Privacy policy

This policy describes how personal data is processed for the Trackify service (the mobile app and this website), under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD).

Last updated: 21 August 2026.

1. Controllers

Service provider (processor or controller, depending on the processing):

• Trade name: Trackify
• Privacy contact: info@trackify.app
• Location: European Union (servers and infrastructure in the EU when Supabase is used in a European region).

Client company (your organisation):

When you buy Trackify to manage your employees' working time, your company is usually the controller of workers' employment data (hours, location during the shift, visits, site photos). Trackify acts as processor of that data, limited to providing the software on your instructions.

You must inform workers through your own employment channel (an internal notice, an information clause, and so on), on the same bases described in section 3. Trackify can provide a model notice. It does not replace the information the company must give.

2. Data we process

• Identity and account: name, email, role in the company, profile photo (optional), password (stored securely by the authentication provider; Trackify does not keep it in plain text).
• Shift data: start and end, office / travel / project classification, duration, kilometres, route polylines, manual changes and correction requests.
• Location: GPS coordinates only while the shift is open, including in the background on Android/iOS if the system permission allows it, to support time classification (office / travel / project), geofencing and visit check-in. Location is neither collected nor stored when the shift is closed. Under company policy the shift state can be forced by hand. That does not mean recording location outside an open shift.
• Projects and visits: calendar, states, planned hours, check-in, delays, visit notes (including voice dictation if you use it).
• Visit evidence: photographs and related metadata (type: delivery slip, material, fault, other), stored in the provider's file service.
• Optional integrations: if the company connects Microsoft Outlook / calendar, OAuth tokens and imported event data are processed under the administrator's settings.
• Technical and security data: session identifiers, error logs (for example Sentry, if it is on in the build), connectivity data, and the device's offline sync queue.

We do not sell personal data.

3. Purposes and legal bases

For employment data (shift, location, visits, evidence), the client company is the controller. Trackify acts as processor. The bases for hours and GPS are the same ones the company must explain to its staff:

• Providing the SaaS (accounts, invitations, billing) — performance of the contract between Trackify and the client company (GDPR art. 6.1.b).
• Work-time record (clock-in, clock-out and times) — the employer's legal obligation (GDPR art. 6.1.c and art. 34.9 of the Spanish Workers' Statute). The Statute requires a time record. It does not require geolocation.
• GPS location and routes, only with the shift open — this is not an obligation under art. 34.9. The company relies on performance of the employment contract and on the monitoring power in art. 20.3 of the Statute, with the prior, express, clear and unambiguous information required by art. 90 LOPDGDD, and with minimisation (no location when the shift is closed; another person's map is visible only to people with a specific permission, and that opening is logged). The worker's consent is not the basis: in employment it is usually invalid because of the imbalance between the parties.
• Visits, photo evidence and shift corrections — performance of the employment contract and organisation of the work, with the same prior information and proportionality.
• Reminders on the phone — legitimate interest of the company or of Trackify in completing the record. Local notifications need an operating-system permission.
• Dictating notes (voice) — performance of the service. Recognition may run on the device or in system services (Apple/Google). Trackify does not keep the audio permanently, only the transcription saved as a note.
• Support, security and improvement (for example Sentry, if it is on) — Trackify's legitimate interest as provider, not as the basis for workplace GPS.
• B2B invitation sign-up — performance of the contract between Trackify and the client company.

4. Recipients, processors and transfers

Trackify uses only the providers it needs, with a processor contract or standard clauses where required:

Systematic international transfers of employment data outside the EEA are not expected, except those named (for example Sentry or a public OSRM if the client turns them on). In those cases GDPR safeguards apply (an adequacy decision, standard contractual clauses or other measures).

5. Storage on the device (mobile app)

The native app does not use browser cookies. It uses local storage (for example Hive) to:

• Keep the session and preferences.
• Queue GPS points and shift operations offline until they sync.
• Store local reminders and office or project setup on the map.

This data stays on the device and is removed when the app is uninstalled or the session is closed, as applicable. See also the Cookie policy for the website.

6. Retention

• Work-time record: article 34.9 of the Workers' Statute requires the employer to keep it for four years. The client company is responsible for that retention. Trackify keeps the records available for the life of the contract and allows export at any time.
• Deleting a company account: before deletion, Trackify generates a full copy of the record for the company and checks that it has been downloaded. After deletion, Trackify keeps only that file for 30 days, locked in private storage, so it can be delivered again if the company asks; then it is deleted.
• Locations and routes: 90 days. The four-year duty applies to the time record, not to the trail of positions. After 90 days the recorded locations and the raw route trace are deleted automatically. The hours, projects and kilometres of each shift are kept.
• Other shift and visit data: for the life of the contract and, afterwards, for as long as claims, labour inspection or legal duties require.
• Inactive accounts: may be anonymised or deleted after a reasonable period, with prior notice to the company.
• Evidence photos: under the company's policy. You can ask the administrator to delete them.
• Integration tokens (Outlook): while the connection is active; revocable from the app or from Microsoft.
• Error logs (Sentry): under the provider's configured retention (usually months, minimised data).

7. People's rights

You can exercise access, rectification, erasure, restriction, objection and portability by contacting your company (if you are a worker) or info@trackify.app (if we are controller of account or website data).

Without asking anyone, any user can download their own work-time record as CSV or PDF from Record → Export, as article 34.9 of the Workers' Statute requires.

Administrators can delete accounts (personal or company) from the app, using the functions that are enabled.

You can complain to the AEPD (www.aepd.es) or another supervisory authority.

8. Security

Encryption in transit (HTTPS/TLS), role-based access, row-level security in the database, passwords not stored in plain text in the app, minimisation (GPS only while the shift is open), B2B invitations by code or link with an expiry, and deferred sync when offline.

9. Children

Trackify is for B2B employment relationships. It is not intended for children.

10. Changes

We will publish the updated version in the app and on the website. When the version of the legal documents changes, the app will ask for acceptance again before the service can continue.

11. Website form

If you write from Request a demo, the message includes name, company, email, phone if you give it, headcount and the comment. It is used to reply and, if it fits, to send an invitation code. It does not create an account or a company.

The basis is a request for pre-contractual steps (GDPR art. 6.1.b). This version of the site does not store the form on a server: sending it opens your mail app to info@trackify.app. We keep that email for the conversation and, if there is no contract, delete it when it is no longer needed.

This section last updated: 22 October 2026.