Privacy policy
This document is a draft being reviewed by our legal advisers. If anything here matters to a decision you are making, please email sam@ec360.ae.
This policy explains what personal data Stone Max and this website handle, why, who else is involved, how long we keep it and what you can ask us to do. We have written it in plain words; if anything is unclear, email sam@ec360.ae.
Who is responsible
EC360 runs this website and the Stone Max service. For the website and demo requests, EC360 decides how your data is used (we are the "controller"). Inside Stone Max, the project data belongs to the contractor company that uses it — usually your employer. That company decides what is recorded, and we handle it on their behalf and on their instructions (we are their "processor").
What we collect and why
When you request a demo
Your name, company, role, country, email, phone number if you give it, which product interests you and your message. We use them only to arrange the demonstration and reply to you. Please do not send confidential project details through the form.
When you use Stone Max
- Account details your company enters: name, work email, role, job title, base, an optional WhatsApp number and the projects you work on.
- Your password — stored only as a one-way scrambled value (bcrypt); nobody, including us, can read it.
- What you record in the course of your work: diary entries, inspections, approvals, comments, documents and figures.
- An audit trail of each submission, approval, return and edit, with your name, role and the time. This is a core feature: it is how your company knows who did what.
- Security data: failed sign-in attempts and request counts with the IP address, to stop password guessing and abuse.
- Your acceptance of the Terms of Service and this policy: which version and when.
When you visit the website
Our hosting provider records routine server logs. Only if you accept on the cookie notice do we also measure visits and page speed anonymously (see Cookies).
Why we are allowed to use it
- To provide Stone Max under your company's contract with us, and to arrange a demonstration you asked for.
- To keep the service secure and the records accountable (a legitimate interest of your company and ours).
- With your consent, for optional anonymous measurement — you can withdraw it at any time.
- Where the law requires us to keep or share information.
We handle personal data in line with the data protection laws that apply, which may include Qatar's Law No. 13 of 2016 on the Protection of Personal Data Privacy, the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Saudi Arabia's Personal Data Protection Law and, where it applies, the EU General Data Protection Regulation.
What we do not do
- We do not sell personal data or use it for advertising.
- We do not send marketing emails. Stone Max only sends service emails: invitations, password resets and password-changed notices.
- We do not use your data, or your company's project data, to train AI models.
- We do not use tracking pixels, session recording or third-party fonts.
Who else handles it
We use a small number of providers to run the service. Each processes data only for the purpose below. The current list is always on the Subprocessors page.
| Company | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the website and the Stone Max application; delivering pages; server logs; optional anonymous analytics (only after you accept) | Application runs in Frankfurt, Germany; static files served from Vercel's global network; company based in the USA |
| Neon | The Stone Max database | Frankfurt, Germany (AWS eu-central-1) |
| Vercel Blob (Vercel Inc.) | Private storage for files uploaded to Stone Max, such as company logos | Frankfurt, Germany |
| Sentry (Functional Software Inc.) | Error alerts, so we can fix faults quickly | Germany (Sentry EU data region) |
| Resend | Sending service emails: invitations, password resets, password-changed notices and demo requests | USA |
Some providers are based outside your country. Where data leaves it, we rely on the safeguards the applicable law allows, such as the providers' data processing agreements.
How long we keep it
| Data | How long |
|---|---|
| Your account (name, work email, role, job title, base, WhatsApp number, projects) | While your account exists. When your company deletes your account it is removed; your name stays on records you signed, for accountability. |
| Project records your company enters (diaries, inspections, shipments, commercial records and so on) | While your company uses Stone Max. When the contract ends they are returned or deleted as agreed in it. |
| Audit trail (who did what, when, before and after, and the comment given) | As long as the project records it describes. It cannot be edited or removed by users. |
| Record of your acceptance of these terms (version and time) | As long as your account exists, as proof of what was agreed. |
| Security records (failed sign-ins and request counters, with IP address) | Up to 7 days, then deleted automatically. |
| Password reset and invitation links | Until used or expired, then deleted within a day. Only a scrambled fingerprint of the link is stored. |
| Demo requests | Not stored in Stone Max. Sent by email to EC360 and kept only as long as needed to arrange the demonstration and follow up. |
| Server logs (IP address, browser, page requested) | Kept by our hosting provider for a short period for security and troubleshooting. |
| Error reports (page, code location, internal account number — no names, emails or IP addresses) | Kept by Sentry for up to 90 days, then deleted. |
How we protect it
Encrypted connections (HTTPS) everywhere; each company's data kept separate; permissions per role checked on the server; contract values shown only to commercial roles; passwords stored scrambled; lockout after repeated failed sign-ins; single-use, expiring links for invitations and password resets; every other session signed out when a password changes; and an audit trail of changes.
Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to how it is used, to receive it in a portable form, and to withdraw consent you gave. Signed-in users can download their own data at any time from the side menu ("Download my data"). Because Stone Max records belong to your employer, requests about project records usually go to your company's Stone Max administrator first; you can also email us at sam@ec360.ae and we will reply within one month. You may also complain to the data protection authority in your country.
Children
Stone Max is a business tool for adults working for contractor companies. It is not meant for anyone under 18, and we do not knowingly collect their data.
Changes
If we change this policy in a way that matters, we update the date above, and signed-in users are asked to read and accept the new version before continuing.