Privacy policy

1. Who we are

WerfHero is an app for groundworks contractors, made by MSE GROUP. The controller for the processing of the data described in this policy is:

MSE Solutions BV (MSE GROUP)
Ledehof 3, 9160 Lokeren, Belgium
Company number: BE 0792.333.414
Email: privacy@werfhero.be

This policy applies to the WerfHero app (iPhone, iPad and Android), the Apple Watch app, the admin panel app.werfhero.be, the server behind the app, the website werfhero.be and the support chat on that website.

2. Which data the WerfHero server processes

Our server only processes the data needed to make accounts, crews, messages, check-ins on site, legal obligations, app updates and subscriptions work:

Data	Purpose	Legal basis
Email address and name	Creating your account, letting you sign in with a code by email, recognising you in your crew.	Performance of the contract
Company, memberships and invitations	Knowing which company you belong to, which role you have, which crews you are in, which sites you have access to and how many seats your company uses. For an invitation: the email address and, if given, the name of the person invited. Crews: the name of each crew, which accounts and sites belong to it, and the names and job titles of staff without an account that the admin adds (for example for the daily report).	Performance of the contract
Microsoft account	If you sign in with your Microsoft work account, we keep the id of that account and of your company’s Microsoft 365 environment, to recognise you and link you to the right company. The access key for Microsoft stays on your device.	Performance of the contract
Chat messages	Storing and delivering messages in crew conversations and one-to-one conversations. An attachment is only a link to the file in your Microsoft 365. If you share your location in a conversation yourself, it is stored as a message (see section 4).	Performance of the contract
Check-ins on site	Showing who is checked in on which site (Who’s where): who, which site (id, name and address) and the start and end time. See section 5.	Performance of the contract
Legal obligations	Documents a crew must be able to show on site (insurance, VCA, registration, certificates), uploaded by your company’s admin, with title, type and expiry date. These files (PDF or photo) are stored on our server, not in your Microsoft 365.	Performance of the contract
Push tokens	Sending you a notification on your device, for example for a new message.	Performance of the contract; you can switch notifications off in your device settings
Subscription	Your company’s plan, the number of users, the status and end date of the subscription and the customer id at our payment provider Stripe. Payment happens at Stripe: card and bank details never reach our server.	Performance of the contract; legal obligation (accounting)
Partner card	Per partner and per day, only how many times the card was shown and tapped. Never who saw or tapped it.	Legitimate interest (measuring the reach of the partner card)
Demo account	To open the app demo, you first enter an email address (required) and, if you like, a name, company name and mobile number (optional). We also keep the language, the type of device (iOS or Android), the app version, whether you want news and tips, and how you use the demo: when you open it, which main screens you view and how often, roughly how long, and whether you finish the guided tour. Purpose: WerfHero (MSE Solutions BV) contacts you one-to-one to ask what you liked and what you didn’t, to help you and to improve the app. To do so, we look at your use of the demo, check whether you have since become a customer (based on your email address or its domain) and keep notes of our conversations. We contact you by email, by phone or, if you entered a mobile number, via WhatsApp (WhatsApp, a Meta service, then processes your number and the message). You get one welcome email. We only send news and tips if you tick that box and confirm it via the link we will then email you. We don’t sell this data or share it with anyone else.	Legitimate interest (following up people who open the demo, improving the app); news and tips: your consent
Technical data	Sign-in codes and sessions, which we only store in unreadable form (as a hash). The server only uses IP addresses briefly, in working memory, to prevent abuse such as too many sign-in attempts. They are not stored in the database. When checking for app updates, the app sends a random installation number. The server only uses it to roll out an update to part of the devices first. The server’s technical log, which is overwritten automatically, only keeps the start of that number, without an IP address.	Legitimate interest (security)
Change log	Changes that WerfHero itself makes to your company’s account, such as plan, trial period or seats, with the date and who made them.	Legitimate interest (follow-up and proof)
Admin log	What your company’s admins change in WerfHero: inviting or removing members, roles, site access, settings, crews, staff and deleted documents, with the date and who did it. For an invitation also the email address; staff names are not included.	Legitimate interest (security and proof)

We don’t sell data, don’t work with ad networks or an advertising ID, and don’t make automated decisions about you. We don’t build advertising profiles. Only for people who open the demo do we look, per person, at how the demo was used, so we can follow up with you personally (see Demo account). In some plans, the app shows one small card from a partner company on Home (and at the bottom of More), for example MSE Tools, a related company. That is advertising. We only count how many times a day a partner card is shown and tapped, never who saw or tapped it. Tap the cross to hide the card for three days.

