Trussara Privacy Policy

Veltrana Studios LLC — Trussara
Effective Date: October 10, 2026
Last Updated: October 10, 2026

1) Who We Are & Scope of This Policy

Veltrana Studios LLC (“Veltrana,” “we,” “our,” or “us”) provides Trussara, a business operations, project-management, workforce, document, and record-management platform for construction companies and their authorized owners, administrators, employees, workers, subcontractors, accounting personnel, clients, and other invited users.

This Privacy Policy explains how we collect, use, disclose, protect, retain, and delete personal information when you use the Trussara mobile application, related Trussara web pages, account-deletion process, support services, notifications, and other services that link to this Policy (collectively, “Trussara”). It does not govern a separate Veltrana product that displays a different privacy policy.

2) Veltrana’s Role & Your Organization’s Role

Trussara is a multi-tenant business service. The company or organization that creates or administers a Trussara workspace generally determines why its workforce, client, project, timekeeping, location, financial, and document information is entered into that workspace. For that organization-controlled information, Veltrana generally handles information on the organization’s behalf as a service provider or processor, subject to the parties’ agreement and applicable law. The legal role of each party may depend on the particular information and jurisdiction.

Veltrana separately determines how and why it processes information needed to create and secure Trussara accounts, operate the platform, prevent abuse, provide support, communicate about the service, comply with law, and protect legal rights. Organization owners and administrators control workspace membership, roles, permissions, and access to organization records.

A workspace may contain information about people who do not have Trussara accounts, including client contacts, property contacts, visitors, inspectors, subcontractor personnel, and owner representatives. The organization entering that information is responsible for having appropriate authority and providing notices or obtaining consent where required.

If your request concerns records controlled by your employer, contractor, client, or another organization, you should normally contact that organization first. You may also contact Veltrana using the information at the end of this Policy.

3) Information Trussara Collects & Processes

A. Account, Identity & Profile Information

• Name, email address, phone number, profile image, and account identifiers.
• Organization membership, role, permissions, job title, trade, and employee number.
• Authentication information, password-related records maintained by our authentication provider, multifactor-authentication settings and events, invitations, active sessions, and account-security status.
• Account preferences, notification choices, and other settings.

B. Organization, Client & Project Information

• Organization name, logo, business settings, membership records, and administrative configurations.
• Projects, properties, job sites, business or physical addresses, clients, contacts, assignments, schedules, milestones, and related operational information.
• Daily logs, field notes, comments, acknowledgments, punchlist items, transmittals, approvals, signatures, and audit history.
• Client-portal records and invitation or access relationships.

C. Workforce, Timekeeping, Location & Workplace Safety Information

• Clock-in and clock-out events, breaks, time entries, corrections, timesheets, cost codes, assignments, and approval history.
• Crew or subcontractor company, trade, worker count, regular and overtime hours, descriptions, visitor names, visitor company, visit purpose, arrival and departure times, and related notes.
• Safety observations, toolbox talks, inspections, near misses, incidents, severity, actions taken, reportable status, incident references, and occurrence times entered by an authorized user.
• Safety or incident descriptions may contain injury-related information if an organization chooses to enter it.
• Trussara is not a medical-record system. Users should not enter diagnoses, treatment records, health-insurance information, government identifiers, or medical documents unless the organization has determined that entry is lawful, necessary, and appropriately protected.
• Depending on the settings selected by the user’s organization, location may be turned off, optional, or required to complete a live time-clock action.
• When location is included, Trussara may collect latitude, longitude, location accuracy, and the time of the clock action and link them to the applicable account and time record.
• Authorized organization users with the appropriate role may view location attached to a time record for timekeeping, site-verification, review, correction, dispute, safety, or compliance purposes.
• Trussara does not currently collect location continuously and does not request background location access.

D. Documents, Photos & Other User-Submitted Content

• Plans, documents, files, photos, videos, attachments, signatures, logos, comments, and other content an authorized user chooses to upload or create.
• File names, file types, storage paths, version information, upload history, and access or approval records associated with that content.

E. Job-Cost & Business Financial Information

• Budgets, commitments, change orders, actual-cost records, cost codes, financial categories, approval history, and other job-cost information entered by authorized users.
• These business records do not require a user to provide payment-card or bank-account credentials to Trussara.

F. Communications & Notification Information

• Support emails, requests, feedback, troubleshooting details, and other communications with Veltrana.
• In-app notification records, email-delivery information, notification preferences, and device push tokens when push notifications are enabled.
• Organization invitations and transactional messages needed to provide requested features.

