Privacy Policy

1. Who we are

Donestra is operated by OMNIAMUS S.R.L. (CUI 54719073, J2026032656006), Ploiesti, Romania, under the AedifyLab brand ("Donestra", "we", "us"). We are the controller for account, service, and billing-administration data. Contact us at contact@aedifylab.com.

When a business user uploads information about its clients, workers, or job sites, that user is responsible for having a lawful basis to collect and share it. We process that information to provide Donestra to the user.

2. Data we collect

• Account data: name, email address, optional business name, password hash, account timestamps, and session records.
• Job data: job title, client name and email, site address, schedule, notes, checklists, status, and generated summaries.
• Evidence: photos, videos, filenames, media type and size, dimensions, duration, capture time, and optional precise location when you choose to add it.
• Approval data: recipient email, approval-link activity, response, client name, signature drawing, consent record, device/browser information, and a one-way hash derived from network information for audit integrity.
• Completion records: the job snapshot, integrity hash, and generated PDF report.
• Subscription data: Google Play product and base-plan identifiers, purchase token, subscription status, expiry, renewal status, and an obfuscated Donestra account identifier. We do not receive your full card or bank details.
• Technical data: request logs, IP address, device or browser information, error and security events, and service diagnostics produced by our hosting and infrastructure providers.

3. How we use data

• Create and secure your account and keep you signed in.
• Store, organize, display, and export job evidence and completion records.
• Send client review links, record approval or rejection, and create signed PDF records.
• Generate a concise job summary when you request the AI feature.
• Verify and administer Google Play subscriptions and restore entitlements.
• Prevent abuse, investigate incidents, maintain reliability, provide support, and comply with law.

4. Legal bases

Where the GDPR or similar law applies, we process data to perform our contract with you, pursue legitimate interests in operating and securing the service, comply with legal obligations, and—where required—based on consent. Optional location is collected only after device permission and your action. You may withdraw device permission at any time, without affecting prior lawful processing.

5. AI summaries

When you choose Generate summary, Donestra sends the job title, site address, notes/scope, completed checklist labels, and evidence counts to Google Gemini. Photos, videos, client email addresses, and signatures are not sent to Gemini by this feature. Review AI-generated text before sharing it; it can be incomplete or inaccurate.

6. Service providers and disclosures

We do not sell personal data and do not use third-party advertising SDKs. We use the following processors to operate Donestra:

• Railway for application and API hosting; Neon for the application database; Cloudflare R2 for private media and PDF storage.
• Resend for transactional client-approval email; Google Gemini for user-requested AI summaries; Google Play for Android purchases and subscription administration.
• Expo/EAS for application build and update delivery. These providers may process technical data necessary to deliver their services.
• Authorities, advisers, or a successor organization when legally required, necessary to protect rights and security, or connected to a business transaction subject to appropriate safeguards.

7. International transfers

Our providers may process data in the European Economic Area, the United States, and other countries. Where required, transfers rely on adequacy decisions, standard contractual clauses, or another valid legal mechanism. Provider locations and safeguards can change as their infrastructure evolves.

8. Retention and deletion

We retain account and job content while your account is active, unless you delete it sooner. Approval links are configured to expire, but the underlying job, response, signature, and completion record remain in your account until deletion so you can maintain a work record.

Deleting your account removes the active account database records and private objects stored for it, including uploaded media and generated PDFs. Limited copies may remain temporarily in provider backups, security logs, or records we must retain by law, and are removed or isolated under provider retention schedules. Google retains purchase records under its own policies. Deleting Donestra does not cancel a Google Play subscription.

9. Security

We use access controls, password hashing, authenticated APIs, private object storage, expiring signed links, transport encryption, and account-scoped records. No system is completely secure, so keep your password and private approval links confidential.

10. Your choices and rights

Depending on your location, you may request access, correction, deletion, portability, restriction, or objection, and may appeal a denied privacy request or complain to your data-protection authority. You can delete your account in Donestra under Settings, use our web deletion page, or email contact@aedifylab.com. We may need to verify your identity.

You can deny or revoke camera, microphone, photo-library, or location permissions in device settings. Core account and job text are required to provide the service; optional location is not.

11. Children

Donestra is a business productivity service and is not directed to children under 16. We do not knowingly create accounts for children. Contact us if you believe a child provided personal data.

12. Changes and contact

We may update this policy as Donestra evolves. We will post the current version here and provide additional notice when legally required.

Privacy questions and requests: contact@aedifylab.com. Postal contact: OMNIAMUS S.R.L., Ploiesti, Romania.