Privacy notice

The Kosovo company identified in the Imprint operates FiberAdmin. Contact its privacy address below for questions or requests. The company is a controller for its own account administration, business communications, security and supplier-side billing records. The customer normally determines why its staff and end-customer operational data are processed; FiberAdmin acts as its processor under an agreed data processing agreement (DPA). A customer that itself acts for another controller must secure the necessary authorization.

This notice covers website visitors, business contacts and account users. For personal data your employer, contractor or installation provider places in a workspace, contact that organization first. We assist that organization with requests under its instructions.

You provide account name, email, credentials and business details when registering or contacting us. Authentication processes password hashes and session information; do not send us your password. Technical requests expose IP addresses, browser details, access times and error information to the application infrastructure. We receive transaction references, subscription status and limited buyer information from Paddle to deliver paid access and reconcile billing.

A customer may enter employee names, email and phone numbers, roles, employment details, hourly rates, time and leave records, certification records, client contact details and installation addresses. Work orders can contain notes, photographs, signatures and location coordinates. These data come from workspace administrators, authorized workers, imports and customer-enabled integrations. Avoid health data, identity documents and other unnecessary sensitive information in free text or uploads.

For our own controller activities, account provision and a contract with an individual use Article 6(1)(b) GDPR; managing corporate contacts, service security, abuse prevention and necessary support use Article 6(1)(f), with legitimate interests in operating a reliable service and supporting customers. Legally required records and lawful authority requests use Article 6(1)(c), where that provision applies. Optional activities requiring consent use Article 6(1)(a); consent may be withdrawn without affecting earlier lawful processing.

Our customers select the lawful bases for their workspace data, including German employment-law requirements where applicable. Browser permission for location or camera access does not itself establish a GDPR legal basis for an employer. Providing required account and billing details is necessary to create or administer access; without them we may be unable to provide the requested service. Optional information can be omitted.

The optional AI assistant is disabled by default and requires operator enablement and explicit company-owner authorization. When enabled, prompts and reduced information returned by permitted read-only operational tools are sent to OpenAI. Personal data can still be included in prompts or tool results, including client or staff details and work information. Treat its output as assistance requiring human review; the assistant is not intended to make automated decisions with legal or similarly significant effects. Do not submit special-category data. The relevant processing and transfer terms are required before enabling the feature; an enablement switch does not replace them.

Account and password-reset emails use Resend when configured. Appointment messages use Sent and the selected delivery channel when configured; recipients can include telephone numbers, appointment details and a portal link. Public contractor reports and appointment links disclose their configured contents to people who possess the link. These links expire after seven days; legacy links without an expiry must be regenerated. Public progress reports omit customer names and free-text content, but their operational information still requires careful sharing. Share only with intended recipients and revoke access when no longer needed.

External maps are off by default and load styles and tiles from OpenFreeMap after the relevant action/preference, exposing network information and the requested map area. Optional address suggestions send the typed address search and network information to Photon at photon.komoot.io when enabled. A worker submits a device location through a field action after browser permission; this is not continuous background tracking. Workspace permissions limit visibility. See the service-provider register for these dependencies.

Paddle is the merchant of record and reseller for purchases completed through its checkout. Paddle processes payment credentials, tax and invoicing information under its own buyer terms and privacy notice. FiberAdmin does not receive your full card number or card security code. Paddle's role is separate from our role in providing the software; using Paddle does not remove our privacy obligations. Contact Paddle for transaction support and us for product support.

Data can be accessed by authorized service personnel, contracted infrastructure and feature providers, customer-authorized integrations, professional advisers where necessary, and authorities where legally required. Our service-provider register distinguishes core infrastructure, optional features and Paddle's independent billing role.

The operator is based in Kosovo. Hosting, support access and provider operations may involve Kosovo, the EEA, the United States or other countries. Kosovo is not currently on the European Commission's adequacy list. An EEA hosting region alone does not resolve international access. Before production use, each relevant transfer must have a documented lawful mechanism, such as applicable standard contractual clauses together with the required assessment and supplementary safeguards. No EU-only hosting or completed transfer arrangement is promised by this draft. Contact the privacy address to request the applicable safeguards and processing locations.

Account and workspace data are held for the service relationship and the customer's documented retention instructions. Certain business records may need longer retention to meet applicable statutory duties or establish, exercise or defend legal claims. Local completion drafts remain on the device until submitted or removed; clearing site data removes local preferences and drafts but does not delete server records.

A member's latest submitted position is hidden from operational views after 24 hours. An hourly cleanup removes stale latest-position fields, normally within 24–25 hours while scheduled tasks run, and the member can clear their latest position. Location recorded as part of an existing job/completion record is separate and follows the workspace retention schedule; the latest-position cleanup does not erase all geodata or backups.

Production-specific periods for account deletion, workspace data, logs, backups, rights requests, support correspondence and billing records must be fixed in the retention schedule and customer DPA before live use. The operator must disclose those periods or their determining criteria and operate the corresponding deletion process. General account/workspace erasure and backup expiry are not automatically completed by submitting a request.

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons arising from your particular situation, and to direct marketing at any time. You may withdraw consent for future processing. We may request proportionate information to verify identity and aim to respond to GDPR requests within one month; lawful extensions are explained where needed. There is no fee unless the law permits one.

Signed-in users can submit workspace-related requests, export available self-service data and clear their latest shared position in the Privacy screen. Owners can review requests and export workspace records. These tools assist the responsible organization; they do not replace a complete response or erase an account/workspace automatically. Contact the operator's privacy address for its own controller activities, provider assistance or data not covered by the self-service export. Opening an email link does not itself send a request.

You may complain to a competent EU supervisory authority, including in the member state of your habitual residence, workplace or alleged infringement, and to Kosovo's Information and Privacy Agency where applicable. You do not have to contact us first. The EU representative and any designated data protection officer, if required, must be identified before launch; the privacy contact is not automatically a DPO.

Access roles and tenant-level authorization are used in the application. The signed security annex must describe deployment-specific access controls, encryption, logging, backups, incident response and restoration measures. No security certification or guarantee of absolute security is made. We update this notice when practices change and communicate material changes through appropriate service channels.