Privacy Policy

1. Who is responsible

For your own account (your name, email, sign-in and preferences) we are the party responsible for the data. For the data a company enters about its people and business — workers, clients, subcontractors, suppliers, projects — that company is the party responsible ("responsable del tratamiento"), and we process it on its behalf and on its instructions. If you are a worker or a client of a company that uses the Service, contact that company first; you can also write to us at info@mazestudio.design.

2. What we handle

• Account: name, email, display name and photo, job title, phone, an ID number and a signature image if you add them for your documents, language and display preferences, sign-in times.
• Company records: projects, contracts, budgets, expenses and receipts, billing documents and payments, change orders, RFIs, site reports and photos, files, notes and messages.
• Workers: name, trade, pay rate and payments, time entries, and — when a company turns them on — a photo taken at clock-in and clock-out and the location (GPS) of each punch.
• Identity and compliance documents a company uploads (for example a worker's cédula, a subcontractor's RUC, insurance or paz y salvo).
• Client portal: the name and email of a client's people who are given access, and what they view or download.
• Technical data: the device and browser used, error reports and security logs.

3. Why we use it

• To provide the Service the company signed up for and to show each person only what their role allows.
• Clock-in photos and locations: so a company can check that a punch was made by the right person at the right place, and settle disputes about hours. They are not used for anything else, and the Service does not track location between punches.
• To send the emails and notifications the Service needs (invitations, billing documents, approvals), and the ones you choose in My account.
• To keep the Service secure, investigate errors and prevent abuse.
• Optional AI features, when a company turns them on: the text or image you send is processed by an AI provider only to give you the answer. A company can turn AI features off in My account → Companies.

4. Who can see it

• Within a company: its members, according to their role (Viewer, Editor, Admin, owner). Clock-in photos and locations are visible to the company's staff who review time, not to other workers.
• A company's clients see only what the company publishes to their portal.
• Our service providers, only to run the Service: the hosting and database platform, email delivery, payments and, when turned on, AI providers. Some of them store data outside Panama; we choose providers that protect it to a standard comparable to Ley 81.
• Authorities, only when the law requires it.
• We do not sell personal data.

5. How long we keep it

• Account data: while your account is open. When you delete your account it is scheduled for deletion and removed after a seven-day grace period, except what the law requires us to keep.
• Company data (including worker photos, punch locations and ID documents): while the company keeps it in the Service. The company can delete records and files, and everything is removed when the company profile is deleted. The company decides how long to keep records it must hold by law (for example payroll and accounting records).
• Security logs and error reports: kept for a limited time and then deleted.

6. Your rights

Under Ley 81 de 2019 you can ask for access to your personal data, its rectification, its cancellation (deletion), to object to its use, and for its portability (the ARCO rights and portability). You can download your own account data from My account → Data & privacy, and correct most of it yourself. For anything else, write to the company that holds your data or to us. We answer within the time the regulation sets. If you are not satisfied, you may complain to the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI).

7. Security

Data travels encrypted, private files (such as clock-in photos, signatures and ID documents) are stored privately and opened through short-lived links, and every request is checked against the person's company and role. If a security incident affects your personal data, we will tell the companies affected and the authority as the law requires.

8. Cookies and storage on your device

The Service stores a sign-in token and your display preferences in your browser so it works and remembers your choices. It does not use advertising cookies.

9. Children

The Service is for businesses and is not meant for people under 18.

10. Changes and contact

We may update this Policy; if a change is significant we will tell you before it applies. Questions or requests about your data: info@mazestudio.design.