Privacy statement

1 Two roles

Gradlog holds two roles at once, and the difference decides who you need to talk to.

For everything inside the logbook (records, staff names and PINs, photos and dossiers), the account owner is the controller and we are the processor. We do nothing with it other than what the owner instructs. The annex at the bottom of this page is the data processing agreement that goes with that.

For the account itself (the owner email address, the sign-in codes, the paired devices and the subscription state), we are the controller.

If you are a staff member and want to know what is recorded about you, or want it erased, ask the owner of the location. We may not hand it over or erase it on our own initiative.

2 What we record

Swipe the table sideways

We receive no payment details. The store collects the payment and tells us only which product is active and until when.

3 Legal basis

• Performance of the contract: the account, the subscription and the working of the app.
• The controller's instruction: everything inside the logbook.
• Legitimate interest: rate-limiting sign-in attempts and stopping abuse.
• Legal obligation: the records we have to keep ourselves.

4 How long we keep it

• A sign-in code works once and for ten minutes at most. Within two days after those ten minutes have passed, we delete the stored code and the email address kept with it.
• Records, photos and dossiers are kept for as long as the account exists, even after the location's retention period has ended. That period is twenty-four months by default; the owner can change it in the app, but not to less than six months (Dutch hygiene code for hospitality, KHN, 2016).
• Export ZIP files: fourteen days, after which we delete the file and the link expires.
• After a request to delete the account: fourteen days of waiting, then we erase everything. See Delete your account.
• Subscription events from the store: as long as the account exists.

5 Where the data sits

The data is stored on Hetzner Online GmbH servers in Finland. Photos, dossiers and export ZIP files sit on a disk next to that same server and are reachable only through a signed link that expires on its own; there is no public listing. Traffic between the app and the server always runs over TLS.

6 Who we bring in

Swipe the table sideways

Apple and Google are not our processors. They sell the subscription on their own account and are controllers for that sale; their own privacy statements apply to it.

If we bring in another party, we announce it at least thirty days in advance to the owner email address. The owner may object and cancel with effect from the date of the change.

7 Transfers outside the EEA

Only RevenueCat sits outside the European Economic Area. That transfer is based on the European Commission's standard contractual clauses and covers the data listed for RevenueCat in section 6. Hetzner and Brevo (EU) process inside the EU.

8 Photos

A photo on a record is optional; the app never blocks on a missing one. The app asks staff not to photograph people: a photo is meant for a thermometer, a label or a delivery. If someone is visible anyway, the account owner is the controller for that. Photos are resized to 1280 pixels on the device, sent over TLS, and shown only through a signed link that expires.

9 No trackers

Gradlog contains no analytics package, no crash reporter and no advertising identifier. We do not follow you across apps or websites, we do not sell data on, and we set no advertising cookies. This website sets no cookies.

10 Children

Gradlog is meant for people working in a food business and is not directed at children.

11 Your rights

You may access your data, have it corrected, have it erased, take it to another provider, and object to a processing. As the owner you do most of it yourself in the app: export and delete sit under Instellingen → Account (Settings → Account).

For anything else you reach us at info@falka.nl; we answer within one month. If you disagree with what we do, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority of your own country.

12 Annex: data processing agreement

This annex is the processing agreement referred to in Article 28(3) of the General Data Protection Regulation. It forms part of the terms of use.

a. Subject-matter, nature and duration

The controller is the account owner; the processor is Falka Software (Merlijn de Groot). The subject-matter is keeping a food-safety logbook and producing the dossier that goes with it. The agreement runs as long as the account exists and ends when the account is deleted.

b. Personal data and data subjects

Personal data: staff names and roles, hashed PINs, the name of whoever made a record together with its time, free text in corrective actions, and whatever is visible in a photo. Data subjects: the staff of the location, the owner, and anyone who ends up in a photo unintentionally.

c. Instructions

We process this data only on the controller's instruction. That instruction is the use of the app and of these terms. We do not use the data for our own purposes, not to improve or train the product, and we do not sell it.

d. Confidentiality

Everyone on our side with access to this data is bound to confidentiality.

e. Security (Article 32)

• All traffic runs over TLS.
• PINs are stored as bcrypt hashes and never kept in readable form.
• Access tokens belong to one device and to one organisation or location, and can be revoked per device.
• Photos, dossiers and export ZIP files are reachable only through a signed link that expires on its own.
• A record outside its limit is refused by the server too while it carries no corrective action, so the logbook cannot quietly go incomplete.
• Sign-in and the store webhook are rate-limited, and the webhook is checked against its signature.
• A record is never overwritten: a correction is a new record that voids the earlier one, and who did it stays visible.

f. Sub-processors

The controller gives general authorisation for the sub-processors in section 6. We announce a change at least thirty days in advance; the controller may object and cancel with effect from the date of the change.

g. Assistance

We assist the controller with data-subject requests and with a data protection impact assessment as far as it concerns our processing. The export in the app produces everything an access or portability request needs.

h. Personal data breaches

We report a personal data breach without undue delay and no later than forty-eight hours after we become aware of it, to the owner email address, with what we know at that moment about its nature, its scale and the measures taken.

i. Return and deletion

The controller can export everything before requesting deletion of the account. Fourteen days after a request to delete the account we erase all personal data and the files that go with it.

j. Audit

On request we provide the information needed to demonstrate compliance with Article 28, and we cooperate with an audit by the controller or an auditor it appoints, at most once a year and at the controller's expense, unless an audit reveals a shortcoming on our side.