G. Technical, Security & Usage Information

• IP address and request metadata available to our hosting and infrastructure providers.
• Device type, operating-system version, app version, language, time zone, and basic connection or request information.
• Sign-in events, authorization decisions, security events, feature actions, audit records, and technical error information recorded in server request logs or deliberately submitted in a support request.
• App-store or testing-platform information made available by Apple or Google, such as app version, test participation, and purchase-validation information if paid service is later enabled.

H. Information Trussara Does Not Currently Use

Trussara does not currently use third-party advertising, behavioral-analytics, or crash-reporting SDKs; sell personal information; use personal information for cross-context behavioral advertising; read a user’s device address book; or collect continuous or background location.

The current internal-testing version does not process paid subscriptions. If these practices or the paid-service model change, we will update this Policy and any required in-app or store disclosures before the new processing begins.

4) Sources of Information

We obtain information from:

• you, when you create an account, complete a profile, use a feature, upload content, configure a setting, or contact support;
• your organization and its authorized users, when they invite you, assign a role, create or manage records, or submit information concerning authorized business operations;
• clients, contractors, or other authorized users who interact with a shared workspace or portal;
• your device, but only through permissions, settings, and technical functions used to provide or secure Trussara;
• Apple, Google, and other platform providers involved in distributing, testing, securing, or operating the app; and
• our infrastructure, authentication, storage, notification, email, website-hosting, and support providers.

5) How & Why We Use Information

We use information to:

• create, authenticate, maintain, and secure accounts;
• create and administer organization workspaces, memberships, roles, and permissions;
• provide project, scheduling, timekeeping, daily-log, punchlist, team, CRM, financial, plan, document, notification, and settings features;
• display shared records to users authorized by the applicable organization;
• capture a device location when requested for an explicit time-clock action;
• store, transmit, version, retrieve, and protect user-submitted files and records;
• send invitations, security notices, requested notifications, support responses, and important service communications;
• maintain audit history and records needed for accountability, security, dispute prevention, and authorized business operations;
• detect, investigate, prevent, and respond to fraud, abuse, security threats, unauthorized access, or violations of our Terms;
• diagnose errors, maintain reliability, improve accessibility and performance, and develop or evaluate service features;
• comply with legal obligations, lawful requests, and enforceable agreements; and
• establish, exercise, or defend legal claims and protect the rights, safety, and property of Veltrana, customers, users, and others.

6) Legal Bases Where EEA or UK Law Applies

Where European Economic Area or United Kingdom data-protection law applies, we rely on one or more of the following legal bases:

• Contract: processing needed to provide Trussara or take requested steps before providing it.
• Legitimate interests: operating and securing the service, preventing misuse, supporting customers, improving reliability, and protecting legal rights, balanced against the individual’s rights.
• Consent: where consent is required, including certain optional device permissions or communications. Consent may be withdrawn without affecting earlier lawful processing.
• Legal obligation: processing needed to comply with applicable law or lawful process.
• Customer instructions: organization-controlled information may be processed on behalf of a customer acting as controller.

7) Device Permissions & User Controls

Trussara may request permission to use device location or notifications when needed for a feature. Location is requested in connection with an explicit time-clock action and is not collected continuously or in the background. Push-notification registration is optional.

You can deny or later withdraw these permissions in your device settings, although the related feature may stop working. Depending on the organization’s configuration, location may be optional or may be required to finish a live time-clock action.

A device permission does not itself authorize an employer or organization to collect information unlawfully. Organizations are responsible for providing any workplace notices, obtaining any permissions or consents, and following employment, labor, timekeeping, and location-monitoring laws that apply to their use of Trussara.

8) How Information Is Disclosed

A. Within an Organization or at Its Direction

Information may be visible to organization owners, administrators, supervisors, assigned team members, accounting personnel, clients, portal users, invitees, transmittal recipients, or other authorized participants according to their roles, permissions, assignments, and the organization’s instructions.

Trussara does not make private workspace records public merely because they are stored in the service.

B. Service Providers

We use service providers to operate Trussara. Depending on the enabled features, these may include:

• Supabase for authentication, databases, private file storage, and server or Edge functions;
• Resend for transactional email when email delivery is enabled;
• Google Firebase Cloud Messaging for Android push notifications when enabled;
• Apple Push Notification service for iOS push notifications when enabled;
• Apple and Google for app distribution, store-operated testing, platform security, purchase validation if later enabled, and related platform services;
• Squarespace for hosting Veltrana’s public website and Trussara legal or support pages; and
• Veltrana’s business email and support providers for receiving, securing, and responding to support and privacy communications.

When a provider processes information on our behalf, we use agreements designed to require processing only for the services provided and protection consistent with this Policy and applicable law.

Apple, Google, Squarespace, and other platform providers may also process information as independent businesses under their own privacy policies for services they control. Some providers maintain their own subprocessor lists and may process information in multiple locations.

C. Legal, Safety & Rights Protection

We may disclose information when we reasonably believe disclosure is required by law, subpoena, court order, or other valid legal process; necessary to investigate or prevent fraud, abuse, security incidents, or threats to safety; or necessary to establish, exercise, or defend legal rights.

Where legally permitted, we may notify the affected customer or user before disclosure.

D. Business Transactions

Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. We will require the recipient to handle personal information consistently with applicable law and will provide notice when legally required.

E. With Your Direction or Consent

We may disclose information when you or the organization controlling the relevant workspace directs us to do so or when you provide legally valid consent.

9) No Sale, Targeted Advertising, or Advertising Profiles

Veltrana does not sell Trussara personal information for money or other valuable consideration.

Veltrana does not “share” Trussara personal information for cross-context behavioral advertising as that term is defined by California law, and does not use Trussara information for targeted advertising. Trussara does not currently offer a financial incentive in exchange for personal information.

10) Cookies, Website Data, Do Not Track & Global Privacy Control

Trussara’s public webpages may use cookies, local storage, and similar technologies supplied by Squarespace or other website services for essential operation, security, preferences, and measurement features that Veltrana enables.

Browser settings may allow you to block or delete cookies, but doing so may affect website functionality. Where a consent-management control is displayed, you may use it to manage the available choices.

The Trussara app does not currently include third-party advertising trackers intended to follow activity across unaffiliated apps or websites.

Because there is no uniform industry standard for browser “Do Not Track” signals, our website does not currently respond to every such signal. Where applicable law requires recognition of a supported universal opt-out mechanism, such as Global Privacy Control, we will process it as required.

Trussara does not currently sell personal information or use it for cross-context behavioral advertising, so there is presently no sale or targeted-advertising activity to opt out of.

11) Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the service, preserving organization-controlled business records, maintaining security and audit history, resolving disputes, enforcing agreements, and complying with legal obligations.

Retention depends on the type of information, the customer’s instructions, account or workspace status, contractual requirements, security needs, and applicable legal or recordkeeping duties.

• Active account and profile information is generally retained while the account remains active and is processed during account deletion as described below.
• Organization-controlled records may remain for the life of the workspace or longer when the organization or applicable law requires legitimate business, payroll, safety, financial, contractual, dispute, or audit records.
• Security and audit information may be retained as reasonably necessary to prevent abuse, investigate incidents, document authorized activity, and comply with legal obligations.
• Notification information is retained while needed to deliver, document, secure, or troubleshoot the notification and is removed or pseudonymized during account deletion where applicable.
• Support communications may be retained while needed to resolve the request and maintain appropriate service or legal records.
• Backups are protected and removed or overwritten through the applicable provider’s normal backup-rotation process. Until removed, backup information is restricted from ordinary use except for security, continuity, or disaster recovery.

The current beta does not provide organization-configured automatic age-based deletion or in-app legal-hold administration. An authorized organization representative may contact Veltrana to request review of workspace-record deletion, restriction, export, or preservation.

12) Account Deletion & Workspace Records

An authenticated user can initiate account deletion from Trussara > Settings > My Account > Delete account.

A user who cannot access the app can visit www.veltranastudios.com/trussara/delete-account to start an external request.

After required identity and ownership checks are resolved, account deletion is designed to:

• revoke active sessions and remove active workspace access;
• delete the authentication identity;
• delete user-specific notification recipients, digests, preferences, and push endpoints;
• remove or pseudonymize the name, phone number, avatar, invitation identity fields, profile fields, and historical actor references where reasonably possible;
• unlink portal access and invitations from organization-owned CRM contacts; and
• send confirmation when processing is complete.

For security, Trussara may require recent authentication. An account protected by multifactor authentication may require the verified factor.

A sole organization owner may first need to transfer ownership or request closure of the workspace. The verified in-app flow normally completes the account deletion as part of the confirmed request.

If a provider operation cannot be conclusively completed, or an ownership or workspace issue requires additional review, Trussara will display or provide a status or support reference and confirmation after processing is completed.

Deleting one individual account does not delete records created independently by other users or the organization’s separate workspace.

Limited organization-controlled construction, workforce, timekeeping, payroll, financial, contractual, safety, CRM, document, file, security, or audit records may remain only when the customer organization independently controls the record and a documented contractual, legal, security, fraud-prevention, dispute, or recordkeeping basis applies.

Trussara removes active access and identity fields and retains only a non-identifying actor reference where needed to preserve record integrity. Personal content associated only with the deleted account, and content for which no independent lawful or documented organization-record basis remains, must be deleted or irreversibly de-identified.

Where a limited record must remain, Veltrana will minimize it, restrict its use and access to the applicable purpose, and delete or de-identify it when the retention basis ends. We will explain the categories retained and the reason when required by law.

An authorized organization representative may separately request review of an entire workspace or particular organization records. Veltrana will verify authority and evaluate contractual, legal, security, and third-party recordkeeping obligations before acting.

13) Your Privacy Rights & Choices

Depending on your location and the relationship between Veltrana and the organization controlling your records, you may have the right to:

• confirm whether personal information is being processed;
• request access to or a copy of personal information;
• request correction of inaccurate personal information;
• request deletion of eligible personal information;
• request a portable copy of eligible information;
• restrict or object to certain processing where applicable;
• withdraw consent where consent is the legal basis;
• use an authorized agent where permitted by law;
• appeal a denied privacy request where applicable; and
• exercise applicable rights without unlawful discrimination.

You may update certain profile information and notification preferences in Trussara and manage device permissions through your device settings.

To make another request, email support@veltranastudios.com with the subject Trussara privacy request. Describe the request and identify the account email and organization involved.

Do not send a password, multifactor-authentication code, government identification, confidential project records, or sensitive medical information by ordinary email.

We may need to verify your identity and authority before completing a request. If an organization controls the requested records, we may refer the request to that organization or assist it in responding.

Authorized agents may submit requests where permitted by law, subject to verification of the agent’s authority and the individual’s identity. If we deny an appealable request, you may reply to the decision with the subject Trussara privacy appeal.

14) Additional United States Privacy Disclosures

The categories of personal information Trussara may process are described in Section 3, the sources are described in Section 4, the purposes are described in Section 5, and the categories of recipients are described in Section 8.

Trussara may process identifiers, customer records, commercial or business records, internet or electronic activity, approximate or precise geolocation used for an explicit time-clock action, professional or employment-related information, workplace safety information, user-submitted content, and inferences inherent in organization-defined roles or workflow status.

Veltrana does not sell these categories of information and does not share them for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about a person or for advertising.

If a state privacy law applies, eligible residents may exercise the rights provided by that law through the contact method in Section 13.

15) EEA, UK & Similar International Rights

Where applicable law provides, individuals may request access, correction, erasure, restriction, portability, or objection; withdraw consent; and lodge a complaint with the competent data-protection authority.

A withdrawal of consent does not affect processing already lawfully performed. Contractual or legal requirements may limit certain requests.

When Veltrana acts only on an organization’s instructions, the organization is normally responsible for responding, and Veltrana will provide reasonable assistance.

16) Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted network transport, authentication controls, tenant separation, role-based access, private file storage, optional multifactor authentication, audit records, provider access controls, and operational monitoring.

Access is limited according to role and operational need. No system can guarantee absolute security. Users must protect their credentials and promptly report suspected unauthorized access.

17) International Processing

Veltrana and its service providers may process information in the United States and other locations where they operate. Those locations may have data-protection laws different from the laws where you live.

Where applicable law requires a transfer safeguard, we will take the legally required contractual, organizational, or other steps for the relevant transfer.

18) Children’s Privacy

Trussara is a workplace and business service and is not directed to children under 13. We do not knowingly offer Trussara accounts to children under 13.

If we learn that a child under 13 provided personal information directly to Trussara without valid authorization, we will take appropriate steps to delete it.

This Trussara Policy does not apply to any separate child-directed Veltrana product. Child-directed products must provide their own privacy notices and parental controls where required.

19) Changes to This Policy

We may update this Policy to reflect changes in Trussara, our providers, legal requirements, or our data practices.

We will post the revised Policy with a new “Last Updated” date. When required, we will provide additional notice through the app, email, or another appropriate method and obtain consent before applying a material change where applicable law requires it.

20) Contact Veltrana

For privacy questions, rights requests, security concerns, or complaints concerning Trussara, contact:

Veltrana Studios LLC
Attn: Trussara Privacy
Email: support@veltranastudios.com
Support: www.veltranastudios.com/trussara/support
Website: www.veltranastudios.com

We will review privacy complaints and respond as required by applicable law. If you are using Trussara through an employer, contractor, client, or other organization, you may also contact that organization’s administrator regarding its workspace records.