1. About this Ondera Privacy Policy
1.1 This Ondera Privacy Policy ("Ondera Policy") is the Product Privacy Policy for Ondera. It supplements the Good Systems Privacy Policy available at goodsystems.com/privacy-policy (the "Good Systems Policy") and should be read together with it. The Good Systems Policy describes how Good Systems, Inc. ("we", "our" or "us") processes your Personal Data across all of our Products, including your rights, international transfers, security, cookies and how to contact us. This Ondera Policy describes only the additional processing that takes place when you use Ondera and the points on which Ondera differs from the Good Systems Policy.
1.2 Where this Ondera Policy deviates from the Good Systems Policy, this Ondera Policy prevails in respect of Ondera. Everything not addressed in this Ondera Policy is governed by the Good Systems Policy. Capitalised terms not defined in this Ondera Policy have the meaning given to them in the Good Systems Policy.
1.3 Good Systems, Inc., 251 Little Falls Drive, Wilmington, Delaware 19808, County of New Castle, United States, is the controller of your Personal Data in connection with Ondera. As described in the Good Systems Policy's provisions on the Goodnotes Account (GNA) infrastructure, Goodnotes Limited provides authentication and account infrastructure services in connection with Ondera and acts as a processor on behalf of Good Systems for that limited purpose; the documents, drawings, photos, annotations, comments, tasks and other content you create or import in Ondera are processed separately by Good Systems and are not shared with Goodnotes Limited.
2. Service Description
Ondera provides collaborative review and markup tools for professionals, including architects, engineers and construction professionals. It allows you to import documents, drawings and other files (such as PDFs), to annotate and mark them up, to create design reviews, punch lists, inspection reports and whiteboards, to capture photos and notes on site, to add comments, to convert feedback into tasks and track their status, and to share your work with other people and collaborate with them on it. To provide these features we process Personal Data including your name, email address and login details, the content you import into or create in Ondera (and any Personal Data it contains), and the contact details of the people you share your work with (only where you instruct us to do so).
Ondera may allow you to import content from, or export content to, third-party services such as cloud storage providers. Ondera accesses only the content you choose to import or export and does not otherwise access, collect or process data from those third-party services.
You must sign in with a Good Systems Account to create, import or edit content in Ondera. A person you share a document with can view that shared document without creating a Good Systems Account. Your User Content is synced and stored on our servers as described in the Good Systems Policy.
3. Additional Personal Data we collect when you use Ondera
In addition to the Personal Data described in the Good Systems Policy, when you use Ondera we collect and process:
3.1 User Content: the documents, drawings, PDFs, photos and other files you import into Ondera; the annotations, comments, notes and tasks you create; the edit history of your documents; and the suggested tasks and other outputs generated by Ondera AI features (together, "User Content", as defined in the Ondera Product Terms). User Content may contain Personal Data relating to you and other individuals, for example the names, addresses and business information that appear in drawings, plans, specifications and contracts, and the images of people, vehicles or property captured in photos taken on site.
3.2 Sharing and collaboration data: the names and email addresses of the people you invite to collaborate on a document or share a link with, the permissions you give them, and a record of the actions that you and your collaborators take within a shared document (such as annotations, comments, edits and changes to task status), which are attributed to the person who made them.
3.3 Third-party integration data: if you choose to connect a third-party service (such as a cloud storage provider) to Ondera, the content you select to import from or export to that service and the account identifiers needed to maintain the connection. Before we access any data from a third-party service, you will be asked to log in to your account with that service and give your consent. We use third-party integration data solely to provide the features you have requested, do not use it for advertising, do not sell it, and do not use it to create, train or improve any artificial intelligence or machine learning models.
3.4 Diagnostic data for support: for certain support requests, we may ask you to export and send us diagnostic data from Ondera, which may include details of your documents, usage history and tasks where necessary to diagnose and resolve the issue.
3.5 We will not access or collect data (including any Personal Data) from your User Content without your consent, other than the automated processing necessary to provide the Ondera features you use as described in this Ondera Policy.
4. How we use Ondera data and our legal bases
The purposes and legal bases set out in the Good Systems Policy apply to Ondera. The following rows supplement that table with the Ondera-specific processing.
