Privacy
Last updated: 23 October 2026 — Version 1.8
Read this first: who is responsible for your data
Obrelier is workforce software used by construction companies. If you are a worker using the Obrelier app, your employer decides what data is collected about you and why. In data protection law your employer is the data controller.
Obrelier provides the software and stores the data on your employer's instructions. We are the data processor. We do not decide what to collect, and we do not use your data for our own purposes.
This matters practically: if you want to correct your details, object to how your data is used, or ask why something is recorded, contact your employer first. They are the ones who can answer and act. We will help them, and we will act on your request directly where the app allows it.
1. Who we are
Obrelier is a product of Ecommerce Craft Ltd, a company registered in England and Wales (company number 15092987), which also trades as Yarel Craft Digital.
Registered office: 26 Thorpe Street, Bolton, England, BL1 3JE
Privacy contact: privacy@obrelier.com
Contracts, invoices and correspondence may come from Ecommerce Craft Ltd, Yarel Craft Digital or Obrelier. They are the same company.
Ecommerce Craft Ltd is established in the United Kingdom. Because the service is offered to people in the European Union, we have appointed a representative in the EU as required by Article 27 of the GDPR:
Eco Pintura
c/ Pereda, 86-88 nave, 08930 Sant Adrià de Besòs, Barcelona, Spain
Tel: +34 934 717 303
You may contact either us or our EU representative about anything in this policy.
Your employer's identity is shown in the app on the screen you see before enrolling, and in the data export you can download at any time.
2. What the app collects, and why
2.1 Identity and account
Your name, email address, job role, and the identity and contact details your employer holds for you. Used to sign you in and to show you the parts of the service that apply to you.
You do not create your own account. Your employer provisions it.
2.2 Face data — special category
If your employer uses face verification, a mathematical template of your face is created and stored. It is used only to confirm that it is you when you clock in or out.
- It is a template, not a photo album. One reference image is kept to create and maintain the template.
- It is processed within the European Union (Ireland) and does not leave it.
- Under GDPR this is biometric data used to identify you, which is "special category" data with stronger protection than ordinary data.
You can stop using face verification at any time, from Settings in the app. When you do, the template and the reference image are deleted immediately and automatically, and you clock in using your phone's own unlock instead.
If you never want face verification, you can use the alternative: your phone's own fingerprint, Face ID or passcode. That check happens on your phone. We receive only a yes or no. No biometric data reaches us at all.
2.3 Location
How Obrelier uses your location
Obrelier collects location data to confirm workers are on site when they clock in and out, to alert them if they leave the site during a shift, and to share a delivery driver's arrival time with their manager during a delivery, even when the app is closed or not in use. Location is collected only during a shift or an active delivery, never in between, and is shared with the worker's employer for these purposes only. Background ("Allow all the time") access is optional.
- At clock-in and clock-out: your position is recorded, to confirm you were on site.
- While you are clocked in: your location is used to tell whether you are inside the site boundary, including when the app is not open.
- Between shifts: nothing. Location collection stops entirely when you clock out.
We also record whether a position can be relied upon, because the attendance record has to be trustworthy.
If you are a delivery driver
Drivers do not clock in. Instead, your location is recorded only while a delivery job is in progress: from the moment you accept a job until it is marked delivered, failed or cancelled. This continues while the app is closed or while you are navigating in another app, which is why the app asks for "Always" location access and shows a notification (Android) or the location indicator (iPhone) for as long as it runs.
We use it for one purpose: so your manager can see roughly when you will reach the pickup and the site. They see your latest position on a map and an estimated arrival time, calculated from your position and speed.
Nothing is recorded between jobs, before you accept a job, or after it ends. Your position is also attached to each step of the job (accepted, collected, delivered) so there is a record of where it happened, as it is for clock-in.
When you tap Navigate, the destination is handed to the maps app you choose (Google Maps, Apple Maps or Waze). Obrelier does not send those apps your location history; what that app does with its own data is covered by its own privacy policy.
2.4 Photos and recordings
Depending on which parts of the service your employer uses, the app may record photographs taken at work and short voice notes you choose to submit. Voice notes are transcribed and summarised automatically. To do this, the recording is sent to Google's AI service (Gemini), which acts as our processor. It is used only to produce the transcript and summary for your employer. Google does not use the recordings to train its AI models.
2.5 Work records
Records of the work you do: attendance, shifts, and - depending on which parts of the service your employer uses - site resources you handle, absence requests, and pay records.
2.6 Device and technical data
Basic technical information about the device and app, used to deliver notifications, keep the app working, and diagnose faults.
2.7 What we do NOT do
- No advertising. No tracking. No profiling. The app contains no advertising or analytics SDKs.
- We do not sell your data, to anyone, ever.
- We do not track you when you are not working.
- We do not track drivers between jobs, or use delivery location to measure driving behaviour, speed or breaks.
