1. Data controller
- Owner: Diego Herrero García (trading as "dhaudiovisuales")
- Contact: info@dhaudiovisuales.com
- Location: Gijón (Asturias), Spain
2. What data do we collect?
| Data | When it is collected | Purpose |
|---|---|---|
| Your email | When you sign in (one-time code login, no password) | To identify your account reliably so you don't lose your data if you change phones. We also use it to send you the sign-in code and a single reminder email when you have used 80% of your check-in deadline (never for advertising; you can avoid it by pausing alerts or deleting your account from Settings) |
| Date and time of each check-in ("I'm OK") | Every time you confirm | To calculate whether you have confirmed within your deadline |
| IP address | When you accept the legal notice, at each check-in, and when you change your check-in interval | Evidence that it was you who confirmed/accepted/changed the setting, and service security |
| Name and email of your emergency contact(s) | When you add them in the app | To be able to notify them if you do not confirm in time. When you add a contact, we send them an introductory email explaining what AllOk is, so they don't receive an alert "cold", without context, the day it is needed |
| Configured check-in interval, and the history of its changes | When you save it in Settings | To calculate the alert deadline; the change history is kept for your own protection (evidence of which deadline you had active at each moment) |
| Push notification token (FCM) | When you open the app (it is stored even if you have not granted the notification permission) | To be able to send you, from our servers, a push reminder when you have used 80% of your check-in deadline. It goes only to your device, never to your emergency contact. The token is an identifier of the app installation; it does not contain your name or email |
| System notification permission | If you grant it when opening the app | To be able to show you reminders before your check-in deadline expires. There is a local reminder, generated and shown on your phone without going through our servers, and the push reminder described above. Neither is sent to your emergency contact |
| Version of the legal notice accepted and date | When you accept the onboarding | Evidence of informed consent |
| Device model and Android version | When you accept the onboarding | Evidence of informed consent (technical context) |
| Record of pausing/resuming/deleting your account | When you use those options in Settings | Evidence that you managed your account correctly (relevant if you stop using the app) |
We do not collect: GPS location, contacts from your address book (only what you type in manually), photos, or browsing data outside the app.
3. What is the legal basis for processing your data?
- Performance of the service (art. 6.1.b GDPR): we need your email, emergency contact and interval for the app to work and to send you the deadline reminders (push and email) that are part of the service.
- Explicit consent (art. 6.1.a GDPR): when you accept the legal notice during onboarding, through an unticked checkbox.
- Legitimate interest (art. 6.1.f GDPR): recording of IP and technical metadata, to be able to demonstrate consent and prevent fraud or misuse of the service.
- Legitimate interest of the user and of the controller (art. 6.1.f GDPR): your emergency contact's email and name are processed so we can provide the alert service you requested. By providing us with this data, you declare that you have that person's authorisation to do so.
4. Who do we share your data with?
We use the following providers (data processors) to operate AllOk. We do not sell or transfer your data to third parties for their own advertising purposes:
| Provider | Purpose | Data it processes |
|---|---|---|
| Supabase (database and backend) | Hosting all the app's data | All data described in section 2 |
| Resend | Sending emails (alerts, introductory email to the contact, deadline reminder to the user themselves, sign-in code) | Email of the user and of the emergency contact, message content |
| Google Firebase (Cloud Messaging) | Push notifications (deadline reminder to the user themselves) | Device token |
| Google AdMob | Advertising within the app (free version) | Device advertising identifiers, according to Google's privacy policy |
5. How long do we keep your data?
- For as long as your account remains active.
- If you delete your account, we delete your profile and emergency contacts within a maximum of
30 days. Based on our legitimate interest in being able to demonstrate that the service worked
correctly in the event of a claim, we keep: the record that you accepted the terms
(
consent_log), the record of alerts already sent to your emergency contact (alert_log), the record of account actions such as pausing/deleting (account_action_log), the history of changes to your check-in interval (interval_change_log), and your check-in history (checkin_history) — the latter is permanently deleted automatically after 6 months, whether you keep the account active or delete it.
6. Your rights
You can exercise your rights at any time to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your account and associated data.
- Portability: receive your data in an exportable format.
- Objection/restriction: object to certain processing.
To exercise them, write to info@dhaudiovisuales.com. If you consider that we have not handled your request properly, you can also lodge a complaint with the data protection authority of your country of residence (in the European Union, that of your Member State). In Spain, with the Spanish Data Protection Agency (AEPD), at www.aepd.es.
If you live outside the European Union, we generally grant you the same rights of access, rectification, erasure and objection described in this policy, regardless of whether your local law explicitly requires them.
7. International transfers
The Supabase servers we use are located in the European Union (Frankfurt, Germany). Our providers Google (Firebase/AdMob) and Resend transfer data outside the EEA under the Standard Contractual Clauses (SCC) approved by the European Commission and/or the EU-US Data Privacy Framework.
8. Minors
AllOk is not directed at children under 16. If we detect that a person under that age has created an account without parental consent, we will delete it.
9. Changes to this policy
If we make substantial changes to this policy, we will notify you within the app before the change takes effect.
10. Contact
For any question about this policy or how we process your data: info@dhaudiovisuales.com.