Privacy policy

CantierePro · Last updated: 18 August 2026

This policy concerns the processing of personal data. The terms of use of the app and of the subscription (prices, renewal, cancellation) are in a separate document: Terms of use.

Data controller

The data controller is HyLogix di Carrozzo Fabio, Italian VAT no. IT04223690043, with registered office at Via Curva 18, Faule (CN 12030), developer of the CantierePro application for iPhone, iPad, Mac and Android devices. For any request concerning this policy you can write to [email protected]. No Data Protection Officer (DPO) has been appointed, as the legal requirements for doing so do not apply.

Since the app has no servers and no accounts, it is worth saying straight away who processes what. The data for which we are the controller: three things only, all of them outside the content you put into the app.

• the purchase data that reaches us from the stores, App Store and Google Play, in aggregate form, together with confirmation that a subscription is active;
• the support emails, when you write to us;
• any error reports that you choose to send us.

The data for which you are the controller: everything else. Photographs, videos, voice notes, jobs, clients, labour data and every other piece of content you record with the app are processed by you, for the purposes of your professional activity — a building firm, a technical practice, a sole trader. We do not receive it, we do not access it and we cannot process it: there is no server of ours anywhere along the path, and for that content we do not act as a processor on your behalf. If other people appear in that data (clients, workers), the obligations towards them — providing them with a privacy notice, retention, security — remain yours: the app is the tool with which you keep that data, not a service provider processing it for you. The same point, set out at greater length, is in the note on third-party data further down.

Where the app works

CantierePro is designed for iPhone and iPad, and it also runs on Macs with Apple silicon, where the same application is executed. There is also the version for Android: phones, tablets, foldables and Chromebooks that run Android apps. The features available depend on the device hardware: the site camera and GPS position, for example, make sense on a phone or a tablet, whereas on a Mac or a Chromebook the typical use is consulting jobs and producing reports. This policy applies to every platform: where a rule differs between Apple and Android, it is set out below, section by section.

What data the app processes, and where it stays

CantierePro processes the following data in the app's private container on your device. It stays there only, unless you switch on synchronisation or backup, which copy it into your personal cloud storage — iCloud on Apple devices, your own Google Drive on Android (see the dedicated sections):

A note on the original photo. The whole point of the promise is that the photo you hand over as evidence has not been retouched: the app does not recompress the image and does not draw anything on top of it. The stamp with the date, time and place always goes onto a copy, while the original keeps the pixels that came out of the sensor. On the original the app writes only the metadata, that is the information that travels with the file: the coordinates of the shot and, if the phone has not already indicated it, the orientation of the image. That is exactly what the Camera app does when geolocation is switched on, and it is not retouching. If anything, it is a difference worth keeping in mind: coordinates in the metadata strengthen the documentary value of the shot, whereas redrawing its pixels would weaken it.

A note on third-party data. If you enter other people's data into the app — for example the name, telephone number or email of a client, photographs in which workers appear, or names, roles, hours and hourly costs of workers in the Labour section — you are the controller of that processing, within the context of your professional activity. The app is merely the tool with which you store it on your device: we do not receive it and we do not access it. Towards your workers, the information obligations laid down by employment and data protection law remain your responsibility.

What we do not do

• There is no CantierePro server: your data never reaches us. If you switch on synchronisation or backup, the data travels directly between your devices and your personal cloud storage: iCloud, managed by Apple, or your own Google Drive, managed by Google.
• There are no accounts and no registration is required.
• We do not use third-party analytics, tracking or advertising tools.
• We do not share, sell or transfer data to anyone.
• We do not track your activity across other companies' apps or websites.

Permissions the app requests

They are almost the same on Apple and on Android: what changes is the name the system uses when it asks you and, on Android, there is one fewer — the Photos permission, which the app never asks for (why is explained below). Each one is optional and is requested when it is needed, not at launch.

• Camera — to take site photos and videos.
• Microphone — for voice notes and video audio.
• Location (while the app is in use) — to mark shots with coordinates and address. If you deny it, the app still works: the shot is saved without location data.
• Photos — here the two platforms do not behave in the same way. On Apple devices the system may ask you for it when you import images that you choose yourself from the Camera Roll; if you import nothing, the permission is not needed. On Android the Photos permission does not exist and is never requested: to take an image from the Gallery, the app opens Android's system picker (the Photo Picker), which hands it only the photos you have chosen. The app obtains no access to the Gallery: it neither sees nor can read the rest of your images.
• Biometric unlock — Face ID or Touch ID on Apple devices, fingerprint or face on Android: only to unlock the app, if you switch on the lock, falling back to the device passcode when biometrics fail or are unavailable. Verification takes place entirely within the system: biometric data and the passcode are never accessible to the app.
• Notifications — only for the job delivery reminders that you set yourself. These are local alerts, scheduled on the device: no server sends anything.

You can revoke any permission at any time from the device settings: on iPhone and iPad in Settings → CantierePro, on Android in Settings → Apps → CantierePro → Permissions.

