CUE IMS

Last updated: 7 July 2026

1. Who we are

CUE IMS ("CUE IMS", "we", "us", or "our") is the data controller responsible for the personal data processed through the CUE IMS web and mobile applications (the "Service"). If you have any questions about this policy or how we handle your personal data, contact us at privacy@cueims.com. (This is a placeholder contact address and will be updated.)

2. Scope

This policy explains what personal data we process when you use the Service, why we process it, the legal basis for each purpose, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Norwegian data protection law.

3. What data we process

• Account data: your name, email address, role, and the tenant / company membership associated with your account.

• Project and site data: projects, site addresses and locations, plans, zones, and installation progress records you create or that are created about the work you perform.

• Photos and file uploads: issue, snag, and progress photos, image annotations, and documents you upload.

• Location and address data: addresses and location information tied to projects and site records.

• Push notification tokens: on mobile, an Expo push notification token used to deliver operational notifications to your device.

• Device information in support reports: when you submit an in-app "report a problem" support report, we include your device model, operating system version, and app version to help us diagnose the issue.

4. Why we process your data and our legal basis

• To provide the Service — creating and managing your account, projects, site records, plans, progress, photos and documents. Legal basis: performance of a contract (GDPR Article 6(1)(b)).

• To send operational notifications — delivering push notifications about work relevant to you. Legal basis: performance of a contract (Article 6(1)(b)), or your consent where the platform requires it (Article 6(1)(a)).

• To provide support and keep the Service secure — handling the support reports you submit and diagnosing technical problems. Legal basis: our legitimate interests in operating, securing and improving the Service (Article 6(1)(f)).

• To comply with legal obligations — where applicable law requires us to retain or disclose certain records. Legal basis: legal obligation (Article 6(1)(c)).

5. No third-party analytics or advertising trackers

We do not use any third-party analytics, advertising, or crash-reporting/tracking tools in the Service. We do not sell your personal data and we do not use it for advertising. Diagnostic information is limited to the details you choose to include when you submit an in-app support report; we do not collect it automatically in the background.

6. Who processes your data (processors and hosting)

We host and process data using Supabase, our infrastructure and database provider, acting as a data processor on our behalf under a data processing agreement. Supabase stores the account, project, site, and file data described above so that we can provide the Service.

7. International transfers

Where personal data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards recognised under GDPR — such as the European Commission's Standard Contractual Clauses — to ensure your data receives an equivalent level of protection.

8. How long we keep your data

We keep your personal data for as long as your account is active and as needed to provide the Service. When your account or a tenant relationship ends, we delete or anonymise the associated personal data within a reasonable period, unless we are required to keep it longer to meet a legal obligation or to resolve disputes.

9. Your rights

Under GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.

• Rectification — have inaccurate or incomplete data corrected.

• Erasure — have your personal data deleted ("right to be forgotten").

• Restriction — ask us to limit how we process your data.

• Portability — receive your data in a structured, commonly used, machine-readable format.

• Objection — object to processing based on our legitimate interests.

To exercise any of these rights, contact us at privacy@cueims.com. We will respond within the timeframes required by law.

10. Right to lodge a complaint

If you are in Norway, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) if you believe our processing of your personal data does not comply with data protection law. You may also contact the supervisory authority in your country of residence within the EEA.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page.

12. Contact

For any privacy questions or to exercise your rights, contact us at privacy@cueims.com.