Privacy

What is stored

For each person who works for you: their name, role, nationality, date of birth, phone, address, emergency contact, what they are paid, and the records of payments, advances, loans, leave and documents you enter.

Documents you upload, such as a passport or permit page, are stored privately and can only be opened by an admin of that household or by the person themselves.

Some of that the worker enters themselves: their phone, date of birth, nationality, photo, address, emergency contact and the family to reach back home. Every field carries who filled it in and when, and they can see that list on their own screen.

For each admin: name, email address, and the record of what they changed.

Who can read it

The admins of your household, and each worker for their own record only. Nobody else.

The separation is enforced by the database itself, not only by the screens. A second household asking for your rows gets nothing back.

What the person running the service can see

Counts and account details: how many households exist, how many admins and workers each has, when it was created, the email of the owner, and how much storage is used.

They cannot read any household workers, salaries, payments, documents, signatures or requests. There is no policy in the database that would let them, so it is not a promise about behaviour: the query returns nothing.

There is no support tool, no screen and no account that shows them your records, and no way to grant one.

What is true of any hosted service is true of this one: somebody runs the database. The keys the backups and the nightly job use exist, and the person who operates the service holds them. We will not pretend that away, because a privacy promise that quietly depends on nobody checking is worth less than an accurate one.

Where it is kept, and for how long

The records and files are held by Supabase, and the app runs on Vercel. Email, when you switch it on, is sent through Resend.

Records stay until you delete them. A deleted household is exported, then kept for thirty days, then purged.

What is counted

Vercel counts page views for the service: which screens are opened, roughly where from, and on what kind of device. It sets no cookies and follows nobody between sites.

A screen about one person is counted by its shape, /admin/workers/[id] rather than the id itself, so no worker and no household can be picked out of the figures. No name, amount, document or message ever reaches it.

Asking about your data

If you want to see, correct or remove what is held about you, ask the admin of the household you work for. They can export everything and delete records from inside the app.

A worker can do most of it without asking. The details that are theirs change straight away on their own screen. For anything the household set, there is a button beside it to say it is wrong, and asking for the whole record to be removed is on the same screen.

Bank details and the username are the exception. A worker can propose a change and an admin has to approve it, because a changed IBAN would send a salary somewhere else.