Privacy policy of the Touch2build mobile apps
Last updated:
This policy covers the Touch2build mobile apps for iOS and Android. It explains what personal data they collect, why, who receives it, how long it is kept and what your rights are. The Touch2build website and web application are covered by the website privacy policy.
1. Who we are
The controller is YP5 SRL, Avenue Arnaud Fraiteur 15/23, 1050 Bruxelles, Belgique, VAT BE0801888112 (“YP5”, “we”). Privacy questions and requests: support@touch2build.com, or by post to the address above.
Touch2build is used by companies to manage construction and maintenance projects. The organisation that invites you to its projects decides what is entered in them; for that project content YP5 acts on its behalf (as a processor). For your account, the apps, security and diagnostics, YP5 is the controller.
2. What the apps collect
Account
- Your name, email address and account identifier, from the Touch2build account you sign in with.
- Your password is entered only on our sign-in page; the apps never see or store it. Sign-in tokens are kept in the secure storage of your device (iOS Keychain, Android Keystore).
Project content
- Tasks (title, description, status, deadlines, position on a plan or map), comments, hours worked, annotations on plans and photos.
- Forms and their answers, including handwritten signatures and the name of the signer.
- Project members (name, email address, role) added by a project manager.
- Photos taken with the camera or chosen from your photo library, only when you add them.
Location
Only when you tap “Record my position” in a form: the precise position (latitude, longitude, accuracy, time) is stored in that form answer. The apps ask for location access while in use only and never track your location in the background.
Device and diagnostic data
- Synchronisation reports. After each synchronisation the app sends a technical report: your email address, on iOS an app-specific device identifier (identifierForVendor), the push notification token, the device model, the system and app versions, the duration and outcome of each step, the kinds of changes sent (for example “comment added”) and the errors met. We use them to detect and fix synchronisation problems. A copy stays on the device for 7 days.
- Crash reports (Firebase Crashlytics): when the app crashes or meets an unexpected error, the technical details of the error, the device model, the system version and your account identifier.
- Push notifications: a token so that we can tell you about tasks assigned to you and new comments. Notifications carry no project content; their text is built on the device.
- Diagnostics you send: from More › Settings › About › Send diagnostics to support, the app prepares an email to our support with a file containing a copy of the projects synchronised on your device, the app settings, the device model and system version and the recent synchronisation reports. Nothing is sent unless you send that email yourself.
The apps do not show advertising, do not use your data for advertising, do not sell it and do not track you across other companies’ apps or websites.
3. Why, and on which legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing the service: account, projects, synchronisation between devices, offline work, notifications | Contract |
| Detecting and fixing bugs and synchronisation problems; support | Legitimate interest in a reliable service |
| Security and abuse prevention | Legitimate interest; legal obligation |
| Diagnostics you send to support | Your request |
4. Who receives it
Only the providers we need to run Touch2build, bound by data processing agreements:
| Provider | For | Where |
|---|---|---|
| OVHcloud | Hosting of the Touch2build servers, database and files, and of the synchronisation-report server | France |
| Google (Firebase) | Crashlytics (crash reports), Cloud Messaging (notifications), Remote Config (app settings), Installations | EU and United States |
| Apple, Google | Delivery of notifications to iOS and Android devices | United States |
| Map tile providers (OpenStreetMap and those set up for your project) | Map backgrounds: your device downloads them directly, which reveals its IP address to the provider | Depends on the provider |
The members of a project see its content, including the names and email addresses of the other members. We also disclose data when the law requires it.
Transfers to the United States rely on the EU–US Data Privacy Framework and on the European Commission’s standard contractual clauses.
5. How long it is kept
- Account and project content: as long as the account or the organisation’s contract is active, then deleted or anonymised within 90 days, except what the law requires us to keep (invoices: 7 years).
- Synchronisation reports: 12 months on our server, 7 days on the device.
- Crash reports: 90 days.
- Diagnostics emails: until the problem is solved, at most 90 days.
- Server logs: 12 months.
- On the device: until you sign out of the account in the app or uninstall it. Signing out deletes that account’s local data, files and sign-in tokens.
6. Security
Data is encrypted in transit. Sign-in tokens are kept in the secure storage of the device, and each account on a shared device has its own separate local data. Access to our servers and to diagnostics is limited to the staff who need it. We will notify you and the authorities of a data breach as the law requires.
7. Your rights and account deletion
Under the GDPR you can ask to access your data and get a copy of it, correct it, delete it, restrict its use, object to a use based on legitimate interest, and withdraw a consent at any time. Write to support@touch2build.com; we answer within one month. When the data belongs to a project of your employer or client, we may pass your request on to that organisation.
Deleting your account: in the app, More › Delete my account, or at https://auth.touch2build.com/account/delete. Your personal data is then erased as described in section 5. Content that belongs to an organisation’s projects stays with that organisation, without your name.
You can complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be, rue de la Presse 35, 1000 Brussels) or to the authority of the country where you live.
8. Permissions
The apps ask for a permission only when you use the matching feature; you can change it at any time in the settings of your device.
| Permission | Used for |
|---|---|
| Camera | Taking photos for tasks and forms |
| Photos | Adding photos from your library; optionally saving project photos to it |
| Location (while using the app) | “Record my position” in forms |
| Notifications | Task assignments and comments |
9. Children
Touch2build is a professional tool and is not intended for people under 18.
10. Changes
We may update this policy; the date above shows the current version. We will tell you about significant changes in the app or by email before they apply.