Recipients of the data

There are two external parties involved, depending on the platform you use: Apple on Apple devices and Google on Android. They come into play only in the following cases, which are worth keeping apart because they are different roles:

• Geocoding of the address: with every shot taken with location active, the coordinates are sent to the location service of Apple (on iPhone, iPad and Mac) or of Google (on Android) to obtain the readable address that appears in the record and in the overlay printed on the copy of the photo. This also happens in the free version and also with synchronisation and backup switched off: it is the only case in which data of yours leaves the device without your having switched anything on, and to stop it you need only deny the Location permission. The other communications with Apple or Google concern the status of the subscription and the availability of the cloud service, and contain no photos, notes or text.
• Personal cloud storage: iCloud on Apple devices, your own Google Drive on Android, and only if you switch on synchronisation or backup (see below). Here Apple and Google provide the storage; they do not process your work on our behalf. On Android what arrives on Drive is encrypted by your device before it leaves, so not even Google can read its content.
• Stores: App Store and Google Play handle the purchase and the verification of the subscription. All that reaches us is aggregate reporting and confirmation that a subscription is active — never your payment data.

In all these cases the processing carried out by Apple and by Google is governed by their respective privacy policies. Your content does not reach us: there is no server of ours anywhere along the path.

Synchronisation between your devices (optional)

Synchronisation is there so that you find the same archive on more than one of your devices. It is a Pro feature, it is off by default and you are the one who switches it on: if you do not switch it on, nothing goes anywhere. When it is active, what travels is jobs, photos and videos, notes and voice notes, labour (people, hours and costs), notebooks with their images, progress claims with the amounts, and the identity of the practice (name, logo and signature). In practice, two things together:

• job data, text, notes and metadata of the shots (date, time, coordinates, address, annotations);
• the actual files of photographs, copies with overlay, videos and voice notes.

What holds true on every platform:

• it is optional and stays off until you are the one to switch it on;
• the data stays yours and sits in your personal cloud storage, whose space it takes up: not in ours, which does not exist;
• we cannot access it, we do not see it and we do not receive it: there is no server of ours anywhere along the path;
• you can switch it off at any time from Backup & Restore, without restarting the app: the data already on the device stays where it is.

What changes is where the copy ends up and how it is protected, because the two platforms work in different ways.

On iPhone, iPad and Mac: iCloud

Your data is copied into the private database of your iCloud account so that it appears on all the Apple devices that use the same Apple ID.

Mind the space. Photographs are the heaviest content: around 5 MB per shot when the overlay is active. This space is taken from your iCloud plan, not ours: with the free 5 GB plan it may not be enough, and in that case synchronisation stops. Before you switch it on, the app shows you how large your archive is at that moment.

When files are uploaded. So as not to consume your data plan on site, the app queues heavy files for upload only when you are on Wi-Fi; you can also allow the mobile network with a dedicated switch. The actual transfer is then carried out by iCloud and follows your device's settings (on iPhone and iPad: Settings → Mobile Data), over which the app has no control. Jobs and notes, which are very light, always sync.

The data is managed by Apple in accordance with its own policy. To remove what has already been synchronised you can use the iCloud settings of your Apple device.

On Android: your own Google Drive, with encryption on the device

On Android, synchronisation arrives with the version of the app that introduces it: until then there is nothing to switch on and no data leaves the phone by this route. Once it is there, this is how it works.

• The data is encrypted on the device before it leaves, with a key generated at random on the device itself. That key is not known to us, we cannot reconstruct it and it never reaches us. What ends up on Drive is unreadable material: we cannot read it and neither can Google.
• The key does not pass through our systems or through Google: to bring a second device into sync, you are the one who carries it from one to the other, copying a code across from the first device to the second. That is the only way it moves, and it is in your hands.
• The encrypted files go into the app's private folder inside your Google Drive (appDataFolder): they take up the space of your Drive, and the relationship over that space is between you and Google, in accordance with Google's policy and terms.
• If you lose the key, that copy is no longer readable by anyone, ourselves included: we cannot open it, unlock it or recover it, because we never had the key in the first place. The data on the device stays intact — what is lost is the remote copy, not your archive. Keep the code somewhere safe.
• You can switch synchronisation off whenever you like and delete from the app the archive held on Drive.

System backup of the device

This is the backup made by the operating system, independently of this app's features. Here the two platforms behave in opposite ways, and it is only right that you should know.

On iPhone and iPad: the archive is included

If the system iCloud backup is active on your iPhone or iPad (Apple's setting, switched on by default on almost every device), the CantierePro archive is included in it, as with most apps. This is a deliberate choice: excluding it would mean that anyone restoring a new device would find their jobs without photographs.

It follows that, after uninstalling, a copy of the data may survive inside the system backup until you delete it or it is replaced. You can govern all of this from the iOS Settings, under your name, in the iCloud section. The PDF reports and the archives generated by the app are instead excluded from the system backup, because you can regenerate them.

On Android: the archive is excluded, deliberately

On Android the automatic system backup is switched off by our own choice (in the app manifest: android:allowBackup="false"). The CantierePro archive does not end up in Google's automatic backup and is not transferred by itself when you set up a new phone.

