Privacy Policy

1. Information We Collect

We collect the following types of information when you use Resource:

• Account information — your name and email address when you create an account.
• Organization data — projects, staff, allocations, and other business data you enter into the platform.
• Usage data — pages visited and a defined set of product events (such as creating a project or adding staff). These are recorded against your user ID and email address so we can understand how accounts use the product. We do not capture the contents of the fields you type into.
• Error reports — when the application fails, we receive a diagnostic report tagged with your user ID and email address. If an error occurs we also receive a replay of the session that led to it, with all on-screen text masked and images blocked, so the recording shows the shape of the interaction rather than your data.
• Security and activity logs — each time you sign in, your IP address and browser user-agent are recorded, and we keep that record for 90 days. We also keep an audit trail of changes to your organization's records, which includes a before-and-after copy of the data that changed.
• Payment information — processed entirely by Stripe. We do not store credit card numbers or sensitive payment details on our servers.

2. How We Use Your Information

• To provide and maintain the Resource service.
• To communicate with you about your account.
• To improve the product based on usage patterns.
• To process subscription payments.
• To keep accounts secure — detecting and rate-limiting suspicious sign-in activity, and investigating problems you report to us.

3. Data Storage & Security

Your data is stored on Supabase infrastructure with encryption at rest (AES-256) and in transit (TLS 1.3). Row-level security policies ensure that users can only access data belonging to their own organization.

4. Access by Resource Staff

To provide support and investigate faults, Resource platform administrators can view data in a customer organization, and can temporarily obtain the same edit permissions as an account Owner. That elevated access requires typing the organization name to confirm, expires automatically after 15 minutes, and cannot be used to change billing, alter the audit trail, or delete an organization. Both the start and end of every such session are written to the audit log.

5. Third-Party Services

We use the following third-party services to operate Resource:

• Supabase — database hosting, authentication, and backend functions. Holds all of the data you enter into Resource.
• Vercel — frontend hosting, and cookieless analytics covering page traffic only.
• Stripe — payment processing. Stripe receives your billing and payment details directly; we receive only a customer and subscription reference.
• Resend — transactional email delivery, including invitations and the weekly staffing report, which contains staff names, project names and allocated hours.
• PostHog — product analytics (United States). Receives the usage data described in section 1, identified by user ID and email address.
• Sentry — error monitoring (United States). Receives the error reports and masked session replays described in section 1.

A full description of each of these — what they process, and where — is kept on our sub-processors page.

If your organization connects an external project or accounting system — such as Deltek or Microsoft Dynamics — Resource reads project and employee records from it on the schedule you configure, including billing rates. That connection is set up by your organization, and data flows only into Resource; we do not write back to those systems.

6. Data Retention

Account and organization data is retained while your account is active. When you delete your account or your organization, the records are removed from our live systems immediately. Encrypted infrastructure backups are kept on a rolling seven-day cycle, so any remaining copy is purged within seven days of deletion.

7. Your Rights

You can request access to, correction of, or deletion of your personal data by contacting support@resourceapp.co.

8. Cookies & Local Storage

We use essential cookies for authentication and session management. Vercel Analytics collects page traffic without cookies. PostHog stores an identifier in your browser's local storage so repeat visits can be recognised as the same user. We do not use advertising or cross-site tracking cookies.

9. Changes to This Policy

We may update this policy from time to time. Updates will be posted on this page with a revised "last updated" date.

10. Contact

Questions about this policy? Email support@resourceapp.co.