3. Photos, PDFs and documents

Files such as site photos, daily reports, KLIP plans, “utility locations” PDFs and company documents are stored in your own company’s Microsoft 365 (OneDrive or SharePoint). The app sends them straight from your device to Microsoft. They never reach the WerfHero servers. Exception: the documents under Legal obligations (see section 2). In the demo of the app, photos and documents stay on your device. For the demo itself we do ask for an email address (see Demo account).

If there is no signal, a file stays in a queue on your device until it has been sent. For the files in your Microsoft 365, the agreements between your company and Microsoft apply. Your company decides who has access to them and how long they are kept.

4. Location, camera and weather

• Location is used on your device: to show the distance to your sites, to show the nearest site (for example when you check in), to see which site you are on and to add GPS coordinates to photos, Complaints & damage and pipes. Your location is not sent to the WerfHero server and we don’t track you. If you share your location in a conversation yourself (Location button), those coordinates go to our server as a message, like any other message. The GPS data of a photo is in the file itself, in your Microsoft 365. The app only uses your location while it is open, never in the background.
• Weather: for the weather forecast in the planning and the daily report, the app gets the weather from Open-Meteo, using the coordinates of the site. If a site has no coordinates, the daily report uses your device’s position instead. Open-Meteo only receives the position rounded, to within about a kilometre, and also sees your device’s IP address.
• Emergency screen: under SOS, the app shows your position so you can pass it on to the emergency services or share it yourself. It is not sent to WerfHero.
• Route: if you tap the route to a site, Waze, Google Maps or Apple Maps opens with the address of the site. Those apps have their own privacy rules.
• Camera and photo library are only used when you take or choose a photo.
• You can withdraw these permissions at any time in your device settings. Some features will then no longer work fully.

5. Checking in and out on site (Who’s where)

When someone arrives on site, they tap “Check in”. When the work is done, they tap “Check out”. For each check-in we store on our server:

• who checked in (your account);
• the site: the id, the name and the address of the site;
• the start time and the end time. If you forget to check out, the server closes the check-in after 14 hours.

Apart from you, only your company’s admin can see this data, in the Who’s where overview: who is checked in on which site right now, since when, and who has already left today. We keep the check-ins until your account or your company’s account is deleted.

WerfHero doesn’t track anyone with GPS. We don’t store any position or route, only the site you check in on yourself. Your device’s location is only used on the device itself to show the nearest site, and is not sent to WerfHero.

Checkinatwork. The app reminds you to register yourself in Checkinatwork and links to the official Belgian social security site (RSZ). You register there yourself. WerfHero sends nothing to the RSZ and keeps nothing about your registration.

The Apple Watch app uses the same data to check you in or out and to show Who’s where. It doesn’t collect anything extra.

6. Where the data is stored and who we work with

The WerfHero server runs in the European Union, at Hetzner in Germany. We work with the following service providers (processors):

Service	Purpose	Location
Hetzner Online GmbH	The server, the database and the backups of WerfHero: accounts, companies, crews and staff, seats, chat messages, check-ins on site, Legal obligations documents and demo accounts	Germany (EU)
Brevo	Sending emails: your sign-in code, invitations, the demo welcome email and support chat conversations that go to our customer service	EU
OVHcloud	Domain names, DNS and the WerfHero mailboxes, such as support@werfhero.be	France (EU)
Stripe	Payments, invoices and the customer portal for subscriptions	EU and US (with appropriate safeguards)
Anthropic	The answers of the support chat on werfhero.be (AI model Claude). See section 10.	US (with appropriate safeguards)
Expo, Apple and Google	Delivering push notifications to your device	US (with appropriate safeguards)
Open-Meteo	The weather forecast for the site, in the planning and the daily report	Switzerland
Google Fonts	The typeface of werfhero.be and app.werfhero.be	US (with appropriate safeguards)
Your company’s Microsoft 365	Photos and documents, in your company’s own OneDrive or SharePoint. They never reach the WerfHero servers. Here Microsoft works for your company, not for WerfHero.	According to your company’s contract with Microsoft

When data is processed outside the EU, this is based on the appropriate safeguards of the GDPR, such as the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. For Switzerland, the European Commission has decided that the level of protection is adequate.

