Back to homepage

Privacy policy for the ClarixUP employee app

Last updated: 16 October 2026

This policy covers the ClarixUP employee app for Android and iOS and the public app privacy and account-deletion pages. Your workplace determines which business features are available. The separate privacy policy for the marketing website is linked below.

1. Provider, responsibilities and contact

The provider is Labonde Software Ltd, trading as ClarixUP, Tasou Chatzipapanastasiou 11, Office 002, 8035 Geroskipou, Cyprus. Privacy requests and support: contact@clarixup.de.

The workplace that set up your access is generally the controller for your employment and workplace records. It determines purposes, access rights, legal bases and retention. ClarixUP processes those records on its behalf as a processor. Labonde Software Ltd is the controller for its own service-operation purposes, including handling requests addressed directly to us, protecting the platform and handling abuse for which we determine the purposes.

This policy does not replace your employer's privacy information. Your workplace separately explains additional uses outside the employee app, such as payroll or AI analyses it commissions in the administration portal.

2. Data, sources and purposes

Your workplace provides account assignments and enabled employee details. Further information results from your input and use of features. It includes name, email address, user, employee and workplace identifiers and, where applicable, further profile and contact details. Authentication uses password verification hashes or short-lived email codes, session and installation identifiers, platform, device name and sign-in times.

Enabled features process working hours, breaks, shifts, calendars, tasks, leave and absence requests, training and control records, inventory actions, and chat, board and knowledge content. Documents may contain personnel, remuneration and payroll information. Sickness notifications and attachments contain health information. Processing supports workplace organization, communication, access to your documents and business documentation.

Authorized workplace users receive only information allowed by their roles and the relevant access settings. Team messages and shared content are visible to their intended recipients. ClarixUP personnel may access affected information where required for administration, troubleshooting or support. Data also goes to the service providers described below and, where legally required, competent authorities. We do not sell user data or use it for personalized advertising.

Your employer determines the legal basis for workplace processing in the particular context. In Germany this may include section 26 BDSG, Article 6(1)(b) or (c) GDPR and applicable collective agreements. Health information additionally requires a basis under Article 9 GDPR, in particular Article 9(2)(b) together with section 26(3) BDSG where its requirements are met. Consent is a basis only where valid and freely given in the employment relationship.

Where ClarixUP is the controller, security, abuse prevention and necessary technical diagnosis rely on Article 6(1)(f) GDPR: our legitimate interest in a secure, functioning service and protecting its users. Depending on the request, handling enquiries relies on contractual or pre-contractual steps under Article 6(1)(b), legal obligations under (c), or our legitimate interest in responding under (f). Where consent is required it relies on (a) and can be withdrawn for the future.

The app cannot provide protected employee access without an assigned account and necessary sign-in information. Your workplace explains which further details a business task requires. Device permissions do not themselves establish a data-protection legal basis. You can change camera, microphone, location and notification permissions in system settings; the relevant feature may then be unavailable.

4. Hosting, security and processing locations

The application, database and private file storage are hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Application and file storage are in Falkenstein; encrypted backups also use other German Hetzner locations. Device access and file-storage connections use HTTPS. Roles and workplace assignments restrict access. Authentication details and selected local app data use Android or iOS security facilities.

Server connections necessarily involve IP address, time, requested endpoint, response status and app or browser information. These support delivery, troubleshooting and abuse prevention. Application logs rotate by size; their time coverage depends on log volume. Specific security investigations can require records for the duration of the investigation. Section 10 also applies to technical error events.

ClarixUP's registered office in Cyprus is within the EU. The additional providers below may also process information outside the European Economic Area. German hosting therefore does not mean that every recipient processes all information in Germany.

Google describes adequacy decisions, including the EU-US Data Privacy Framework, and Standard Contractual Clauses where required for international transfers. Apple describes Standard Contractual Clauses for EEA data. The provider information linked below contains the applicable terms and ways to request a copy of safeguards. You can also contact contact@clarixup.de about recipients used for our service.

5. Authentication emails and email enquiries

Automated emails, including invitations and sign-in and deletion confirmations, are sent through Resend (Plus Five Five, Inc., USA). Resend receives the recipient address, message content and delivery metadata, including a name where it appears in the message. Resend uses subprocessors, including Amazon Web Services in the USA for hosting and sending. Its published data-processing terms incorporate EU Standard Contractual Clauses for international transfers. The terms and current recipient list are linked below.

Resend states that its standard plans retain email and delivery log data for 30 days and delete remaining customer data within 90 days after termination. Retention of delivered email in your own inbox is controlled by you or your email provider.

When you email contact@clarixup.de, we process your address, message and any attachments to handle your request. Our mailboxes are provided by Migadu-Mail GmbH, Rohnen 587, CH-9414 Schachen, Switzerland. The European Commission has an adequacy decision for Switzerland. We retain correspondence as needed to handle and document the request or meet legal retention obligations. Do not send health or personnel documents that your request does not require.

6. Location checks

If your workplace enables location checks, the app requests device permission and a single location fix when you start recording work. Coordinates and accuracy are sent to ClarixUP to check the distance. The check log records the workplace site, distance, accuracy and result, not your raw coordinates. The app does not track movement in the background. The log follows retention for the associated workplace time records. Your workplace explains its purpose, legal basis and any alternatives. Location checks are disabled for the fictional workplace used for internal Store testing.

7. Camera, microphone, files and scanning

Camera, microphone and file selection support actions you start, such as photos, document uploads, voice messages and barcode or QR scans. You choose what to send. Uploads are made available to authorized recipients in private file storage. Files may contain their own metadata, including capture time or location. Sharing or exporting passes a copy to the app or person you select. You and the recipient manage such copies.

