Privacy policy

This policy explains which personal data we process when you visit this website or use Allyova, why we do it and which rights you have. We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Who is responsible

Allyova
Badstrasse 50
5200 Brugg AG
Switzerland
info@allyova.com

Visiting this website

When you open this website, the server that hosts it automatically records technical data such as your IP address, the date and time, the page you requested and your browser. We need this data to deliver the website and keep it secure. It is kept only as long as that purpose requires.

This website does not use analytics, advertising or tracking cookies, and we do not build visitor profiles.

Contacting us

The contact form does not send or store anything on its own. It opens your email app with your message already filled in, and you decide whether to send it. When you write to us by email or call us, we use your details only to answer you and, if you ask for it, to prepare an offer.

Using Allyova

Allyova (app.allyova.com) is used by companies to organise their team: tasks, leave, attendance, profiles and notices. The company that uses Allyova decides which data about its people is entered. For that data we act on behalf of that company and process it only to provide the service. Each company's data is kept separate from every other company.

To create and manage your account we process your name, email address, your company and your role. Sign in uses a session cookie that is strictly necessary for the app to work.

When you sign in, we also set a security cookie (allyova_device) holding a random identifier, valid for up to 400 days. It lets us recognise devices you have signed in on before and email you when someone signs in to your account on a new device. We store only a hash of it. The cookie serves the security of your account alone and is necessary for it.

If your company records sick leave, we also process health data: the absence itself and any doctor's certificate that is uploaded. This data is especially sensitive. Only you and the people your company authorises can see it.

Notifications

Allyova notifies you about events in your company that concern you, such as the decision on a leave request, a new task or a reminder to clock out. Every notification appears in the app. Whether it also reaches you by email or as a push notification is up to you, under Settings > Notifications. Emails about your account's security and about billing are always sent.

For every email we send, we log the recipient address, the kind of email and its delivery status (for example delivered or bounced), so that we notice delivery problems. Notifications and this log are deleted after 180 days.

The Allyova app for iOS and Android

The app processes the same data as app.allyova.com: your clock-in and clock-out times, your tasks and your absences, including uploaded documents. Instead of a cookie it keeps your sign-in in your device's protected storage (the Keychain on iOS, the Keystore on Android). Signing out deletes it there.

When it starts, the app asks whether a newer version is available. That request carries the platform and the app's version number, but nothing about you. The app contains no advertising and no tracking.

When you sign in, the app sends a device identifier that applies only to this app on your device (identifierForVendor on iOS, the Android ID on Android). We store only a hash of it and, like the security cookie, use it only to recognise known devices.

If you allow push notifications, the app sends your device's push token to us. We use it only to deliver notices such as the answer to a leave request or a new task. The notification (title and text) passes through Expo's push service and through Apple (APNs) or Google (FCM). You can turn notifications off at any time in your device settings or in Allyova under Notifications, and we remove the token when you sign out. With the push token we store the device model (such as "iPhone 15"), so you can tell your devices apart in the settings.

A profile photo is optional. If you upload one, the people in your company and your employer see it on your profile.

Sharing data

We do not sell personal data. We share it only with service providers we need to run the website and the app, and only to the extent necessary:

• Vercel: hosting the website and the app, storing uploaded documents
• Neon: database
• Resend: sending emails, such as notifications or for resetting a password, and reporting whether an email was delivered
• Expo: updates to the app for iOS and Android
• Expo, Apple and Google: delivering push notifications (the push token and the text of the notification)

Where these providers are outside Switzerland or the EU, we make sure your data is adequately protected.

How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires us to keep it.

Your rights

Within the limits of the applicable law you can:

• ask which personal data we hold about you
• have incorrect data corrected
• have your data deleted or its processing restricted
• receive your data in a common format
• object to processing or withdraw a consent you gave

If you are a member of a company that uses Allyova, please turn to your company first, as it decides about that data. You can always write to us at info@allyova.com. You also have the right to complain to a data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

Changes

We may update this policy when our services or the law change. The version published on this page applies.