Política de Privacidad

1. Who we are and when this policy applies

AGT Work Crew is provided by AGT Work Crew LLC, Wyoming, USA ("AGT", "we", "us"). Contact: [email protected].

This policy covers the AGT Work Crew web application, the mobile app, the Client Portal and shared document links, our emails and the website https://agtworkcrew.com.br.

Two roles apply:

• AGT is the controller of the data about Owners and account users that we need to run accounts, the free trial, subscriptions, billing, support and security, and of data about website visitors.
• For the data a business stores about its own Workers and Clients ("Customer Data"), the business that uses AGT Work Crew (the "Organization") decides why and how it is used, and AGT processes it on the Organization's behalf. If you are a Worker or a Client of a business that uses AGT Work Crew, please contact that business first; we will help it answer your request.

2. The personal data we collect

Owners and account users:

• account: name, email address and password (stored only as a secure hash by our authentication provider), preferred language, and optionally phone number and profile photo;
• business: company name, main trade, team size, business address (which you can choose to show on documents), time zone, currency, logo, business email, phone, website, tax identification number if you add it, and document defaults;
• acceptance of these documents: which version of the Terms of Service and Privacy Policy you accepted and when;
• subscription: plan, billing interval, status and dates, and the customer identifier at our payment processor. Payment card details are entered on Stripe's pages and are not stored by AGT;
• while you fill in the sign-up form, your answers (without the password) are saved in your browser so you do not lose them, and saved on our servers when you create the account so the company can be created after you confirm your email.

Workers (entered by the Organization or by the Worker):

• name, email, phone, position, role and permissions, profile photo, status and invitations;
• pay rates, work time (clock-in and clock-out times, breaks, notes, edits and their history), payment runs and payment records, including the payment method and a payment reference;
• location at clock-in and, when the company requires it, at clock-out (see the next section);
• daily reports, photos, files and comments added to Jobs, and job and schedule assignments.

Clients and their contacts (entered by the Organization): names, company, billing and job-site addresses and their map coordinates, contact names, job titles, emails and phone numbers, notes, follow-ups, estimates, invoices, change orders and the emails sent to them.

Client Portal and document links: when an estimate or invoice link is opened, approved or declined, the Organization is notified. We do not record the visitor's IP address or device for these views.

Emails: for each email sent through the Service we keep the recipients, subject, message, delivery status and provider reference, so the Organization can see what was sent.

Website visitors: see the cookies section. The website has no forms, no analytics and no advertising.

Security: to prevent abuse of the sign-up form and of address search, we keep a keyed one-way hash of the IP address and of the email address being checked, for about one day. We do not store raw IP addresses in our database. Our hosting providers keep their own technical logs, described below.

We do not ask for government identification numbers, dates of birth, bank account numbers or health information, and the Service is not designed to hold them.

3. Location in the mobile app

The mobile app asks for location permission only while the app is in use. It never tracks location in the background and never follows a Worker's movements.

• When a Worker taps Clock In, the app takes one location reading and sends it with the clock-in. When the company requires location for that Job, the same happens at Clock Out. No location is taken for breaks.
• We store the coordinates, their accuracy and time, and the distance to the Job site calculated on our servers. A reading that is far from the site or not accurate enough is flagged for the Organization to review; it never stops a Worker from recording time.
• On the Home screen the app may show the distance to the Job site using a reading that stays on the phone and is not sent to us.
• If the phone is offline, the clock events (including the reading) are kept encrypted on the phone until they are sent, and removed from the phone 7 days after they are synced.

Photos taken or chosen in the app are converted before upload, which removes embedded metadata such as the GPS position. The camera is used only when the Worker chooses to take a photo.

4. How we use personal data and our legal bases

• To provide the Service: create and secure accounts and Organizations, run the trial and subscriptions, record work time, Jobs, reports, estimates and invoices, show the Client Portal, and send the emails that are part of the Service. Legal basis: performance of our contract with the Organization or the account user, and, for Customer Data, the Organization's instructions.
• To bill subscriptions through Stripe and keep records of transactions. Legal basis: contract and legal obligations (for example accounting and tax records).
• To keep the Service secure and prevent abuse, including rate limits and checks that an email domain can receive mail. Legal basis: our legitimate interest in protecting the Service and its users.
• To answer your questions and requests. Legal basis: contract or legitimate interest.
• To comply with the law and to establish, exercise or defend legal claims. Legal basis: legal obligation or legitimate interest.

We do not use personal data for advertising, we do not sell or rent it, and we do not share it for cross-context behavioral advertising. We do not make decisions with legal or similarly significant effects based solely on automated processing.

We do not send marketing emails today. If we start, we will ask for separate consent where the law requires it, independent of accepting the Terms, and every marketing email will include a way to unsubscribe.

5. Emails and notifications

We send service emails that are needed to use the product, such as email confirmation, password reset and password change, the welcome email when your company is created, and Worker invitations. Organizations also use the Service to send estimates, invoices, Client Portal links, daily reports and data exports. These emails are sent from AGT's email domain; emails sent for an Organization use its name as the sender name and its business email as the reply address.

The web app shows in-app notifications, for example when a Client opens or approves an estimate. The mobile app may ask permission to send push notifications and, if you allow it, stores a device token; you can turn notifications off in your phone's settings at any time.

