Back to home
PRIVACY AND DATA

Privacy Policy

This policy explains what information CronoGantt processes, for what purposes, who may be involved and how you can exercise your rights.

Version 2026-10-07.1. Last updated: October 7, 2026, revision 1

1. Controller and scope

CronoGantt is responsible for the processing described in this policy. The contact channel for questions and requests related to personal data is contacto@cronogantt.com.

This policy applies to the public website, registration, sign-in and use of the CronoGantt application. It also covers information an organization manages within its workspaces.

2. Information we process

Depending on how you use the service, we may process the following categories:

  • Account and identity data, such as verified email address, name, profile photo and authentication identifiers.
  • Organization and membership data, such as workspace name, members, roles, permissions and invitations.
  • Operational content uploaded by users, such as projects, tasks, teams, dates, files, photos, settings and history.
  • Technical and security data, such as IP address, browser, device, access dates, session events, errors and records needed to protect and operate the service.
  • Billing data, such as payer email, opaque subscription, payment and request identifiers, plan, amount, currency, billing country, taxes, payment status and renewal, cancellation or grace-period dates. CronoGantt does not receive or store full card numbers or card security codes.
  • Legal records associated with creating a workspace, such as the accepting account’s email and identifier, the relevant workspace, date, method, and versions and references of the documents presented.
  • Communication data, such as sender, recipient, subject, content and delivery metadata of emails we receive or send for inquiries, support, exercise of rights, or operational and legal service notices.
  • Data stored in the browser to maintain sessions and essential functionality. Kiosk mode uses IndexedDB to keep a sanitized local snapshot of projects, tasks, teams and schedules during connection outages of up to 72 hours. If the device remains offline, revocation cannot erase that copy; the workspace owner must clear the browser profile when retiring or reassigning the device.

3. How we obtain information

We receive information directly from you when you register or use the service, from the organization that invites you or manages your access, and from authentication providers when you choose to sign in with them. If the owner subscribes to Pro, we also receive the identifiers and statuses needed to verify and reconcile the subscription and its payments from the relevant payment provider (Mercado Pago or, where enabled, Paddle).

4. How we use information

  • Create, link, authenticate and manage accounts.
  • Create workspaces and apply roles and permissions.
  • Provide planning, execution and collaboration features.
  • Store, display and back up content requested by users.
  • Protect the service, prevent abuse and investigate incidents.
  • Start and manage subscriptions, verify payments, apply grace periods, process cancellations and coordinate refunds or receipts.
  • Respond to inquiries, support requests and personal data requests.
  • Send operational and legal notices necessary to provide the service.
  • Document acceptance of the Terms and acknowledgment of the Privacy Policy associated with creating each workspace.
  • Measure application and public website usage, detect operational problems and monitor consumption of contracted services.
  • Meet applicable obligations and exercise or defend rights.

5. Signing in with Google

If you choose to continue with Google, Google may provide your verified email address, name and profile photo. We use that information to authenticate you, create or link your account and display your identity within CronoGantt.

  • We do not request access to Gmail, Google Drive, Google Calendar, contacts or other Google products.
  • CronoGantt does not receive or store the Google access or refresh tokens used by the authentication infrastructure.
  • Use of information received from Google is limited to the authentication and account management described in this policy.

You can read the Google Privacy Policy.

6. Providers and recipients

We do not sell personal data. We share only the necessary information with providers that help deliver the service:

  • WorkOS: registration, authentication, sessions, identity, organizations, memberships and invitations.
  • Google: identity provider when you choose that sign-in method.
  • Convex: application database, backend functions and storage.
  • Cloudflare: hosting, site delivery, protection of public infrastructure, approximate detection of the connection’s country, contact email routing and delivery of service notices.
  • Resend: delivery of operational and support emails and legal notices. It processes email addresses, subject, content and metadata needed to manage delivery. You can read its Privacy Policy.
  • Mercado Pago: hosted checkout, payment methods, recurring subscriptions, renewals, cancellations and status notifications. Its processing is also governed by the Mercado Pago Privacy Statement.
  • Paddle: where international subscriptions are enabled, it acts as Merchant of Record, processes payments and subscriptions, administers sales taxes and issues receipts. It receives the billing details needed for those functions and communicates transaction amounts, currencies, identifiers and statuses to CronoGantt. You can read its Privacy Policy.

Content may also be visible to authorized members of your organization according to their roles and permissions. We may disclose information where a valid legal obligation exists or where necessary to protect rights, security or the integrity of the service.

7. International transfers

The providers listed may process or store information outside Argentina. In those cases, we seek to use providers that offer appropriate contractual, technical and organizational measures to protect data according to the nature of the processing.

8. Retention, closure and deletion

We retain operational data while the workspace is active. When requesting closure, the owner may expressly authorize retention for one calendar year after effective closure so it can be recovered. We record the date, text version and authorization. The app displays the deletion date and time. Alternatively, the owner may request permanent deletion without waiting for that year.

During retention, only the owner can reopen the workspace, download a free ZIP containing documented data and original files, or request deletion. The downloadable copy excludes credentials, keys and sessions, requires authentication, and expires after 24 hours. A Pro subscription is not required to download it. Invited members cannot export or delete the whole workspace.

When the year expires, or a verified early-deletion request is executed, we delete operational data, files, exports and monitoring records associated with the workspace. We keep a minimal technical deletion receipt without its name, email or content to prevent accidental reconstruction. Deleting a workspace does not delete personal accounts or affect other workspaces.

Early-deletion requests receive priority review, with a target resolution within five business days and no required 30-day notice. Requests about a member’s personal data are handled according to their scope and do not by themselves authorize deletion of the whole organization. You may exercise your rights or request help by writing to contacto@cronogantt.com.

Necessary financial documentation is retained separately with restricted access and its own expiry. Accounting documentation covered by the general Argentine rule is retained for ten years from its date or last entry, as applicable. This retention does not extend to projects, tasks or attachments. We do not store complete payment-provider notification payloads or full card information.

Temporary backups under CronoGantt’s control are kept for a maximum of 30 days. Providers’ residual copies follow their backup cycles and contractual obligations; deleting active systems does not establish that those copies disappear instantly. They remain outside normal operations. Before restoring a central backup, we reapply the deletion register to prevent deleted workspaces from being reactivated.

Closure invalidates earlier file links when file protection completes. We cannot remove copies a person has already downloaded. Disconnected kiosks retain their existing local-cache limits, up to 72 hours, and clear the cache upon reconnecting and receiving an access rejection. Request, closure, expiry, recovery and deletion notices are transactional, without open tracking or marketing content; links lead to the authenticated portal and do not execute actions themselves.

9. Your rights

You may request access, updates, correction, confidentiality or deletion of your data through the contact email address. Access requests will be answered within 10 calendar days, and requests for updates, correction or deletion within 5 business days, in accordance with applicable Argentine rules.

The Argentine Agency for Access to Public Information, the supervisory authority under Law 25,326, receives complaints and claims concerning noncompliance with personal data protection rules. You can find its channels at argentina.gob.ar/aaip.

10. Security

We apply technical and organizational measures intended to protect information against unauthorized access, alteration, loss or disclosure. No system is completely infallible, and these measures are reviewed as the service evolves.

11. Cookies and local storage

CronoGantt uses cookies and browser storage to maintain sessions and service functionality. The public site includes Cloudflare Web Analytics to measure visits, page views, traffic origin, device type and performance. This measurement does not use advertising cookies or session recordings. Private pages and organization content are not sent to that service.

The language preference is remembered using the functional cookie cg_locale, with a maximum duration of one year. On production domains, it is shared between the public site and application to preserve your selection when signing up or subscribing. You can change it using the language selector or delete it in your browser. The country estimated from the connection automatically determines the initial offer and does not replace the billing address, which is confirmed at checkout.

In the application, we record the internal user and organization identifiers, day and last observed activity, without storing keystrokes, cursor positions or work content. We retain these records for 90 days and daily totals for 13 months. The reporting panel is restricted to the CronoGantt administrator account. Measurement begins when enabled and may be incomplete due to blockers or connection problems.

12. Changes and contact

We may update this policy to reflect changes in the service or applicable requirements. Material changes will be published on this page and communicated to the workspace owner by email 30 days in advance. Changes required for legal or security reasons may take effect sooner. The page will always identify the current version.

For questions or to exercise your rights, write to us at contacto@cronogantt.com.