Privacy Policy

1. Who we are

flexiday is operated by Daniel Hrynusiw OSVČ (“we”, “us”, “the controller”), a sole trader established in the Czech Republic, with a registered address at Bořetická 4133/6, 628 00 Brno-Židenice, Czech Republic. We are the data controller for the personal data described in this policy.

For any privacy question or to exercise your rights, contact us at daniel@hrynusiw.cz. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

2. Scope

This policy applies to the flexiday web application and related services (the “Service”), a tool that helps teams request, approve and track time off. It does not cover third-party websites we may link to.

3. What data we collect

Data you provide

• Account data — your name, email address and password (stored only as a salted hash; we never see your plain-text password).
• Team & organisation data — groups you create or join, roles, and invitations.
• Time-off data — leave requests you submit, including dates, leave type (e.g. vacation, sick, home office), status, and any note you add.
• Support communications — the content of emails you send us.
• Attendance location — where your employer has switched attendance location on, we store the latitude, longitude and accuracy your browser reports at the moment you clock in and at the moment you clock out. Nothing is recorded between those two instants and nothing is collected in the background: your browser asks your permission each time, and declining is neither recorded nor flagged. The coordinates are visible to you and to the administrators of your organisation or group; nobody else can see them. We erase them twelve months after the business date they belong to — the attendance record itself stays, without the location.
• Request attachments — files (images or PDFs) you or an admin attach to a leave request, such as a doctor’s note. Because a file may contain health data, we treat it as a special category of personal data under Article 9 GDPR. We store it so that the people who decide your request have the evidence for it. Attachments are stored encrypted at rest on AWS in Frankfurt, Germany, and only you, the group’s approvers and its admins can open or download them; other members of your team cannot see that an attachment exists. We delete an attachment twelve months after the absence it belongs to, or sooner if the request is cancelled.
• Sign-in with Google, Microsoft or Apple: if you sign in with one of these accounts, the provider sends us your name, email address and, where you have one, your profile picture. We use them only to create your account and sign you in.
• Calendar connection: if you connect your Google or Microsoft calendar to a personal calendar, we store the access tokens the provider issues (encrypted), the permission you granted, the time zone you chose, and the ids of the events we created. Section 6 has the details.

Data we collect automatically

• Technical data — IP address, browser and device type, and timestamps, collected in server logs for security and reliability.
• Session data — an authentication cookie / local-storage token that keeps you signed in (see section 10).
• Push token — the address Apple gives your iPhone for notifications, stored only if you allow notifications in the iPhone app.
• Error and performance data — when something goes wrong in your browser or on our servers, we record the error, the page or API route it happened on, your browser and operating system version, and timing measurements, so we can fix it. This is tagged with a random id that lives only for the current browser tab. We do not record your screen or your session, and we do not use this data to build a profile of you.

4. Why we use your data and our legal bases

5. Who we share it with

We do not sell your personal data. Within the Service, your time-off and profile information is visible to members of your team and groups, as needed to coordinate coverage. We rely on the following processors, who act on our instructions under data-processing agreements:

Paddle acts as the seller of record for paid plans: when you buy a subscription, Paddle processes your payment details under its own privacy policy — we never receive your full payment card details.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety and security of our users.

6. Calendar connections and Google user data

On a personal calendar you can connect your own Google or Microsoft calendar. flexiday then writes your approved absences into that account’s primary calendar and keeps them up to date as your requests change. Only your own records are written there, never a teammate’s.

What we access

From Google we ask for one permission, calendar.events.owned, which lets us create, change and delete events on calendars you own. We use it only on events we created ourselves. We do not read your other events, your list of calendars, or anyone else’s calendar. From Microsoft we ask for Calendars.ReadWrite and offline_access, which keeps the sync running while you are signed out, and use them the same way.

What we write and store

Each event carries the absence type (for example “Vacation”), its dates or times, your time zone, and the note you added to the request, if any. People who can see your calendar, such as colleagues your organisation shares it with, can see these events. On our side we store the access tokens the provider issued to us, encrypted, plus the permission you granted and the id of each event we created, so we can update or remove it later.

How we use it, and what we never do

We use the access you grant only to keep your calendar in step with your approved absences. We do not sell this data, Google user data included, use it for advertising, use it to train AI or machine learning models, or transfer it to anyone else. Nobody at flexiday reads it, except where you ask us to for support, where security requires it, or where the law requires it.

flexiday’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion

When you disconnect a calendar, we delete the events we created from it, revoke our access at Google, and delete the tokens we held. Microsoft offers no revocation from our side; you can remove flexiday under your Microsoft account’s app permissions. You can also withdraw Google access at any time at myaccount.google.com/permissions; we then stop syncing. When you delete your flexiday account, we do the same for every connected calendar first: we delete the events we created, revoke our access at Google, and delete the tokens. Anything we cannot remove or revoke at that point stays; you can delete a leftover event yourself and remove flexiday’s access in your Google account permissions.

7. International transfers

Your data is hosted within the European Union (Amazon Web Services (AWS), eu-central-1 region (Frankfurt, Germany)). Where any transfer outside the European Economic Area occurs, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. How long we keep it

We keep your personal data for as long as your account is active. You can delete your account yourself in Settings, or ask us to erase your data.

Deleting your account removes it from our live systems at once, together with everything tied to it: your leave and attendance records, request attachments and settings. That includes what your team or employer could see of them. If you own an organization that has nobody else in it, the organization goes too, with its groups and its subscription record. An owner has to remove the other members and cancel a renewing subscription before they can delete their account. Paddle, as seller of record, keeps its own records of past payments under its own privacy policy.

Our database backups age out, so deleted data is gone from them within seven days. Changes you made to other people’s allowances as an admin stay in the audit log without your identity. A request to erase your data is handled the same way. Either way, we delete it unless we are legally required to keep it longer.

Request attachments are deleted automatically twelve months after the absence, or as soon as the request is cancelled. Attendance location coordinates are erased twelve months after the business date they belong to, leaving the attendance record itself in place. Server logs are retained for a limited period for security purposes.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email daniel@hrynusiw.cz. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (https://www.uoou.cz).

10. Cookies and local storage

We store only what the Service needs to work, which is why you see no cookie banner. Nothing we store identifies you across visits, and there is no analytics, advertising or cross-site tracking of any kind.

• Authentication. A session cookie and a matching local-storage token that keep you signed in. Clearing them signs you out.
• Diagnostics. A random id (fd.sid) held in your browser’s session storage, which groups the error and performance records described in section 3. It is discarded when you close the tab and never links two visits together.
• Preferences. Your light/dark theme choice, stored in your browser.
• Payment. On a paid plan, opening the checkout loads Paddle, which sets its own cookies to process the payment and prevent fraud. This happens only when you click to subscribe or manage your payment method, never on an ordinary page view.

11. Children

The Service is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, please contact us so we can remove it.

12. Security

We take appropriate technical and organisational measures to protect your data. For details, see our Security page.

13. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, provide a more prominent notice.

14. Contact

Daniel Hrynusiw OSVČ
Bořetická 4133/6, 628 00 Brno-Židenice, Czech Republic
daniel@hrynusiw.cz