Privacy Policy

1. Introduction

Roca Guia ("we", "us", "our") operates the construction management platform available at app.rocaguia.com and rocaguia.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.

By using our Service, you agree to the collection and use of information in accordance with this policy. We are committed to complying with applicable privacy laws, including Costa Rica's Ley de Protección de la Persona Frente al Tratamiento de sus Datos Personales (Ley N° 8968) and the EU General Data Protection Regulation (GDPR) where applicable.

2. Information We Collect

2.1 Information from Google Sign-In

We use Google OAuth 2.0 for authentication. When you sign in with Google, we receive and store the following information from your Google account:

• Full name
• Email address
• Profile picture URL
• Google account identifier (sub/ID)

We do not receive your Google password. We use this data solely to authenticate you and create your user profile within the Service. We do not use your Google data to serve advertisements or share it with third parties for marketing purposes.

2.2 Account and Usage Data

When you use the Service, we collect:

• Organization information (company name, country, timezone, currency preferences)
• Project data, resources, schedules, and reports you create within the platform
• Hours reported, financial records, and billing data you enter
• Audit logs of actions performed within your organization's account
• Communication preferences and application settings

2.3 Technical Data

We automatically collect certain technical information including IP address, browser type and version, device type, pages visited, and timestamps of access. This data is used to maintain security, diagnose issues, and improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process your organization's construction management data
• Send transactional emails (account access, invitations, application status)
• Detect, prevent, and address security incidents and fraudulent activity
• Comply with legal obligations
• Improve and develop new features of the Service

We do not sell your personal information to third parties. We do not use your data for advertising profiling or behavioral targeting.

4. Data Storage and Security

Your data is stored on servers provided by Supabase (PostgreSQL database) with infrastructure hosted on AWS. Data is isolated at the database level using row-level security policies — your organization's data is never accessible to other organizations. All data is transmitted using TLS encryption.

We implement industry-standard security measures including encrypted connections, access controls, audit logging, and regular security reviews. However, no method of transmission over the internet is 100% secure.

5. Data Sharing

We share your information only in the following circumstances:

• Service providers: We use Supabase (database and authentication), Resend (transactional email), and Vercel (hosting). These providers process data on our behalf under confidentiality agreements.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority.
• Business transfers: In the event of a merger or acquisition, your data may be transferred to the successor entity.

6. Google API Data Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the minimum scopes necessary for authentication (profile and email). We do not store Google OAuth tokens beyond the session, and we do not use Google data for any purpose other than authenticating the user and populating their profile.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data. Note that some data may be retained for legal or billing compliance purposes.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain processing of your data.

To exercise any of these rights, contact us at info@rocaguia.com. We will respond within 30 days.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., financial records).

9. Cookies

We use strictly necessary cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. You can control cookies through your browser settings, but disabling necessary cookies will prevent you from using the Service.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date and, where appropriate, by sending an email notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: