Privacy Policy
NDroad · LLC New Direction Road
Effective from 20 August 2026 · Version 1.0
This explains what data NDroad stores, what for, and how long we keep it. We have tried to write it in plain language.
1. Who controls what
Two parties use the system, and the law gives each of them a different role.
- The company using NDroad is the controller of its employees' data. It decides who to add to the system, what daily rate to record, and how long to keep that record.
- LLC New Direction Road is the processor: we run the software those records live in. We do not use customer data for our own purposes, do not sell it, and do not process it for advertising.
One exception: the account holder's own contact details (name, email, phone) are also processed by us as a controller, because the contract is directly between us.
If you are a worker or a foreman wondering why your location or wage appears in the system, that question belongs to your employer. We cannot delete their records without their instruction, but we are obliged to help your request reach them.
2. What data we process
Below is every category the system actually stores. We collect nothing else.
| Category | What it contains |
|---|---|
| Account | Name, email, phone (if you provide one), role, and a hashed password. Passwords are never stored in plain text. |
| Worker | Name, phone, trade, daily rate, city, whether the record is active, and an available-for-hire flag if the company turns it on. |
| Work records | Attendance, earnings, advances and payments, fuel, materials, machine hours, weather and chainage, and project costs. |
| Photos and their location | The image, the capture date and time, coordinates, altitude, speed and heading exactly as the phone reported them, and the place name derived from those coordinates. |
| Technical records | Login attempts, security events and their IP address, a log of who changed what and when, and a push notification token if you enable notifications. |
What we do not collect: card details (billing is by invoice and no card is stored), health or biometric data, your phone's contacts, and any form of analytics or advertising tracking. There is no third-party analytics code in the system.
3. Our legal basis
- Contract. Account data and everything the system stores on your instruction. Without it we cannot provide the service at all.
- Legitimate interest. Technical records and login attempts, to protect the system. Without them we cannot stop someone guessing passwords.
- Legal obligation. Accounting and tax records we are required to retain.
- Consent. Phone permissions, to the extent described in section 4. Consent can be withdrawn at any time.
4. Phone permissions
The mobile app asks for four permissions, each for one specific feature.
- Camera: to photograph the site. The date and location are stamped onto the photo at the moment of capture.
- Photo library: to pick an existing photo if you are not using the camera.
- Location: only while the app is open. When the app is closed it does not read your location.
- Face ID or fingerprint: to unlock the app. Biometric data never leaves your phone. The server is only told whether the app unlocked.
Refusing a permission does not stop the app, it only disables the corresponding feature. Permissions can be revoked at any time in your phone's settings.
5. Cookies
There are no advertising or tracking cookies. Four things are stored in the browser in total.
| What | Why | How long |
|---|---|---|
| Session | So you are not asked for a password on every page | 30 days |
| Worker session | The same, for the worker sign-in | 30 days |
| Flash message | Carrying a "saved" notice to the next page | 10 seconds |
| Theme | Light or dark appearance, kept in browser storage | Until you clear it |
A web session closes itself after 20 minutes of inactivity. Administrator sessions never live longer than 8 hours.
6. Who we share with
We do not sell or trade data. The system contacts the following external services, each for one specific function.
- Push notification service. When a notification goes to a phone, the external service receives that phone's notification token and the message text (for example "a report needs approval"). Wage figures and photographs are never sent in a notification.
- Email. Used to send the administrator's one-time code. The message contains the code and the IP address that requested it, nothing else.
- Map service. It appears in two places, and the difference matters:
- For photo stamps and for turning coordinates into a place name, the request is sent by our server. Your IP address does not reach the map service, and the answer is cached with us so the same point is not requested twice.
- On the dashboard map page, map tiles are fetched directly by your own browser. Here your IP address is visible to a third party. Nothing else in the system contacts the map service, so if you would rather it were not, do not open that one page.
- Law. We will disclose data if required by law or a court order. In that case we notify the customer, unless notifying them is itself prohibited by law.
7. Where data is stored
Data is stored in the European Union (Sweden). This is within the European Economic Area, where the level of data protection meets the requirements of Georgian law, so the transfer needs no additional authorisation.
We do not publish the server provider, the configuration or the technical security parameters. We answer those questions for a specific customer under contract or on a security questionnaire.
8. How long we keep it
- While the account is active: work records are kept. They are your company's history.
- After the subscription expires: the data stays and the system becomes read-only. We delete nothing because a payment was late.
- After 12 months: if no renewal happens for a year, we may delete the data. We warn the account's email address at least 30 days before deleting anything.
- On your request: sooner. We complete such requests within 30 days.
- Technical records: login attempts and revoked sessions delete themselves as soon as they expire. The log of who changed what is kept for the life of the account. In an internal dispute it is often the only record there is.
- Accounting records: for as long as the law requires, regardless of a deletion request.
9. Your rights
Georgian law gives you the right to:
- know what data we hold about you and where it came from;
- receive a copy of it;
- have it corrected if it is inaccurate;
- request its deletion or that processing be stopped;
- withdraw consent where processing rests on consent;
- not be subject to a decision made by automated means alone. The system makes no such decision: wages and attendance are confirmed by a person, the system does the arithmetic.
Send requests through the channel you arranged your subscription through (see section 12). We answer within 30 days. If you are a worker or an employee added by your company, we forward the request to your employer and follow up to make sure it reaches them.
If our answer does not satisfy you, you have the right to complain to the Personal Data Protection Service of Georgia. This does not limit your right to go to court.
10. Security
Passwords are stored as cryptographic hashes and cannot be read in plain text. One company's data is not reachable from another, and this is checked on every request. Backups are taken, and we check periodically that they actually restore.
We do not publish specific technical security parameters, because a published parameter helps an attacker. Ask a security question under contract and you will get a written answer.
We cannot promise absolute security. If an incident occurs that affects your data, we notify the customer without delay and inform the supervisory authority within the period set by law.
11. Changes
When this document is updated, the date and version above change. For material changes we write to the account's email address at least 14 days in advance.
12. Contact
LLC New Direction Road
A contact email address will be published on this page. Until then, reach us through the channel you arranged your subscription through.
This document exists in Georgian and English. In case of any inconsistency, the Georgian version prevails.