The app recognizes barcodes on the device. The Android scanning library also includes Google ML Kit. Google describes collection by this SDK of device manufacturer and model, operating system, app identifier and version, installation identifiers, and performance, usage and error information for SDK diagnosis and usage analysis. This potential SDK processing is separate from optional ClarixUP error reporting; disabling that reporting does not automatically disable collection by other libraries. Google services may process information internationally, including in the USA. The SDK and transfer information linked below explains the data categories and safeguards.

8. Push notifications

For app versions configured to support them, you can enable notifications. A delivery identifier is then linked to your installation, session and workplace. Android delivery uses Google Firebase Cloud Messaging; iOS delivery uses Apple Push Notification service. Relevant Google and Apple entities include Google Ireland Limited and Google LLC, and Apple Distribution International Limited and Apple Inc. These services process delivery and device identifiers and technical app, device and connection information. Processing outside the EEA, including in the USA, is possible.

ClarixUP notifications contain no chat text: they contain a generic notice and an internal destination reference. Authentication and access are checked again when opened. You can disable notifications or revoke device permission. Logout and session revocation remove the server-side delivery registration. An installation identifier already held by the platform provider is separate and follows its retention terms. Push is not yet configured in the first internal Android test build.

9. Storage on your device

Access tokens are protected by Android Keystore or iOS Keychain. Selected evidence drafts and photos are encrypted locally so that you can continue or send them later. They remain until removed or until logout or a workplace change. A limited offline copy of your time balance and own shifts is usable for up to 24 hours. It does not allow offline time commands.

Downloads and recordings temporarily use private app storage. The app cleans these files when entering the background, on logout and through a 15-minute expiry check during further use. This does not mean that a powered-off device independently erases files after exactly 15 minutes. Exported copies are outside this cleanup. Necessary local storage supports the employee access and features you explicitly use; the native app does not set advertising or tracking cookies.

10. Technical errors and diagnostics

ClarixUP operates Sentry on its own Hetzner infrastructure in Germany for technical troubleshooting. Server-side error events may include technical request and error information. Event retention is configured to 90 days. This does not use Sentry's cloud service.

Separate error reporting from the native app is enabled only when specifically configured; it is currently disabled on the test and production servers. If enabled, the app sends minimized JavaScript error information such as error class, program location, platform and app version. Messages, form values, access tokens, file contents, interaction histories and screen recordings are excluded from these app error reports. The receiving server necessarily receives network information required for the connection. This does not exclude processing by native Google libraries; see sections 7 and 8. ClarixUP does not use this data for personalized advertising.

11. Retention and erasure

Your workplace determines retention of time, personnel, remuneration and evidence records according to their purposes and applicable legal obligations. The technical default for time records is 24 months. Your workplace can configure retention; disabled automatic erasure and legal holds can result in longer storage. Therefore 24 months is not a maximum for all employment information. The deletion preview shows your workplace's time-retention setting.

Chat media currently has a 30-day retention setting, after which a cleanup service removes it from file storage. This does not automatically erase the message text. Message text, boards, published knowledge and completed business records follow content deletion, account-deletion rules and your workplace's retention policy. Closed reports and completed account-deletion receipts are removed after 90 days. Open cases remain until handled or until file erasure succeeds. Deletion confirmation codes are valid for ten minutes; a cleanup service removes expired deletion challenges.

Mobile access tokens currently last ten minutes; renewal ends after 30 days without use and no later than 90 days after session creation. Expiry does not mean that all security and session records are automatically erased then. Account deletion removes associated sessions. Other security records remain only as needed to protect the service and investigate the relevant matter.

Erased live data may remain in encrypted backups until rotation. Regular rotation retains hourly, daily and up to eight weekly recovery points; daily protected archives are locked against deletion for 30 days. If backups fail, older recovery points may remain until replaced by new verified backups. Backups are for recovery. Previous erasures must be reapplied following a restoration.

12. Help, reports and blocking

If you report content, ClarixUP administration receives your description, the content reference, a limited excerpt and any account references needed to handle the report. Decisions are documented. Direct contact blocks are linked to your account and workplace. Processing supports your request and protects those involved; section 11 describes retention.

13. Account deletion and workplace records

You can request account deletion in the app or on the public deletion page linked below. After email verification you receive a preview of information to be removed and records retained for workplace purposes. Your final confirmation removes your personal login, revokes sessions and queues private files for erasure. A status key lets you check completion. Failed file erasures are retried and remain visible until complete.

Deleting an app account does not automatically erase all workplace time, personnel, payroll and evidence records. Your workplace remains responsible for those records. If you no longer have access to the registered email address, contact contact@clarixup.de; appropriate identity verification may be necessary.

14. Your rights and complaints

Subject to the legal conditions, Articles 15 to 20 GDPR provide rights of access, rectification, erasure, restriction and portability. You can withdraw consent for the future at any time without affecting the lawfulness of previous processing. Under Article 21 GDPR you can object to processing based on Article 6(1)(f) for reasons relating to your particular situation.

Contact your workplace about employment and workplace records. For ClarixUP's own processing and help routing your request, contact contact@clarixup.de. You can complain to a data-protection supervisory authority, particularly where you live, work or believe an infringement occurred. For Labonde Software Ltd's registered office, the authority is the Office of the Commissioner for Personal Data Protection in Cyprus: commissioner@dataprotection.gov.cy. Its website is linked below.

15. Updates and further information

We update this policy when features, recipients or processing conditions change. An older installed app may contain an older text. The published web version is available at /datenschutz-app. Updating this text alone does not replace notice of material changes or any consent that is required.

Privacy information for the services mentioned

Delete account · contact@clarixup.de