3. Legal basis
Your employer determines the legal basis. In general:
- Working-time records (clock events, shifts): a legal obligation. Spanish law (Real Decreto-ley 8/2019, Art. 34.9 of the Workers' Statute) requires employers to keep a daily record of working time.
- Running the site safely and efficiently: the employer's legitimate interests.
- Driver location during a delivery job: the employer's legitimate interest in coordinating deliveries to its sites and telling the site when to expect them.
- Face data: special category data under Article 9.
Face verification is never compulsory. It applies only where both are true: your employer has chosen that part of the service, and you have given your own consent. Without both, the app uses the non-biometric method instead.
You can change your mind at any time. Withdrawing is as easy as giving consent, takes effect immediately, and your face data is deleted when you do. Choosing the alternative must not disadvantage you in any way.
4. How long data is kept
| Data | Kept for | Why |
|---|---|---|
| Clock-in / clock-out records | 4 years | Legally required of your employer |
| Location points during shifts | 30 days, then deleted automatically | Only needed to confirm presence at the time |
| Driver location points during deliveries | 30 days, then deleted automatically | Only needed for the arrival time while the job runs |
| Delivery job records (what, when, where each step happened) | With your employer's delivery records | Proof of what was delivered |
| Site photos | 12 months, then deleted automatically | Supporting evidence for a disputed shift |
| Voice recordings | 90 days, then deleted automatically | Only needed until transcribed and reviewed |
| Face template and reference image | Until you withdraw, or you leave | Deleted immediately on either |
| ID card photo | Until you leave | Deleted when your employer marks you as having left |
| Payslips | As required by tax and employment law | Your employer's obligation |
Deletion is automated and runs daily.
When you leave, your face template, reference image and ID photo are deleted automatically. Your working-time records are kept, because your employer is legally required to keep them — even if you ask for erasure. This is permitted by Article 17(3)(b).
5. Your rights
You can exercise these through the app, or by contacting your employer.
| Right | How |
|---|---|
| See your data (Art. 15) | Settings → "Download my data" |
| Take your data elsewhere (Art. 20) | The same export includes a machine-readable file |
| Correct your data (Art. 16) | Correct your name in the app; for other details, ask your employer |
| Delete your face data (Art. 17) | Settings → "Stop using face verification" — immediate |
| Request erasure (Art. 17) | Settings → "Delete my account" |
| Withdraw consent (Art. 7(3)) | At any time, as easily as it was given |
| Object / restrict (Arts. 18, 21) | Contact your employer |
| Complain | Your national supervisory authority. In Spain: the Agencia Española de Protección de Datos (www.aepd.es) |
On erasure requests: we must tell you honestly that your working-time records cannot be deleted on request, because your employer is legally obliged to keep them for four years. Everything that is not legally required is deleted. A request is answered within one month, and a refusal always comes with a reason.
6. Who else processes your data
| Processor | What they do | Where |
|---|---|---|
| Supabase | Database, file storage, authentication | European Union (Frankfurt) |
| Amazon Web Services | Face template matching and secure image storage | European Union (Ireland) |
| Expo | Delivers push notifications | United States |
| Google / Apple | Push notification delivery to your device; maps | Varies |
| Google Maps, Apple Maps, Waze | Only if a driver chooses them to navigate, and only the destination of that trip | Varies |
| Google (Gemini AI) | Transcribing and summarising voice notes in end-of-shift reports | Varies |
Face data and work records stay in the European Union.
Push notifications are delivered via Expo, in the United States. A notification contains only a short message and an identifier — never your face data, location history, or work records. This transfer is made under the European Commission's Standard Contractual Clauses, as required by Chapter V of the GDPR.
7. Automated decisions
Progress reports you record by voice are transcribed and summarised automatically. A human can review any report, and low-confidence results are flagged for review.
A shift left open with no clock-out may be closed automatically. When this happens it is marked as automatically closed, and timed to the last point we know you were on site — never to the time it was closed — so it cannot add hours you did not work. If this is ever wrong, tell your employer and it can be corrected.
No decision with legal or similarly significant effects is made about you solely by automated means.
8. Security
Data is encrypted in transit and at rest. Access is restricted per company and enforced by the database itself, not only by the app. Face templates are held in Ireland and are not reversible into a photograph of your face.
9. Children
The app is for employed workers and is not directed at children.
10. Changes
Material changes will be notified in the app. The version and date are at the top of this page.
11. Contact
Your employer is the first point of contact for anything about your data.
Ecommerce Craft Ltd — privacy@obrelier.com
26 Thorpe Street, Bolton, England, BL1 3JE
We have not appointed a Data Protection Officer. Data protection questions should be sent to the address above.
EU representative (Art. 27): Eco Pintura, c/ Pereda, 86-88 nave, 08930 Sant Adrià de Besòs, Barcelona, Spain.