Last updated: September 2026
ProPunch collects information you provide when creating an account, including your name, email address, organization name, and role. We also collect data generated through your use of the platform, such as checklist entries, photos, voice notes, and project information.
We use your information to provide and improve the ProPunch platform, including managing your projects, generating reports, sending notifications, and ensuring the security of your account. We do not sell your personal information to third parties.
Your data is stored securely using Firebase (Google Cloud Platform) with encryption at rest and in transit. Photos and media are stored in Firebase Storage with organization-scoped access controls. We implement role-based security rules to ensure users can only access data within their organization.
We share data only as necessary to provide the service: with Firebase/Google Cloud for infrastructure, with Resend for email delivery, and with Vercel for hosting. We do not share your project data, photos, or checklist information with any third parties for marketing or advertising purposes.
If your organization connects ProPunch to Procore or CompanyCam, we access data from those services through their APIs, only for the projects you link and only to mirror punch items and photos between ProPunch and your own project in the connected service, so your team does not re-key the same finding twice. We never sell this data, never share it with any other customer, and never build a copy of it beyond what the connection needs.
What we read from Procore. Punch items and their attachment files, Locations, project and company names, and the profile of the Procore user who authorizes the connection. We do not read financials, RFIs, submittals, daily logs, or directory records. Drawings are read only when a project manager chooses to import them.
What we write to Procore. Punch items and photo attachments for failed checklist items, Location nodes for the buildings and units in a linked project, and the webhook subscriptions that let Procore notify us of changes. Every write is made as the authorizing user and never exceeds that user’s own Procore permissions.
CompanyCam. We read project names, IDs, and photo thumbnails from the CompanyCam projects you link, and write verdict-bound photos into them.
How it is protected. Procore OAuth tokens and CompanyCam access tokens are encrypted at rest with AES-256-GCM using a key held in Google Secret Manager, are handled only on our servers, and are never sent to a browser. Connected-service data is stored inside your organization’s boundary under the same access rules as the rest of your data, and is not sent to any language model.
Retention. Mirrored punch items, re-hosted attachment photos, and Procore identifiers are kept while the project is linked. They are deleted when you disconnect the integration, when an admin removes a project’s Procore data, or when you ask us to purge them. Unlinking a project on its own stops the mirror and hides it but does not delete it, so a re-link never loses history. Tokens are revoked at the provider and deleted the moment you disconnect. Sync and audit logs, which record what the integration did but contain no punch item content or tokens, are kept for 12 months. Drawings you import become your own project documents and follow the project, not the connection.
Requesting deletion. You can disconnect Procore or CompanyCam yourself at any time from Admin Settings, or remove the app from Procore’s App Management. To have us purge connected-service data for your organization or a single project, email hgibson@siteline.co from an address on your account. We acknowledge within two business days, confirm the requester’s authority, complete the deletion within 30 days, and confirm in writing what was removed. Deleted data may persist in access-restricted backups for up to 30 days before it ages out.
You may request access to, correction of, or deletion of your personal data by contacting us at hgibson@siteline.co. Organization admins can manage user accounts and data through the admin panel.
For privacy-related questions, contact us at hgibson@siteline.co.