The consequence deserves to be stated plainly, because it cuts both ways: no copy of your sites goes off to Google without your deciding so, but neither does one come back by itself if you uninstall the app or lose the phone. The copies exist if you make them: the manual .zip backup, or synchronisation, if you have switched it on.

Backup of the archive (optional)

On iPhone, iPad and Mac: automatic backup to iCloud Drive

If you switch on automatic backup to iCloud Drive (a Pro feature, off by default), a copy of your archive is saved in the CantierePro folder of your personal iCloud Drive. This data takes up your iCloud space, is managed by Apple in accordance with its own policy and is in no way accessible to us: it does not pass through any servers of ours, which do not exist. You can switch off the backup at any time and delete the files from the iCloud Drive folder.

On Android: manual backup to a .zip file

The manual backup exists on every platform; on Android it is the way you put your archive somewhere safe. The app exports everything — jobs, photographs, videos, voice notes, notebooks — into a single .zip file and hands it to you: from that point on you decide where it goes, and you hand it to whichever app you choose (email, Google Drive, a USB stick, a computer). The file is yours and it does not pass through us: we do not see it, we do not receive it, we keep no copy of it. From that moment the privacy policy of the service or the person you hand it to applies.

Purchases and payment data

The CantierePro Pro subscription is bought through the store you downloaded the app from: the App Store on iPhone, iPad and Mac, Google Play on Android. The seller is the store, which handles payment and invoicing. We do not see, do not receive and do not process any payment data, nor do we know your identity: no payment data passes through the app, which does no more than ask the store whether a subscription is active. All that reaches us is the aggregate reporting that the stores make available to developers (how many activations, in which countries, how much has been taken in). The processing of payment data is governed by the privacy policies of Apple and of Google. Prices, renewal and cancellation are described in the Terms of use.

Legal basis and purposes

• Operation of the app (local storage of shots, geocoding of the address, composition of the reports) and verification of the subscription: performance of the contract, Article 6(1)(b) of Regulation (EU) 2016/679.
• Synchronisation between devices and backup to your cloud storage (iCloud Drive on Apple devices, your own Google Drive on Android): consent, Article 6(1)(a). Both are off by default and consent is given by switching on the relevant toggle.

You can withdraw your consent at any time by switching off the corresponding toggle (Article 7(3)): withdrawal does not affect the lawfulness of processing carried out beforehand. None of the features involves automated decision-making or profiling.

Retention and deletion

• The data stays on your device until you decide otherwise: we apply no expiry.
• You can delete individual shots, notes or jobs from the app.
• By uninstalling CantierePro you delete all the app's data from the device. Mind what may remain elsewhere: on iPhone and iPad, if the system iCloud backup is active, a copy survives in that backup until you delete it (on Android this does not happen, because the automatic backup is switched off). And if you had switched on synchronisation or backup, a copy remains in your cloud storage and has to be removed separately: from the iCloud settings of your Apple device, or — on Android — from the app, which deletes the archive held on Drive.
• Reclaim space: if you have switched on synchronisation, you can ask the app to delete from the phone the files already copied to your cloud storage, to free up memory. This happens only at your request and only for files of which an intact second copy already exists in the app's archive — the same one that is synchronised — verified by comparing the fingerprint of the content. The photos remain visible and are rewritten from that copy when you open them, and they continue to be included in the .zip backups that you export.
• The .zip backups and the PDF reports that you generate are your files: if you choose to share them (email, messages, cloud), from that moment they are subject to the policy of the service you use to share them.

Your rights (GDPR)

Regulation (EU) 2016/679 grants you the rights of access, rectification, erasure, restriction, objection and portability. Since we neither collect nor store any of your data on our systems — with the exception of the three categories set out above (aggregate purchase data, support emails and error reports), dealt with in their own sections — we have nothing to show you, correct or delete on request: you already have complete and direct control of your data on the device: you can consult it, modify it and delete it from the app at any time. Exporting the entire archive to a .zip file is available with the Pro subscription; restoring an archive, by contrast, is always free, even without a subscription.

If you consider that the processing infringes the Regulation, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Support by email

If you write to us at [email protected], we process your address and the content of your message for the sole purpose of replying to you (Article 6(1)(b) and, for general enquiries, 6(1)(f): our legitimate interest in providing support). It is the main case in which we receive data of yours directly. Messages are kept for as long as is necessary to handle the request and in any event no longer than 24 months, and they are not used for other purposes or disclosed to third parties. In relation to this data you can exercise the rights listed above by writing to us at the same address.

The same applies to error reports, if you choose to send us one: we receive the description of the problem and the technical data about the malfunction that comes with it, not your site content. They serve only to put the error right.

Minors

CantierePro is a professional working tool and is not intended for children under 14, the threshold laid down for Italy by Article 2-quinquies of Legislative Decree 196/2003.

Changes to this policy

If this policy changes — for example if features were added that entail new processing — the updated version will be published on this page with a new date, and significant changes will be flagged in the app.

Questo documento è disponibile anche in altre lingue. Torna a CantierePro.