Privacy Policy
Last updated October 19, 2026.
This policy explains what personal information Worksite Photos collects, why, who receives it, how long we keep it and what you can do about it. It applies to our website, our iPhone and iPad app and our emails, in every country we sell in. The sections for particular countries near the end add what the law there asks for.
Who we are
Worksite Photos is run by Todd Lahman LLC, 24601 E Mica Peak Rd, Liberty Lake, WA 99019, United States. Its representative is Todd Lahman.
Our Privacy Officer, Todd Lahman, answers for how we handle personal information. This is also our data protection officer where the law uses that name. Write to 
, use the contact form and choose the privacy request topic, or send a letter to the address above.
What we collect
- Account: your name, email address, phone number if you give it, your sign-in provider (Apple, Google or email), the answers you give when you start (your trade, what you want from the app, your crew’s size) and the language you use.
- Google sign-in: if you sign in with Google, Google tells us your name, email address and profile picture (the
openid,emailandprofilepermissions). We use your name and email address to create and identify your account, and show your profile picture beside your name to the people in your company (their browsers load it from Google). Nothing else. - Google Drive, if you connect it: Worksite Photos asks only for the
drive.filepermission, which lets it create files in your Drive and manage the files it created. It makes a Worksite Photos folder and writes copies of your photos there. It cannot see, open or change any other file in your Drive. We keep the access Google grants (a refresh token), encrypted. - Photos and their details: the photos and videos you capture or upload, and the time, GPS location, accuracy, device model and project address recorded with them. This is the product: we store it so you can prove your work. A photo’s precise location is used only to stamp, verify, map and report that photo for your company, never to follow where a person goes. To put the street address on the stamp, the app sends the photo’s position, rounded to about 11 meters and with nothing that names you, through our server to OpenCage, which sends the address back and keeps no record of the lookup. When your company allows it and you let the app add to your photo library, the app also saves each photo’s stamped copy and original to the photo library of the phone that took it. Those copies are on that phone, and in any backup its owner uses; we cannot see or remove them, and deleting a photo in Worksite Photos does not remove them.
- Your company’s contacts: the people your company keeps as contacts, such as your clients, with their name, company, email address, phone number and your notes. You add them, import them from a file, or pick them on your phone. We use them only to show them to your crew and to email the links you choose to send them. Their email address, phone number and notes are encrypted field by field with AES-256-GCM before they reach our database, under keys kept outside it. Every email we send a contact has a one-click link to stop emails from your company, and a contact you delete is gone for good.
- Verification records: a cryptographic hash of each original photo, a signed record of when and where it was taken, and a trusted timestamp. Records contain no image.
- Device attestation: a key issued by Apple App Attest that lets us confirm a photo came from a genuine, unmodified copy of the app. We never receive your device’s identifiers.
- Support requests: what you write to us and our answers.
- Billing: on the website, Stripe sells our subscriptions as merchant of record: you give your card and billing address to Stripe, not to us, and we never see your full card number. Stripe tells us the country of your card and billing address, and we note the country your connection comes from, so we can confirm we are allowed to sell to you. In the app, Apple sells the subscription and tells us only that you have one.
- Launch list: if you ask to be told when Worksite Photos opens, we keep your email address and the page you signed up on, and use them for a confirmation and that one email.
- Collected automatically: your IP address and browser or device details when you use the service (kept in short-lived server and security logs), basic page statistics without cookies, crash reports Apple passes on when you allow it on your iPhone, and for share links, the time, an anonymized IP address and the country of each visit.
You must give an email address to have an account; everything else is optional or is the work you choose to store. We do not collect sensitive information such as health, beliefs or identity numbers, and we ask you not to put it in notes or photos you do not need it in.
Why we use it
- To provide the service you signed up for (performing our contract with you or your company): storing, organizing, verifying, sharing and delivering your photos, files and reports; running your account and your company; sending the emails the service needs, the notifications you turn on and the links you send your contacts; and answering support requests.
- To bill and to sell only where we may (contract and legal obligation): confirming your country, keeping billing records and meeting tax, sanctions and export rules.
- To keep the service safe and working (our legitimate interest in security, which does not override your rights): preventing abuse and fraud, limiting repeated attempts, and finding and fixing errors.
- With your consent: product news, which is off unless you turn it on, and connecting Google Drive. You can withdraw consent at any time, in Settings or with the link in any product news email; that does not affect what was done before.
- To meet the law: answering lawful requests from authorities and keeping the records the law asks for.
We do not sell personal information, show ads, build advertising profiles, or use your photos or data to train artificial intelligence models. We use personal information only for the purposes above; a new purpose would need your consent where the law asks for it.
Emails
Emails about your account, billing, your companies, your support requests and changes to these terms always go out. Activity emails (an upload that failed, a shared link someone opened) can be turned off in Settings. Product news is off unless you turn it on, and only the owners of companies with a paid subscription can turn it on; it never goes to crew members or anyone else who was only invited to a company. Every product news email has a one-click way to stop it, and our name and postal address.
Google user data
Worksite Photos’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- What we use it for: your Google name and email address sign you in, and your profile picture shows beside your name in the app; Drive access writes the backup copies you asked for. We use Google user data for nothing else.
- What we never do with it: we do not sell it, share it with anyone except as needed to provide these two features, use it for advertising, let people read it (except with your permission, to comply with the law, or for security), or use it to develop, improve or train artificial intelligence or machine learning models.
- How we store it: the Drive refresh token is encrypted with AES-256-GCM before it reaches our database. The photos written to your Drive are yours; we keep no copy of your Drive’s contents.
- How you end it: disconnect Google Drive in Settings, or delete your account, and we revoke our access with Google and delete the token. Files already written stay in your Drive. You can also remove Worksite Photos at myaccount.google.com/permissions.
Who receives it
Photos are shared only with the people you invite or send a link to. Public verify pages show a verification record, not the photo. We do not give personal information to anyone else except the service providers below, who handle it for us under written contracts that allow them to use it only to provide their service to us; when the law requires it (a valid court order, for example); or to a buyer of our business, who would be bound by this policy.
| Provider | Country | What it handles | Why | Privacy contact |
|---|---|---|---|---|
| Supabase, Inc. | United States | Everything in your account and your company’s data except image files | Database and sign-in | supabase.com/privacy |
| Cloudflare, Inc. | United States | Photos, files and reports; IP addresses; messages to | Storage, delivery, form checks (Turnstile) and email forwarding | cloudflare.com/privacypolicy |
| Vercel Inc. | United States | Requests to the website, IP addresses, page statistics without cookies | Running the website | vercel.com/legal/privacy-policy |
| Twilio Inc. (SendGrid) | United States | Email addresses, names and the emails we send | Delivering email | twilio.com/en-us/legal/privacy |
| Stripe, Inc. | United States | Your email address and company name when you subscribe; Stripe collects your payment details itself | Selling and billing web subscriptions, as merchant of record | stripe.com/privacy |
| Apple Inc. | United States | Sign in with Apple, app purchases, App Attest and map tiles | Sign-in, App Store billing, attestation and maps | apple.com/legal/privacy |
| OpenCage GmbH | Germany | A photo’s GPS position, rounded to about 11 meters, with nothing that names you | The street address on the stamp; it keeps no record of the lookup | opencagedata.com/gdpr |
| Google LLC | United States | Google sign-in, map tiles and, if you connect it, your Drive | Sign-in, maps and backups | policies.google.com/privacy |
Your browser loads map tiles from Apple or Google when a map shows a photo’s location, and Turnstile from Cloudflare when it checks a form; each receives your IP address. The timestamp authorities that seal verification records receive only a hash, which contains no personal information. Before a new provider handles personal information we add it here and email account owners.
Where your data is stored, and sending it to the United States
Worksite Photos is run from the United States, and your data is stored and processed there, by us and by the providers above. If you use Worksite Photos from another country, your personal information is sent to the United States over encrypted connections each time you use the service, and kept there for the times listed under “How long we keep it”. The service cannot work without this; if you do not want it, do not create an account, or delete it. One exception: to find a photo’s street address, its position alone goes to OpenCage in Germany, as described above.
The United States has no single national privacy law. Personal information is protected there by federal laws for particular kinds of information, by the Federal Trade Commission’s power to act against unfair or deceptive practices, and by state laws such as California’s Consumer Privacy Act. Courts, law enforcement and national security agencies may obtain access to information held there under United States law. We have reviewed that system, and we protect your information with the contracts and measures in this policy wherever it is held.
How long we keep it
| Information | Kept until |
|---|---|
| Your account | You delete your account in Settings, which erases it at once |
| A company’s photos, files, projects, contacts, reports and verification records | Its owner deletes the company. A company whose subscription ends stays read-only, with every export available, until then |
| Photos moved to the trash | 30 days, then deleted for good |
| Support requests | Your account is deleted |
| Share link visits | The link or the company is deleted |
| Product news consent | You turn product news off |
| Launch list | Launch, when we delete the list; unsubscribing stops every email at once |
| Security records (attempts counted by IP address) | 2 days |
| Email delivery events | 7 days |
| Database backups | Replaced as they rotate, within 30 days |
| Billing records | Kept by Stripe and Apple as long as tax law requires them to |
When the time is up, we delete the information from our systems so it cannot be recovered, and our providers do the same; we keep no paper copies. Proof already issued for a photo stops verifying once that photo’s company is deleted. What deletion cannot reach: copies a customer already made (exports, Drive copies, files downloaded from share links).
Cookies
We use only the cookies the service needs: one that keeps you signed in, one that remembers which company you are working in, and one that remembers your language. Your browser also stores your light or dark theme. We use no advertising or tracking cookies. If you block cookies, you cannot sign in, but the public pages still work.
Tracking and Do Not Track
We do not track you across other websites or apps, show ads, or let advertising or analytics companies collect information about what you do on Worksite Photos. Because there is no such tracking to turn off, we treat every visitor the same whether or not their browser sends a Do Not Track or Global Privacy Control signal.
How we protect it
- Technical: encryption in transit and at rest; originals in a private bucket, served only through signed links that expire; every query scoped to your company; contacts’ email addresses, phone numbers and notes and Google Drive tokens encrypted field by field with keys kept outside the database; limits on repeated attempts; verification records that cannot be changed once made.
- Organizational and personnel: a named Privacy Officer; access to personal information only for the people who run the service, only to provide and support it, under a duty of confidentiality; this policy and our breach plan reviewed when the service changes.
- Physical: our data is held in our providers’ data centers in the United States, whose physical security they certify; we keep no personal information on paper.
- Where it is held: we hold personal information in the United States, and we have taken the United States’ system for protecting it into account in these measures (“Where your data is stored” above).
If a security breach affects your personal information, we tell you without undue delay, and the authorities where the law requires it, with what happened, what was affected and what we and you can do; and we tell the company that holds it in its account.
Your rights
You can see, export, correct and delete your information yourself in the app and in Settings. You can also ask us, at no charge, to:
- tell you what personal information we hold about you, how we use it and who has received it, and give you a copy;
- correct it or complete it;
- delete it, or stop or limit using it;
- withdraw a consent you gave, without affecting what was done before;
- give it to you in a format another service can read.
Write to or use the contact form. We confirm who you are (usually by answering from the email address on your account), and we answer within 10 days. Someone you authorize may ask on your behalf. We never treat you differently for using these rights. Information your company keeps about you (as a crew member, subcontractor or client) is held for that company: we pass your request on to it, or help it answer.
If you are not satisfied with our answer, you can complain to the privacy authority where you live; they are named in the sections below.
Country sections
United States
California residents have rights under the California Consumer Privacy Act, and residents of other states under their own laws; we honor them for everyone. In the last 12 months we collected the categories described under “What we collect”: identifiers, commercial information (subscriptions), internet activity on our service, precise geolocation recorded with photos, and the photos themselves, from you, your company and your devices, for the purposes under “Why we use it”, and disclosed them only to the providers listed above for those purposes. We do not sell or share personal information, as the CCPA defines those words, and use precise geolocation only to provide the service. You may also complain to the California Privacy Protection Agency.
Australia
We handle personal information in line with the Australian Privacy Principles. You can complain to us first, and then to the Office of the Australian Information Commissioner (oaic.gov.au).
Taiwan
Under the Personal Data Protection Act, we tell you that Todd Lahman LLC collects the personal data under “What we collect” for the purposes under “Why we use it”, uses it for the periods under “How long we keep it”, in the United States and wherever you use the service, and only by us and the providers listed above. You may ask to see or copy it, to correct or complete it, and to stop collecting, processing or using it or to delete it, as under “Your rights”. If you do not give an email address, we cannot open an account for you.
Singapore
Our data protection officer is Todd Lahman, . You may withdraw your consent, and ask for access to or correction of your personal data, as under “Your rights”; we tell you what withdrawing would mean for the service. Our providers protect transferred personal data to a standard comparable to the Personal Data Protection Act. You may also contact the Personal Data Protection Commission (pdpc.gov.sg).
New Zealand
Under the Privacy Act 2020 you may ask for access to and correction of your personal information, as under “Your rights”. Our Privacy Officer is Todd Lahman. If a contractor has entered your details in their account, they are responsible for telling you, and we help them. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).
Children
Worksite Photos is for businesses and is not directed at children under 16. We do not knowingly collect personal information from them.
Changes
We post changes here with a new date and, for material changes, email account owners before they take effect.