Privacy Policy

Last updated: 24 August 2026

Autodocs is a construction document control platform operated by Goodwill of Work Company Limited. This policy covers the Autodocs web application (app.autodocs.work), the AutoDocs Defects mobile app, and this website (web.autodocs.work). The personal data protection notice published inside the platform is the authoritative record — it carries the lawful basis, the record of processing activities and the sub-processor register that our data processing agreements refer to. Where the two ever differ, that one governs.

Data we collect

• Account information — your name, email address and hashed password, and the companies and project roles your account belongs to.
• Project content you create — documents, defect reports (description, priority, location, assigned company, due dates, pin positions on drawings) and related records.
• Photos — site photos you capture or attach, stored on Google Cloud Storage.
• Location — one GPS fix is attached to a defect photo at the moment of capture (geotag). Location permission is optional; if you decline, everything else still works.
• Microphone — voice-to-text uses your device’s speech recognition. Audio is not recorded or uploaded to our servers; only the resulting text enters the defect description.
• Push token — a Firebase Cloud Messaging device token used to deliver notifications. It is deleted automatically once the device stops accepting notifications, and removed with your account when you delete it.
• Website analytics — this marketing site uses Google Tag Manager subject to the cookie consent banner. The web and mobile apps themselves contain no advertising or analytics SDKs.

Signing in with Google, Microsoft or LINE

Where your organisation has enabled it, you can sign in with a Google, Microsoft or LINE account. We receive only what identifies you: your name, email address and profile picture from Google or Microsoft, and — because LINE does not give us an email address — a LINE user id. That data is used solely to authenticate you and match you to your Autodocs account. It is never sold, never shared for marketing, never used for advertising, and never used to build a profile of you. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google account permissions, your Microsoft account or your LINE account settings, and you can always sign in with an email address and password instead.

How we use data

Solely to operate the service: managing project documents, delivering notifications you and your project team rely on, and providing support. We show no advertising and we never sell personal data.

Who we share it with

Only with the providers that run the service on our behalf. Six sub-processors are used, each covered by a data processing agreement: Vercel (application hosting and AI Gateway transport), OpenAI (language-model inference, reached through the AI Gateway, with redacted prompts and only for projects that have opted in), Google Cloud Storage (files and generated documents), Neon (the PostgreSQL database), Resend (transactional email) and Railway (the legacy MySQL source read by the synchronisation job). Each is risk-assessed before it is engaged and reviewed annually, and we give written notice at least 30 days before engaging or replacing one. The mobile app additionally hands your push token to Firebase Cloud Messaging to deliver notifications. Your project data is also visible to the members of your own projects according to the permissions your project administrators configure. No data is shared with third parties for marketing.

Naming companies that use Autodocs

We may name a company as an Autodocs user in our own marketing — its name, its logo and the kind of work it carries out — but only where that company has given us written permission, or where its subscription agreement with us allows it. We never publish project names, who works with whom on a project, or the content of any document. Permission can be withdrawn at any time by writing to support@goodwill.work, and we take the reference down at the next update of the site.

Cookies

The apps set a session cookie to keep you signed in and a small preference cookie to remember your language. This marketing website additionally loads Google Tag Manager, Google Analytics and Google Ads — but only after you accept them in the cookie banner. The banner runs on Google Consent Mode: until you consent, those tags are blocked from storing anything. You can change or take back that choice at any time by clearing this site’s cookies in your browser, and the banner will ask again. The web and mobile apps themselves carry no advertising or analytics SDKs.

Retention and deleting your account

You can delete your account yourself in the app (Account → Security → Delete my account). Sign-in is blocked immediately, a 30-day window lets you cancel by email link, and after the window your contact details and credentials — email, phone number, password, linked Google/Microsoft sign-in, profile photo, signatures and push tokens — are permanently erased. Your name remains on the project documents you authored: they are part of the construction record and must keep showing who recorded them. Full instructions are on the account deletion page.

Security

All traffic is encrypted in transit (HTTPS). Access to project data is scoped per project and per role, and file downloads use short-lived signed URLs.

Your rights

Under Thailand’s Personal Data Protection Act B.E. 2562 (2019) you may ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong or incomplete;
• delete it, or restrict how we process it;
• transfer it to another provider;
• object to a particular use, or withdraw consent you gave earlier.

One thing to know first: the project records inside a workspace belong to the company that owns it, and its administrators decide who may see or change them. For those records, start with your own administrator — we act on that company’s instructions. For anything about your personal account, write to us and we will answer within 30 days. If you think we have handled a request badly, you may complain to the Personal Data Protection Committee (PDPC).

Children’s privacy

Autodocs is a tool for construction professionals and is not directed at children. We do not knowingly collect personal data from children; if you believe a child has given us data, tell us and we will delete it.

Contact

Questions about this policy or your data: support@goodwill.work. We may update this policy from time to time; the date above reflects the latest revision.