Privacy Policy
Effective 18 May 2026 · v1.0
This Privacy Policy explains what personal data Project Tracking Center (“PTC” or the “Service”) collects, why we collect it, how we use it, and the rights you have over it. We’ve tried to write this plainly. If anything is unclear, email contact@projecttrackingcenter.com and we’ll explain.
1. Who is responsible for your data
PTC is the data controller for personal data you provide directly to us (your account, your profile, the workspaces/clients/projects/tasks/notes/comments you create). For workspaces created by an organization, that organization is the controller for any third-party data they upload, and PTC acts as a data processor.
Contact: contact@projecttrackingcenter.com
2. What we collect
Account data
When you sign up, we collect your email address and password (stored as a hash by our authentication provider — we never see the plaintext password). You can optionally provide your first and last name, role title, profile color, and avatar URL. You can edit or remove any of these from your profile page at any time.
Workspace content
Everything you create inside the Service: workspaces, clients, projects, tasks, checklists, task comments, project notes, time logs, service requests, activity history, and notification preferences. We treat workspace content as belonging to you (or to your organization, for team workspaces).
Communications
If you email us or use a contact form, we store the messages and our responses. We send transactional emails (workspace invites, @mention notifications) — these include a one-click unsubscribe link.
Technical data
When you use the Service we automatically collect:
- IP address, used for rate-limiting and abuse prevention;
- Browser user-agent and device type, captured by our error-reporting tool when an error occurs;
- Request timestamps and pages visited within the Service, captured by our error-reporting tool for performance traces;
- Crash and error reports (stack traces, redacted query parameters) when something goes wrong.
What we don’t collect
- We don’t track you across other websites.
- We don’t use advertising cookies or third-party analytics tools.
- We don’t sell or rent your personal data to anyone, ever.
- We don’t scan your workspace content for advertising, training of AI models, or any commercial purpose unrelated to providing the Service.
3. How we use your data
We process your personal data only for these purposes:
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the Service | Authenticate you, store your workspaces, send mentions | Contract |
| Security & abuse prevention | Rate-limit signin attempts, detect brute-force attacks | Legitimate interest |
| Service operations | Error logs, performance monitoring | Legitimate interest |
| Transactional communications | Workspace invite emails, @mention notifications, password reset | Contract |
| Compliance | Responding to legal requests, tax records for paid plans | Legal obligation |
We do not use your data for automated decision-making with legal or similarly significant effects.
4. Subprocessors
We use a small number of trusted vendors to run the Service. These subprocessors only receive the data they need to do their job and are contractually bound to handle it consistently with this policy.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database hosting, authentication | United States / EU (region-dependent) |
| Functional Software, Inc. (Sentry) | Error monitoring and performance traces | United States |
| Resend | Outbound transactional email delivery (workspace invitations, and account mail such as sign-up confirmation and password reset) | United States |
| Hostinger International Ltd. (Titan Email) | Inbound email to our published addresses | European Union |
| Cloudflare, Inc. | Application hosting, content delivery, and the headless browser used to render PDF exports | United States / global edge network |
When we add or change a subprocessor, we’ll update this list and, for material changes, notify workspace Owners by email.
5. International transfers
Some of our subprocessors (notably Supabase, Sentry, Resend and Cloudflare) may process personal data outside your country of residence, including in the United States. When such transfers occur and the destination is not covered by an adequacy decision under EU/UK GDPR, we rely on Standard Contractual Clauses (SCCs) and supplementary measures to provide an equivalent level of protection.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account & profile | Until you delete your account |
| Workspace content | Until you or the workspace Owner deletes it; archived projects are kept until explicitly removed |
| Email delivery logs | 90 days for bounce / complaint diagnostics |
| Error and performance reports | 90 days, then auto-deleted by Sentry |
| Rate-limit counters | Up to 1 hour past the end of their time window, then deleted |
| Database backups | Rolling 7-day window managed by Supabase; deleted data may persist in backups for this period |
| Records required by law | For the period required (typically 6 years) |
7. Your rights
Depending on where you live, you have some or all of the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Correction — fix anything inaccurate. Most fields you can edit directly from your profile.
- Deletion — ask us to delete your account and your personal data. Some data (legal records, anonymized aggregates) may be retained where law allows.
- Export / portability — receive your data in a machine-readable format.
- Objection / restriction — object to processing or ask us to restrict it.
- Withdraw consent — where we rely on consent, you can withdraw it at any time.
- Complain — to your local data-protection authority. For UK users, that’s the ICO; for EU users, your national DPA.
Email contact@projecttrackingcenter.com to exercise any of these rights. We’ll respond within 30 days. We may need to verify your identity first to prevent unauthorized access.
8. Cookies and similar technologies
PTC uses only essential cookies (for sign-in) and the browser’s localStorage for your theme preference. We do not use advertising, social-media, or analytics cookies. See our Cookie Policy for the specific list.
9. Security
We use industry-standard measures to protect your data, including encryption in transit (HTTPS / TLS), encryption at rest by our database provider, row-level security policies in the database to prevent cross-workspace data leaks, rate limiting on authentication endpoints, server-side input validation, and a Content Security Policy. No system is 100% secure; if a breach affects your data we will notify you and the relevant authorities as required by law.
10. Children
The Service is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, email contact@projecttrackingcenter.com and we’ll delete it.
11. Changes to this policy
If we make material changes to this policy, we’ll notify workspace Owners by email and update the effective date at the top of this page. Continuing to use the Service after a change means you accept the updated policy.
12. Contact
Privacy questions or rights requests: contact@projecttrackingcenter.com