Privacy Policy — A&A Time

Last updated: 10/14/2026

A&A Time is a project management and time-tracking platform maintained by Andrade & Alvares Soluções de Engenharia (the “Operator”) and used by customer companies (each, a “Company”) for their teams. This page explains what data the system processes and how.

1. Who is who

Each Company decides who accesses the system and which data it enters, and is responsible for that data towards its own staff. The Operator processes this data on the Company's behalf, only to provide the service. For Andrade & Alvares itself, the Operator and the Company are the same.

2. Who can use the system

Access is by invitation from the Operator or from the Company's administration: there is no public account sign-up. Each person has one account (e-mail and password) that may be linked to more than one Company; each Company's data is kept separate from the others.

3. What data we process

Account data: name, e-mail, job role and access role. Passwords are stored only as cryptographic hashes.
System usage data: logged hours, projects, tasks, comments, attached files, meetings, external guests and client contacts entered by the Company.
Access records: date and time of sign-ins and each person's last access, and the IP address of login attempts and platform administrative actions, for security and for the Company's management dashboard.
Trial requests: when someone requests a trial through the public form: company name, name, e-mail, phone (optional) and message (optional).
Google Calendar (optional): if you connect your Google account, we sync calendar events related to project meetings. You can disconnect at any time in your profile.
Notifications: if you enable notifications (browser or Android app), we use a device identifier to deliver them.
Cookies: we use only the session cookie required to keep you signed in; no advertising or tracking cookies.

4. How we use the data

Data is used to operate the system (time tracking, project management, reports and team communication), keep it secure and prevent abuse, send the service's own e-mails (invitations and password reset) and answer trial requests. We do not sell, rent or share data for advertising.

5. Service providers involved

Data may be processed by these services, strictly to enable functionality:

Hostinger — hosting of the database, files and application, and delivery of the system's e-mails.
Google — optional calendar sync.
OneSignal (when configured by the Company) — push notification delivery.
Artificial intelligence providers (Anthropic and/or OpenAI) — only when the Company enables the AI assistant: excerpts of task and project data are sent to generate answers.
Read.ai (when configured by the Company) — importing recorded meeting notes.

6. Separation between companies and security

Each Company's data is logically isolated from the others. Measures include: hashed passwords; encrypted integration keys; single-use, time-limited invitation and password-reset links; login attempt limits; a log of platform administrative actions; and technical administration access restricted to what is needed to run the service and provide support.

7. How long we keep data

A Company's data is kept while it uses the service.
The Company can download a full copy of its data (Settings → Your data) and ask the Operator for the permanent deletion of the company, which removes the data and files.
Access records: up to 13 months. Trial requests: up to 1 year. Login attempts: 24 hours.
Backups kept by the hosting provider follow its own policy.

8. Your rights

You may request confirmation of processing, access, correction, portability or deletion of your personal data under applicable data protection law. Make the request first to the administration of the Company you work for (it is responsible for the data); the Operator assists as needed through the contact below.

9. Contact

Questions about this policy can be sent to andradealvares.engenharia@gmail.com.