For part of their processing, some services are controllers themselves, for example Stripe for fraud prevention and legal checks, and Apple and Google for the App Store and Google Play. Their own privacy policies apply to that.

7. How long we keep data

• Account, company and membership data: as long as your account and your company’s account exist.
• If you delete your account (in the app via More › Profile & settings › Delete account, or on request via support@werfhero.be), we erase your account, your memberships, your check-ins and your push tokens from our server. Messages you sent in a conversation of your company stay in that conversation, without your name.
• If your company stops using WerfHero, the admin can have the company account deleted via support@werfhero.be. The company’s crews, staff, messages, check-ins and Legal obligations documents are then deleted too.
• Deleted data also disappears from the backups within 30 days.
• Check-ins on site: until your account or your company’s account is deleted.
• Staff and Legal obligations documents: until the admin deletes them or your company’s account is deleted.
• Partner card statistics: only counts per day, with no personal data.
• Demo account: up to 12 months after you last used the demo, then erased automatically. You can delete it sooner in the app (More › Profile & settings › Delete account) or via privacy@werfhero.be. It disappears from the backups within 30 days.
• Sign-in codes: valid for 10 minutes, then erased within a day. Sessions: until you sign out or until they have not been used for 90 days.
• Push tokens: until you sign out or until your device makes them invalid.
• Support chat: our server doesn’t keep the conversations. Conversations that go to our customer service and contact details you leave, we keep in our mailbox for as long as needed to follow up your question.
• Invoices and payment data: as long as accounting law requires.
• Log of changes that WerfHero itself makes to your company’s account: 2 years.
• Log of what your company’s admins change: 2 years.

8. Company and employees

WerfHero is used by companies. For the data your company manages in the app, such as who is in which crew and who is checked in on which site, your employer is the controller and WerfHero acts as processor. A data processing agreement is available on request via privacy@werfhero.be. If you work for a company that uses WerfHero, you can also go to your employer with questions.

For the website, the support chat, demo accounts and invoicing your company, MSE Solutions BV itself is the controller.

WerfHero is not intended for people under 16.

9. Website and admin panel

werfhero.be and app.werfhero.be don’t use tracking or advertising cookies. In your browser we only store what is needed: your language choice, your sign-in session in the admin panel and the ongoing conversation with the support chat (only in that tab). The typeface is loaded via Google Fonts, which passes your IP address to Google.

If you fill in the “Free trial” form, we only use your company name and email address to send you a sign-in code, create your account and email you about your free trial.

10. Support chat

On werfhero.be you can ask questions in the support chat. The answers are created automatically by Claude, an AI model from Anthropic, based on the information on our website. They may contain mistakes.

• What you type in the chat goes, together with the language of the page, via our server to Anthropic to create an answer. Our server doesn’t keep the conversations. To limit abuse and costs, the server only briefly counts, in working memory, how many questions come from each IP address.
• If the chat can’t solve your question, or you want to talk to a person, we send the conversation by email to our customer service, so that we can follow it up. If you leave your email address or mobile number, it is sent along, only to contact you.
• Under its terms for business customers, Anthropic doesn’t use these conversations to train its AI models.
• Don’t type sensitive data in the chat, such as passwords, sign-in codes or payment details.

Legal basis: our legitimate interest in answering questions about WerfHero quickly. For contact details you leave: your request to be contacted.

11. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• see your data and get a copy;
• have incorrect data corrected;
• have your data erased (see also delete your account);
• have the processing restricted;
• receive your data in a common format to take it elsewhere;
• object to processing based on legitimate interest;
• withdraw your consent (for example for news and tips) at any time.

Send your request to privacy@werfhero.be. We answer within one month. If you are not satisfied, you can file a complaint with the Belgian Data Protection Authority, Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

12. Contact and changes

Questions about privacy? Email privacy@werfhero.be. If we change this policy, we put the new version on this page. For important changes we also let you know in the app or by email.