Privacy and use of information.

Two different experiences

On the public website, the assessment brief is generated in the browser: the fields are not sent to or stored in Megabau systems. If you copy or download the brief, the file remains under your control.

Megabau Operaciones, by contrast, is a connected tool for authorized staff. It transmits the data needed to authenticate the account, receive a shift, document work and sync an assigned order.

Public website and support

The public website is hosted and distributed through Cloudflare. To deliver and protect the page, Cloudflare may process the IP address, browser and device data, requested URL, date and time, network information, and security signals. It may also set __cf_bm, a technical cookie necessary for bot management and service security. Megabau does not use this data or cookie for advertising or cross-site tracking.

When you write to administracion@megabau.cl, Megabau receives the name and email address associated with the individual account that you provide, the message text, and, if attached, screenshots or other files.

Support correspondence is used to identify and respond to the request, restore access, investigate failures or incidents, and protect service security and continuity.

It is retained only for as long as necessary to resolve and document the request, meet contractual or legal obligations, protect security, or resolve disputes; it is then deleted through an authorized process.

Data used by Megabau Operaciones

• Identity and account: name used for work, email address associated with the individual account, and user identifier.
• Device: a random UUID for this installation, used to separate queues and prevent duplicate actions. It is not the IDFA.
• Order, customer, and location: identifiers and names of the customer or business, property, and unit; address; service type; schedule; tasks; and the service or access instructions required to complete the assigned order. The app downloads this data and may keep a local copy for operational continuity.
• Photos: only images the person takes or selects to document a task or incident. Video upload is not currently enabled.
• Operational content: checklist status, notes, incidents, resolutions, self-checks and work events associated with an order.
• Attendance and point-in-time location: check-in and check-out per person and site, time reported by the device and received by the server, location captured for each punch, accuracy, calculated distance to the site, verification result, exceptions, hours worked and punctuality against the assigned schedule.
• Functional and technical metadata: action UUIDs and idempotency identifiers, cursors, revisions, timestamps, a random X-Request-ID for each request, and server error context when present.

The password is sent directly to Google Identity Platform to authenticate the account and is not stored in the app's operational cache.

Purpose and link to identity

This data is used solely for app functionality: authenticating and authorizing the person, displaying their workday, recording check-in and check-out, calculating hours and punctuality, confirming proximity to the site when punching, recording work, synchronizing changes, preparing operational evidence, maintaining consistency and resolving failures. It is linked to identity because requests are authenticated or belong to an assigned work order.

Local storage on the iPhone

To maintain an authorized workday when connectivity is intermittent, the app keeps an operational cache on the iPhone with assignments, customer and site data, address, instructions, checklist, pending attendance punches—including the captured location—notes and photographs needed for the work.

Operational files are stored using iOS complete file protection and are excluded from iCloud backups. Refresh tokens are stored in the iOS Keychain; the password is not retained.

With explicit permission, the app schedules local reminders on the iPhone for the next unit and pending attendance punches based on the downloaded schedule. This build does not use a push service. Alerts do not include access instructions, coordinates, or private notes, and they do not automatically change an order's status.

When the user signs out or access is revoked, the app starts a verified purge of that account's credentials, assignments, action queue, recovery copies, and evidence. If cleanup cannot finish, the information remains inaccessible and the app blocks another sign-in while it retries or instructs the user to contact Administration.

Photos and work content

Photos are private by default and are sent through a signed HTTPS URL. The person uploading them from iOS does not decide which photos are included in a client report; that selection is part of the authorized supervision workflow.

Before adding a note or image, avoid including passwords, alarm codes, personal documents or other information that is not needed for the work order.

Providers and infrastructure

Megabau uses Google LLC services for authentication and cloud infrastructure, including Identity Platform, Cloud Run, Firestore, and Cloud Storage. The public website uses web hosting and distribution infrastructure. These providers process data on Megabau's behalf only to deliver, protect, and diagnose the services. Megabau requires these providers to apply protection equal or equivalent to that described in this policy and limits use to those purposes; it does not authorize them to use or disclose the data for third-party advertising.

Cloud Run request logs include the remote IP address, user agent, URL path and query, method, sizes, status, latency and protocol. The _Default log is retained for 30 days and has no configured exclusions. Megabau does not use the IP address for geolocation or tracking.

Identity Platform activity logging is disabled. Google may process the IP address and user agent for security and abuse prevention, and retain a logged IP address for a few weeks.

Retention and deletion

Authentication information is retained while the account exists. After it is deleted, Google documents that the data is removed from active and backup systems within a maximum of 180 days.

Mobile commands and idempotency identifiers have a 90-day TTL, and Firestore point-in-time recovery retains 7 days. Operational audit records do not expire automatically: they remain until an authorized deletion under Megabau's business and legal policy.

Attendance sessions and their punches, including the associated location, currently have no automatic expiry. Megabau retains them only for as long as needed to manage working time, meet contractual or legal obligations and resolve disputes; deletion requires an authorized process.

Photographs, evidence, and reports are retained only for as long as necessary to document the service, meet contractual or legal obligations, protect security, and resolve disputes. Deletion requires an authorized process.

The verified Cloud Storage configuration automatically deletes pending evidence after 2 days and photographs after 180 days. Access to each official report closes 5 calendar years after approval; the object is physically deleted under a 1,827-day rule, and the bucket retains deleted objects for 14 days for administrative recovery.

You may request access, correction or deletion by writing to the contact shown below. Megabau will verify your identity before acting and may retain the minimum required for legal or contractual obligations, security or dispute resolution.

No advertising or continuous tracking

The app does not use IDFA, advertising or tracking across apps or websites. It requests location access while in use only when a person chooses to check in or out; each punch captures one point and its accuracy to confirm proximity to the site. It does not track continuously, does not access location in the background and Megabau does not use the IP address to geolocate the person.

If location is unavailable or does not allow reliable verification, the punch is marked for review and may include an explanation from the person. Calculated proximity does not prove presence inside a specific apartment.

Contact and requests

For privacy enquiries or to make a request about your data, write to:

Do not send passwords, verification codes or unnecessary sensitive information by email.