| Why and how we process your information | Types of Personal Data Used | Legal basis relied upon |
|---|---|---|
| To allow you to use and access the features and functionality provided by Ondera, including importing and storing your documents and photos, annotating and marking them up, creating comments and tasks, sharing documents and collaborating with other people, maintaining edit history, generating suggested tasks using Ondera AI features, and connecting third-party services you choose to connect. | Personal identifiers and contact information of you and of the people you share your work with. User Content (documents, drawings, photos, annotations, comments, tasks and AI-generated suggested tasks). Sharing and collaboration data. Third-party integration data, where you choose to connect a third-party service. Diagnostic data. Any Personal Data of other people contained in the documents, photos and other content you import or create. Any information that you tell us or a Good Systems staff member. | Legitimate interests, namely it is in our interests and your interests for us to provide Ondera to you, including storing and displaying the content you add to it and generating suggested tasks from the photos you add to a punch list. We will rely on consent if we deem that this is required in the context of a specific feature (including your consent before we access any third-party service you choose to connect). You can turn Ondera AI features off at any time in your settings. It is your responsibility to ensure that you have a lawful basis, and where required the consent of the people concerned, for including other people's Personal Data in the content you import into or create in Ondera, including people captured in photos taken on site. |
| Where you have given your explicit opt-in consent, to help us provide and improve the quality and design of Ondera AI features including by training the AI model that powers the Ondera AI features, and carrying out analytics to better understand queries/prompts from different types of users and to troubleshoot issues. | Any feedback that you provide to us in relation to or when using the Ondera AI features, including whether you accept or reject a suggested task. Usage histories and logs of your interactions with us when using the Ondera AI features. Photos, annotations and suggested tasks (together with related usage metadata) that you create using the Ondera AI features, including their content. Any Inputs that you submit into and any Outputs generated by the Ondera AI features. | We will obtain your explicit opt-in consent to collect, use, store, and otherwise process personal data relating to your use of the Ondera AI features for these purposes (to the extent this is required by applicable data protection legislation). Where we have not obtained your consent, your User Content is processed by Ondera AI features solely to provide the relevant feature to you, as described in Section 5. |
5. Ondera AI features
5.1 Ondera uses artificial intelligence and machine learning models to provide certain features, such as generating suggested tasks from the photos and annotations you add to a punch list, and may use them to provide further features in future ("Ondera AI features"). This Section 5 describes how Ondera AI features process your content, supplementing the Good Systems Policy.
5.2 Ondera AI features process your content, including photos, annotations and notes, to generate the relevant output (such as a suggested task) and are not used for any other purpose. Where an Ondera AI feature relies on a third-party provider to process your content, that provider acts as our processor and processes your content only for the purpose of providing the feature to you. Up-to-date information on the providers we use is set out in Section 7.2.
5.3 You remain in control of Ondera AI features. Ondera tells you in the product when an Ondera AI feature is being used to generate a suggested output, that output is labelled as AI generated, and you can accept, edit or reject it. You can turn Ondera AI features off at any time in your Ondera settings, in which case your content is not sent to any AI provider for that purpose.
5.4 We will only use your User Content, Inputs or Outputs to train or improve AI models where you have given your explicit opt-in consent as described in Section 4. We may offer you the opportunity to give such consent in the future; if we do, we will explain what your consent covers at the time and you will be free to decline or to withdraw your consent later.
6. Other people's Personal Data
6.1 The documents, drawings and photos you import into or create in Ondera may contain Personal Data about other people, such as your colleagues, clients, contractors and the owners or occupiers of a site, and people who happen to be captured in photos taken on site. Ondera does not notify, or seek consent from, those people. You are solely responsible for ensuring that you have a lawful basis for including their Personal Data in your User Content and for sharing it with your collaborators, including obtaining any consent and giving any notice required under applicable law and under your obligations to your clients or employer. Personal Data relating to other people will be processed in accordance with this Ondera Policy and the Good Systems Policy, including its provisions on information you give us about other people.
6.2 When you invite someone to collaborate on a document, we process their name and email address to send the invitation and to identify their contributions within the shared document. Collaborators who sign in to Ondera are also Ondera users and this Ondera Policy applies to them directly.
6.3 If you are not an Ondera user but your Personal Data appears in content created by an Ondera user, and you have questions about how your Personal Data is processed, you may contact us using the details in Section 9. Please note that the Ondera user who created or imported the content controls that content within their account.
8. Retention of Ondera data
8.1 The Good Systems Policy sets out the criteria we use to determine how long we keep Personal Data. In addition, for Ondera:
User Content, including AI-generated suggested tasks, is retained until you delete it through Ondera or your Good Systems Account is closed, after which it is deleted in accordance with the Good Systems General Terms & Conditions;
content you submit to an Ondera AI feature is retained by the relevant AI provider only temporarily as described in Section 5 and is not retained by that provider after that period;
sharing and collaboration data is retained for as long as the relevant document is shared and the related edit history is kept; a share link stops working when you withdraw it; and
content that you have shared with other people, and any copies they have exported, may remain available to them after you delete it or close your account.
9. Contact and complaints
9.1 For questions about this Ondera Policy or about how Ondera processes your Personal Data, you can contact us at support@ondera.co. You may also use any of the contact details, including those of our Data Protection Officer and our UK representative, set out in the Good Systems Policy.
