customer.

8. Health and Incident Information

Health screening answers and accident reports may be sensitive. We treat them as confidential, restrict access to users the Customer authorizes, and use them only to provide the Service to the Customer. We do not sell health information or use it for advertising. Customers are responsible for collecting such information lawfully, including under the Americans with Disabilities Act and state laws such as Washington's My Health My Data Act, and for keeping medical information separate and confidential as required by law.

9. How We Share Information

We share personal information only as described below:

• With the Customer. Service Data is available to the Customer's authorized administrators and users according to the roles and permissions the Customer sets.
• With service providers (subprocessors) who process information on our behalf under contracts that restrict their use of it, including:
  • cloud hosting, database and file storage providers (including Amazon Web Services for file storage);
  • Stripe, for payment processing;
  • Twilio, for SMS delivery of login codes, alerts and notifications;
  • our transactional email delivery provider;
  • Google reCAPTCHA, to protect our website forms from spam and abuse; and
  • application monitoring and error-tracking tools used to keep the Service reliable.
• With integrations the Customer enables. When a Customer connects a third-party system such as Procore or CMiC, we exchange the data the Customer configures (for example manpower logs, notes, photos, visitor logs and accident reports) with that system. The third party's handling of that data is governed by its own terms and privacy policy and the Customer's agreement with it.
• For legal reasons. To comply with law, regulation, legal process or governmental request; to enforce our agreements; or to protect the rights, property or safety of Adrolog, our Customers or others.
• In a business transfer. In connection with a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, subject to this Policy's protections.
• With consent or at the direction of the Customer or the individual.

10. No Sale or Targeted Advertising

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined under California and other U.S. state privacy laws. We have not done so in the past twelve months. We do not knowingly sell or share the personal information of individuals under 16.

11. Cookies and reCAPTCHA

We use cookies and similar technologies that are necessary to operate the Service and our website, such as session, security (CSRF) and preference cookies, and to remember whether you are signed in. We do not use third-party advertising cookies. Our contact and demo forms are protected by Google reCAPTCHA, which collects hardware and software information and sends it to Google for analysis. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service. You can control cookies through your browser settings, but disabling necessary cookies may prevent parts of the Service from working.

12. Text Messages (SMS)

If a Customer enables SMS features, or if you sign in with a phone number, we may send text messages such as login verification codes, visitor arrival notifications and attendance alerts. These are service messages, not marketing. Message frequency varies. Message and data rates may apply. Reply STOP to opt out of non-essential messages or HELP for help; opting out of login codes may require you to use another sign-in method. Mobile carriers are not liable for delayed or undelivered messages. We do not sell or share mobile phone numbers or SMS opt-in consent with third parties for their marketing purposes.

13. Data Retention

We retain Service Data for as long as the Customer's account is active and as instructed by the Customer, and then delete or de-identify it within a reasonable period after the account ends, subject to the data export window described in our Terms and to routine backup rotation. Biometric information is retained only as described in Section 7.5. We retain Business and Website Data for as long as needed for the purposes described in this Policy, such as maintaining our business relationship, and as required to comply with legal, tax and accounting obligations, resolve disputes and enforce our agreements.

14. Security

We maintain reasonable administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, hashed passwords, role-based access controls, optional two-factor authentication and audit logging. However, no system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your credentials confidential. If we learn of a security breach affecting personal information, we will notify affected Customers and, where required by law, individuals and regulators, within the time required by applicable law.

15. International Transfers

We are based in the United States, and personal information is processed and stored in the United States and in other countries where our service providers operate. Those countries may have data protection laws different from those of your country. Where required, we use appropriate safeguards for international transfers, such as standard contractual clauses.

16. Children and Minors

Our website and Service are not directed to children under 16, and we do not knowingly collect personal information from children under 16. Where a Customer employs or permits workers under 18 on its jobsites as permitted by law, the Customer is responsible for any additional notices or consents required for those workers. If you believe a child has provided us personal information, please contact us and we will delete it.

17. U.S. State Privacy Rights

Residents of California and other U.S. states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas, Oregon and others) may have the right, subject to exceptions, to: know or access the personal information we hold about them and how we use and disclose it; correct inaccurate personal information; delete personal information; obtain a portable copy; limit the use of sensitive personal information; and opt out of sale, sharing for targeted advertising or certain profiling. We do not sell or share personal information and use sensitive personal information only for purposes permitted by law.

Service Data: If your information is in the Service because of your work at a Customer jobsite, please send your request to that Customer. We will assist Customers in responding to requests as their service provider.

How to submit a request: Use our contact form or email adil@adrolog.com with the subject line "Privacy Request." We will verify your identity by matching information you provide with information we hold, and may ask for additional information to do so. You may use an authorized agent, who must provide proof of authorization, and we may require you to verify your identity directly. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal," and we will respond within the time required by law. We will not discriminate against you for exercising any of these rights.

Categories under California law: In the past twelve months we have collected the categories described in Section 3, which correspond to identifiers, customer records, commercial information, internet or network activity, professional or employment-related information, biometric information, sensitive personal information (such as account log-in credentials, health and biometric information), and audio-visual information (photos). We collected them from the sources in Section 4, for the purposes in Section 5, and disclosed them for business purposes to the categories of recipients in Section 9.

18. EEA, UK and Canada

If you are in the European Economic Area or United Kingdom, you may have the right to access, correct, delete, restrict or object to processing of your personal information, to data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. If you are in Canada, you may access and request correction of your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. For Service Data, please contact the Customer that controls your information. To exercise rights for Business and Website Data, contact us as described below.

19. Do Not Track

Our website does not respond to browser "Do Not Track" signals, because there is no common industry standard for them. We do not track users across third-party websites for advertising. Where required by law, we honor Global Privacy Control signals as a request to opt out of sale or sharing, although we do not sell or share personal information.

20. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last Updated" date. If we make material changes, we will provide additional notice, such as by email to Customer administrators or a notice in the Service, before the changes take effect.

21. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: