Privacy policy
Version 2026-11 · Controller for the data described in sections 1–2: Mohammad Al Hussein (enskild firma, trading as AstraDev), organisation number 20030804, Skansgatan 8, 21132 Malmö, Sweden, info@astrarota.com.
1. Two roles
Account data (the people who sign in) — we are the controller. Team data (the staff a customer schedules: names, absences and so on) — the customer is the controller and we are the processor; that is covered by the data-processing note.
2. What we collect about people who sign in
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email or username, role, password (stored only as a one-way hash) | To create and run your account and keep it secure | Contract (art. 6.1 b) |
| Sign-in times, security log (which account changed what) | Security, abuse prevention, support | Legitimate interest (6.1 f) |
| Organisation name, country, plan, subscription status | To provide and bill the service | Contract; legal obligation for accounting (6.1 c) |
| Acceptance of terms (date and version) | To prove what you agreed to | Legitimate interest |
| IP address (kept briefly, only to limit sign-up and sign-in attempts) | Abuse prevention | Legitimate interest |
| Email address and chosen language of every person who signs in, including staff accounts created by their employer; whether the address has been verified | To sign in, reset a forgotten password, and send the messages described in section 3 | Contract; for staff accounts the employer’s instruction (the employer is the controller) |
| Name, work email, and, if given, company, country, team size and message of people who ask for early access on our start page, and our own note about them | To tell them when we open, send a personal invitation link and answer their questions. Stored only if the person ticked the consent box. | Consent (6.1 a), which can be withdrawn at any time |
The early-access list is not shared with anyone else. The confirmation and invitation emails go through Brevo (France). A person can ask us at info@astrarota.com to be removed at any time and we do so at once.
| Name | Type | Why | How long |
|---|---|---|---|
| Session cookie | Cookie (HttpOnly, Secure) | Keeps you signed in | Until you sign out, at most 7 days |
| Entrance-screen cookie | Cookie (HttpOnly, Secure), only on a time-clock entrance screen | Ties the entrance screen link to the one tablet that opened it | Until the link is replaced |
| Language, light or dark mode, larger text, tutorial and setup progress, cookie note | Your browser's local storage (never sent to us) | Remembers the choices you made on this device | Until you clear your browser data |
Payments open on Stripe's own pages, which set their own cookies for fraud prevention; see Stripe's privacy policy.
3. Staff accounts, emails and notifications
An employer can invite its staff to their own account. The staff member then sees their own shifts, can ask for time off, swaps or open shifts, can enter availability, and may use the time clock if the employer has switched it on. We send emails for account security (verify address, reset password, invitation) and for schedule events (a schedule changed, a request was decided, a request is waiting for a manager). Each person can switch event emails off in their settings; security emails are always sent. The same messages appear in the app’s notification list. The emails are sent through Brevo (France), which receives the recipient’s address, name and the text of the message. Each person can also create a private calendar link for their own shifts; anyone who has the link can read that person’s shifts, and it can be replaced in the app at any time, which stops the old one.
4. Time clock and location
If the employer turns the time clock on for a team, staff can clock in and out in the app. For each entry we store the time (in UTC), the shift it belongs to, who corrected it and why, and any flag such as “late” or “outside the zone”. Location is read from the device only at the moment the person presses clock in or clock out, and only if the employer requires or allows it for that team. The browser asks the person for permission first. We store the coordinates and accuracy with that entry only; we never track a person in the background. A location reported by a phone or browser can be wrong or manipulated, so it is a help for the employer and not proof. Time entries are kept for 400 days (the employer can set a different period per team) and are then deleted automatically; the employer can export them before that. The employer is the controller of time-clock data and must inform its staff and have a legal basis; see the data-processing note.
5. Activity log
Important actions (who added or removed a person, changed a role, approved a request, corrected a time entry, changed a setting) are recorded with the account, time and the thing changed. The organisation’s owner and managers can read this log. We also use it for security and support.
6. Payments
Card and payment details are handled by Stripe, which is an independent controller for them; we never see full card numbers. We receive the customer’s billing name and address, VAT number, plan, status and invoices. Accounting records are kept as long as Swedish accounting law requires (currently 7 years).
7. Who else receives data
Hosting: Clouding.io (Cloudi Nextgen SL), Spain. Email sending: Brevo (France). Payments: Stripe Payments Europe, Ltd. and its group (may transfer data outside the EU/EEA under EU standard contractual clauses or the EU–US Data Privacy Framework). Our accountant, for bookkeeping. We do not sell personal data. We disclose data to authorities only when the law requires it.
8. How long we keep data
- Account and team data: while the organisation exists. The owner can export it and delete the organisation at any time; deletion removes it from the live system immediately.
- Unpaid trial organisations: deleted 60 days after the trial ends.
- Early-access list: a person who never joined is removed 365 days after the request; once they have created an account their list entry is removed after 90 days, and the account data takes over. Invitation links work for 14 days.
- Backups: the server keeps the two newest nightly backups, and we keep a further copy offline that is replaced regularly. Deleted data therefore disappears from backups within about 60 days at the latest, and is not restored except to recover from a failure.
- Time-clock entries: 400 days by default, then deleted automatically. For organisations in Spain the period is at least 4 years, because Spanish law requires the employer to keep daily time records for that long. A Spanish trial organisation that has time records is kept read-only until 4 years after its newest record, and is then deleted completely; until then the owner can export everything at any time.
- Notifications in the app and queued emails: removed automatically after a short period.
- Accounting records: 7 years.
9. Security
Connections use HTTPS. Passwords are hashed with scrypt. Organisations are separated in the application and this separation is covered by automated tests. Servers are access-restricted and backed up daily. No system is perfect; if a personal-data breach affects you we will tell the affected customers without undue delay and, where required, the Swedish authority (IMY).
10. Your rights
You may ask us for access to, correction, deletion, restriction or a copy (portability) of your account data, and you may object to processing based on legitimate interest. Write to info@astrarota.com; we answer within one month. If you are a member of a customer’s staff and your question concerns your schedule, absences, time-clock entries or other team data, please ask your employer first: they are the controller. You also have the right to complain to the supervisory authority: Integritetsskyddsmyndigheten (IMY), imy.se, or the authority in your own EU country.
11. Changes
We will announce material changes to this policy by email to organisation owners at least 30 days before they apply.