9.2 Your rights in relation to your Personal Data, and how to exercise them, are described in the Good Systems Policy. You may exercise some of your rights (for example, deleting your User Content, withdrawing a share link or turning off Ondera AI features) directly within Ondera.
10. Changes to this Ondera Policy
We may update this Ondera Policy from time to time, in particular where we change the way Ondera AI features process your data, the AI providers we use or the infrastructure we use. Changes will be notified in accordance with the Good Systems Policy.
Website analytics
When entry measurement is enabled, this website sends a limited homepage arrival event with the entry time and known email campaign labels to our existing Good Systems analytics service before analytics acceptance, to improve this website. It excludes browser and session identifiers, saved attribution, account links and browsing history, and is intended for daily totals in ClickHouse. The existing Decline and Analytics settings controls stop future requests, including saved declines and withdrawal. Changing your choice cannot recall events already received. See the Cookie policy.
After you accept analytics, Good Systems analytics sends page visits, approved app-link selections and valid campaign labels from home, support, privacy, terms and cookies to our shared analytics service. FAQ changes and related-product link measurement stay on the homepage. It uses random browser and tab identifiers. The service may add geographic and network information. These consented page views overlap entry counts and are reported separately.
Google analytics stays disabled on the preview website. When enabled on the production website, Google Analytics receives visits and approved app-link selections on home, support, privacy and terms after your consent and can use analytics cookies. FAQ changes and related-product link measurement stay on the homepage. When cookieless entry measurement is enabled, Google also receives individual homepage visit and consent pings before you choose, with analytics and advertising storage denied. These may include network and browser information and a temporary page-load number. We supply only known campaign labels from the current URL, without saved attribution, and request no analytics cookie access before acceptance. Decline stops future Google collection too. The banner explains which entry measurement is enabled. We do not send Good Systems browser or session identifiers, account IDs, email addresses or private URL query values to Google. We use no advertising tags.
The banner and Analytics settings name the providers enabled for your visit. Saved acceptance applies only to the providers named when you accept. We ask for a new choice before adding another provider. Old version 2 acceptance requires a fresh choice for this measurement. A saved decline continues to keep analytics off. Use Analytics settings to withdraw consent. We stop collection, clear this website's analytics storage and configured Google cookies, and reload the page. Withdrawal does not delete data already received by either service. Website link selections measure intent. They do not confirm signup in the app.
After consent, this website saves valid campaign labels in local storage for up to 30 days with either enabled analytics provider. This website storage is separate from Google cookies and server retention. See the Cookie policy for browser storage, lifetimes and your choices. The Google cookies have a 90-day lifetime, renewed on later consented visits. Your browser can shorten this lifetime. A Google event retention period does not apply to all aggregated reports. The Good Systems Policy states the criteria for retention of Personal Data.
With your acceptance of Good Systems analytics, we record visits and approved app-link selections on home, support, privacy, terms and cookies. We retain the entry page, entry time and referring website origin during internal navigation, reload and history traversal. A later external entry updates that context without changing the funnel identifier. Referring paths, queries and fragments are excluded. Without usable external referrer evidence, the entry source is direct or unknown, independently of saved campaign labels. Google receives none of these entry fields.
Website-to-app measurement
Website-to-app measurement requires an enabled handoff release and your explicit version 3 acceptance of Good Systems analytics. Old version 2 acceptance cannot authorize it. A saved decline keeps analytics off.
When the handoff is enabled, and with your version 3 acceptance of Good Systems analytics, we add a random funnel identifier and a click identifier to approved links to the Ondera web app. They will retain the entry page, selected button or link, valid campaign labels, and the referring website origin. We will exclude referring paths, query strings, and fragments. This lets us connect a website journey with app arrival and a verified sign-in. A verified sign-in can link this journey to your app account. With a verified recent registration, the app can also record a signup observation using the original registration time. A sign-in alone does not prove that you created an account.
The funnel identifier will stay in tab session storage until the tab closes or analytics storage is cleared, including when you withdraw consent. Each app-link selection will allow up to 24 hours to connect its app arrival and verified sign-in. Reloads and sign-in will not extend that selection's window. Browser tabs can copy session storage when they open. We will preserve the entry page and referring website origin during internal navigation and reload, and update them on a later external entry in the same tab. If no usable external referrer is available, the entry source will be direct or unknown. Saved campaign labels will keep their separate limit of up to 30 days. A campaign change will not change the funnel identifier or entry source. Google analytics will receive none of these new identifiers or app account information.
Before acceptance or after decline, app links can still pass valid campaign labels from the current URL. This does not save website analytics data or send a website event. Turning website analytics off will stop future website collection and identifier forwarding and clear this website's analytics storage. It cannot recall a link already opened in the app or delete records already received. The app has separate measurement controls. Website consent does not grant app permission. App opt-out takes precedence.