Privacy Policy

1. Scope and privacy roles

This Privacy Policy applies to the Refitrack website at refitrack.eu, the Refitrack Android application, the Refitrack API, and associated hosting, support, security, and administration services (together, the Service).

Refitrack is operated by REFITUS, MB, a company established in Lithuania. For data needed to provide, secure, support, and improve the Service, REFITUS, MB acts as a data controller. Contact details are provided in section 12.

Refitrack is primarily offered to organizations. When your employer, client, or another organization gives you an account and decides why your profile, assignments, work records, or project content are processed, that organization is the controller and Refitrack processes the data on its instructions. Questions about that data should normally be directed to your organization first.

2. Personal data we process

Data the current Android app does not request

Based on the current production app, Refitrack does not request precise or approximate device location, contacts, phone logs, SMS, microphone, health data, payment data, or an advertising identifier. Work photos may still reveal a place or person from their visible content, but Refitrack does not request GPS coordinates for that feature.

3. Where personal data comes from

• Your organization: administrators create and manage accounts, roles, project access, and assignments.
• You: when you sign in, record work, enter progress, take or select photos, upload files, annotate blueprints, or contact support.
• The Service and your device: when technical, session, activity, and diagnostic data are created through normal use.
• Other authorized users: when colleagues create tasks, assign work, upload project content, or record activity involving you.

4. How and why we use personal data

We process personal data to:

• create and administer accounts, organizations, roles, permissions, and sessions;
• provide project, task, assignment, blueprint, work-time, progress, photo, and reporting features;
• synchronize data between the Android app, web app, and API, including queued uploads;
• authenticate users, prevent unauthorized access, investigate abuse, and maintain service integrity;
• diagnose crashes and errors, maintain reliability, provide support, and improve existing features;
• comply with law, enforce agreements, and establish, exercise, or defend legal claims.

Where Refitrack acts as controller, the legal basis is normally performance of a contract, our legitimate interests in operating and securing a business service, compliance with legal obligations, or consent where the law requires it. Where Refitrack acts as processor, processing is performed under the relevant customer organization's instructions and legal basis.

Refitrack does not use automated decision-making that produces legal or similarly significant effects about individuals.

5. When personal data is shared

Personal data may be disclosed to the following recipients only as needed for the purposes above:

• Your organization and authorized users: administrators, project managers, and colleagues can access data according to their roles and project permissions.
• Infrastructure and support providers: providers used for hosting, databases, storage, backups, networking, and technical support.
• Google Firebase Crashlytics: Google processes Android diagnostic and installation data to provide crash reporting. See Firebase privacy and security information.
• Authorities and professional advisers: where disclosure is required by law or reasonably necessary to protect rights, safety, security, or legal claims.
• A successor operator: in connection with a merger, acquisition, financing, reorganization, or sale, subject to appropriate confidentiality and notice requirements.

We do not sell personal data. We do not share it with advertising networks or use it for cross-context behavioural advertising.

6. International data transfers

The main Refitrack service infrastructure and support arrangements may process data in the European Economic Area. Some service providers, including Google Firebase Crashlytics, operate globally and may process data outside your country or the EEA. Where required, we rely on recognized transfer mechanisms and contractual or organizational safeguards, such as adequacy decisions, standard contractual clauses, or an applicable data privacy framework.

7. Data retention and deletion

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, customer instructions, security, dispute resolution, and legal obligations. In particular:

• account, project, assignment, work, and uploaded content is generally kept while the customer organization uses the Service or needs it for legitimate operational records;
• when a user is deleted, identifying account fields are deactivated or anonymized and active refresh tokens are removed; related work records may remain for the organization's legitimate project and audit needs;
• projects, tasks, and work records may first be soft-deleted so that integrity and authorized recovery can be maintained, then removed or anonymized according to customer instructions and operational retention schedules;
• security and technical logs are kept for a limited period appropriate to troubleshooting, security, and legal needs; backup copies remain until the relevant backup cycle expires;
• Firebase states that Crashlytics keeps crash traces and associated installation identifiers for 90 days before beginning removal from live and backup systems;
• the Android app clears locally stored login tokens and offline work tables on logout. Remaining local app files can be removed through the app where available, by clearing app storage, or by uninstalling the app.

Because organizations administer Refitrack accounts, users cannot currently create their own account in the Android app. To request deletion, contact your organization administrator or the privacy contact below. We may retain limited information where law, security, fraud prevention, or legal claims require it.

8. How we protect personal data

Refitrack uses technical and organizational safeguards designed for the nature of the Service. These include HTTPS for production app and web traffic, secure HTTP-only web authentication cookies, password hashing and salting, encrypted or protected session credentials, role and project-based access controls, tenant separation, restricted administrative access, and backups. Sensitive Android authentication and offline work stores are excluded from Android cloud backup and device transfer.

No system is completely secure. Users should protect their credentials, use only authorized devices, avoid including unnecessary personal information in photos or task descriptions, and report suspected unauthorized access promptly.

9. Your rights and choices

Depending on where you live and the relevant controller, you may have rights to be informed, access personal data, correct inaccurate data, request deletion or restriction, receive portable data, object to certain processing, and withdraw consent where processing relies on consent. You may also complain to your local data protection authority.

For work, project, or employment-related data, contact the organization that provided your account. You may also contact Refitrack using section 12. We may need to verify your identity and coordinate with the relevant customer organization before completing a request. Refitrack does not send direct marketing through the current Service.

10. Children

Refitrack is a business service intended for authorized working-age users and is not directed to children. We do not knowingly provide accounts directly to children. If you believe a child has provided personal data through the Service without proper authorization, contact us so the matter can be investigated.

11. Changes to this policy

We may update this Privacy Policy when the Service, providers, or legal requirements change. We will publish the revised version at this URL and update the date above. Where a change materially affects how personal data is handled, we will provide additional notice where reasonably possible or legally required.

12. Contact