6. Service providers that process data for us

We use the following providers to run the Service. They process personal data only on our instructions and for these purposes:

• Supabase: database, user authentication and file storage for all product data (servers in the United States).
• Vercel: hosting of the web application and its server functions, including technical request logs.
• Cloudflare: DNS and hosting of the website; the website asks Cloudflare which country your connection comes from (see the cookies section).
• Google Maps Platform: when you type a business address, the text you type is sent from our servers to Google to suggest addresses and return the selected address and its coordinates; for some regions the coordinates are also sent to find the time zone. Your IP address is not forwarded. Google's privacy policy: https://policies.google.com/privacy.
• Stripe: payment processing, checkout and the billing portal for subscriptions. Stripe receives the Owner's email, the company name and the payment details entered on its pages.
• Resend: delivery of the emails described above (servers in the United States).
• Expo (Expo Application Services) and Apple and Google push services: issuing push notification tokens and delivering notifications, and Apple's App Store and Google Play for distributing the mobile app.

We may also disclose personal data when required by law or by a valid request from a public authority, to protect rights, safety and security, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the data transferred.

7. International transfers

AGT is based in the United States and our main providers store data in the United States. If you use the Service from another country, such as Canada, a country of the European Economic Area or Brazil, your personal data will be transferred to and processed in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses included in our providers' data processing agreements.

8. How long we keep data

We keep personal data for as long as the account or Organization exists and as needed for the purposes above:

• Organization data is not deleted when a trial or subscription ends: the Organization becomes read-only, so you can still view and export it; a closed Organization is deleted when its paid period ends, or within 30 days of the request if no paid period remains;
• after an account is deleted, without the name or email and under a keyed one-way code of the email: the record of which Terms and Privacy versions were accepted, for 6 years from the deletion, as contract evidence; and whether the free trial was used, for 3 years from the deletion, to prevent repeated free trials;
• if you tell us why you cancel or delete, the answer is kept linked to the company, not to you, to improve the Service: a written comment for 12 months and the selected reason for 36 months;
• the record of an account deletion or company closure request, which holds no personal data once completed: 24 months after it is completed or withdrawn;
• a record may be kept longer only while a legal claim, a dispute or a request from an authority requires it;
• abuse-prevention hashes of IP and email addresses: about one day;
• clock events on the phone: until synced, then up to 7 days;
• records we must keep by law, such as billing records, for the period the law requires;
• technical logs at our providers: for their own retention periods (for example, Resend keeps email logs for 30 days).

When a Worker no longer works for an Organization, the Organization can deactivate them; their past work records remain part of the Organization's records.

9. Your rights and choices

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent where processing is based on consent. Owners can view, correct and export most of their data directly in the app (Data Management offers CSV and PDF exports).

You can delete your own account at any time in the AGT Work Crew app (Profile › Delete account) or on the web at https://agtworkcrew.com.br/delete-account, without contacting us. Your password is checked again and the account is deleted as soon as you confirm; we send a confirmation by email. If you are the only Owner of an Organization, you can still delete your account immediately; this also starts a separate closure of that Organization, as described in the Terms of Service.

When an account is deleted, we delete the login, profile, photo, notifications, devices and company memberships. Organizations keep the business records they may be required to keep, such as Jobs, timesheets, invoices and payment records; the person's login and contact details are removed from them. If the person is the last Owner of an Organization, their account is still deleted immediately, and a separate closure of that Organization starts: its renewals stop, it stays read-only for its remaining authorized users until the end of the period already paid (or for up to 30 days if none remains), and its data is then deleted or kept as described below.

To exercise any other right, email [email protected]. We may need to verify your identity. We answer within one month (or within the shorter period your law sets, such as 15 days for a complete answer under Brazil's LGPD), and tell you if we need more time and why. Requests are free unless they are manifestly unfounded or excessive.

If you are a Worker or a Client of an Organization, we will pass your request about that Organization's records to it, which decides on its own data, and we will help it respond.

You also have the right to lodge a complaint with your data protection authority, for example a supervisory authority in the European Union, the Office of the Privacy Commissioner of Canada or Brazil's ANPD.

10. Additional information for United States residents

Residents of California, Virginia and other U.S. states with consumer privacy laws have the rights described above to know, access, correct and delete their personal information, and to opt out of the sale or sharing of personal information, of targeted advertising and of profiling. AGT does not sell or share personal information, does not use it for targeted advertising and does not profile people in ways that produce legal or similarly significant effects, so there is nothing to opt out of. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you can appeal a decision by writing to us.

In the past 12 months we collected identifiers (such as name and email), commercial information (subscriptions), professional or employment-related information (work time, pay records), geolocation (clock-in and clock-out readings) and account credentials, from the sources and for the purposes described in this policy, and disclosed them only to the service providers listed above.

11. Cookies and similar technologies

We use only storage that is needed for the Service to work or to remember your choices. We do not use analytics, advertising or tracking cookies, and we do not use third-party trackers.

• Web application: authentication cookies set by our authentication provider to keep you signed in, and the cookie agt_org, which remembers the company you are working in (1 year).
• Web application, browser storage: whether the side menu is collapsed, the sign-up form you are filling in (without the password) and a logo you chose before your company was created.
• Website: the browser storage item agt.prefs.v1, which remembers your country, language and currency choices. To suggest them, the website asks Cloudflare (on the same domain) which country your connection comes from; only the country is used and it stays in your browser.
• Mobile app: your session, preferred language, cached data and unsent clock events are stored securely on the phone.

Because these are strictly necessary or preference items, we do not show a cookie banner. You can delete them in your browser settings; you will then be signed out and your preferences will be reset. We do not respond to Do Not Track signals because we do not track you across sites.

12. Security

We protect data with encryption in transit, access controls that keep each Organization's data separate, private file storage with short-lived links, and permissions set by each Organization. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the authorities as the law requires.

13. Children

AGT Work Crew is a tool for businesses and their workers. It is not directed to children and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. Each version has its own version identifier, shown at the top of this page, and we keep a record of which version each Owner accepted and when. If a change is material, we will tell Owners by email or in the app before it takes effect and, where required, ask for consent again.

15. Contact

AGT Work Crew LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Email: [email protected].