Privacy

Who is responsible

SoloDesk's operator is the data controller for account administration, support, service security and website operation. This means the operator decides why and how that information is used.

For customer records entered by a professional, that professional is the controller and SoloDesk's operator acts as a processor on their instructions. The professional is responsible for informing their customers and establishing a lawful basis for those records.

Information processed

• Account: your email, business or trading name, non-VAT confirmation, authentication credentials, account identifiers, sessions, email verification and password-recovery information.
• Business records: business name and address, customer names and phone numbers, appointments, services, notes, prices, payments, refunds, expenses and fixed monthly costs.
• Synchronisation: account, business and record identifiers, an app-generated device identifier, operation timestamps, revisions, processing outcomes and errors. The device identifier is used to distinguish app operations, not for advertising.
• Support: your contact details, messages and any information you choose to send when requesting help.
• Connection information: service providers receive information such as your IP address and request metadata when your device connects.

Account information comes from you and the authentication service. Professionals supply their business and customer records; the app and service infrastructure generate technical information.

Email, authentication information and a business name are needed to create and use an account. Customer phone numbers, business addresses and notes are optional. Without an internet connection, changes remain on your device until they can sync.

Payment entries record transactions handled elsewhere. SoloDesk does not request card numbers or bank-login credentials or process customer payments.

Use fictional customer records during this beta. Do not put unnecessary health or other sensitive information in notes, support messages or feedback.

Purposes and legal bases

Accounts and requested support

Creating your business workspace, signing you in, recovering access and answering account-support requests: performing the service contract you request, under GDPR Article 6(1)(b).

Security and reliable operation

Controlling access, preventing misuse and diagnosing synchronisation or service faults: the legitimate interests of protecting accounts, preventing unauthorised access and keeping the service working, under Article 6(1)(f).

Beta testing

Investigating TestFlight crashes and feedback and improving the beta: the legitimate interest in finding and fixing app defects, under Article 6(1)(f).

Website delivery

Serving these pages and protecting them from abuse: the legitimate interest in operating an available and secure information website, under Article 6(1)(f).

Legal requirements

Handling data-protection requests and responding to a binding legal obligation where applicable: compliance with that obligation, under Article 6(1)(c).

These are the operator's purposes for account and service information. They do not replace the professional's legal basis for processing their customers' records.

The app does not include advertising profiling or automated credit or eligibility scoring.

Providers and recipients

• Supabase: account authentication, account-confirmation and password-recovery flows, hosted database and server functions.
• PowerSync: synchronisation of the business records made available to your account.
• Cloudflare: website hosting, delivery and security.
• Apple: TestFlight distribution, beta diagnostics and feedback, as described below.

The actual authentication-email and support-mail providers, hosting regions, provider agreements and any processing outside the European Economic Area still need to be verified. The final notice must identify the applicable transfer safeguards and how to obtain information about them; EU hosting alone is not a guarantee of EU-only processing.

When you choose to share an accountant report, the selected recipient and sharing service receive that export. Information may also need to be disclosed where a binding legal obligation requires it.

Storage and access

The app keeps local records, pending changes, drafts and preferences so you can work offline. Synced records are held by the service; work that never reached the cloud cannot be recovered from it.

Private business details are stored in encrypted payloads. Account information and structural data such as identifiers, dates, amounts and status values are not all covered by that payload encryption. Keys are managed by the service, so this is not end-to-end encryption that prevents operator access.

Authentication sessions and cached business keys are protected in encrypted app storage using a key held in the iPhone's secure storage. Signing out does not delete the cloud account or erase all retained local records.

CSV exports are readable copies. Keep them secure; removing information from SoloDesk does not remove copies already saved or shared elsewhere.

Retention and deletion

The current beta does not automatically expire cloud accounts or business records. Archiving a customer or service hides it from active lists; financial corrections retain an audit history rather than erasing the original entry.

Retention periods or criteria for accounts, business records, support messages, security logs and beta diagnostics are still being finalised, including inactive accounts and backup expiry. Audit history is not a blanket reason to retain personal data indefinitely, and no fixed deletion or backup-recovery period is promised by this draft.

There is currently no in-app account-deletion control. A verified manual request-handling process and public contact must be established. Signing out or deleting the app is not a request to delete cloud data.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Public contact details for account and privacy requests are still being finalised. Reasonable identity verification may be needed. Never send a password, reset link or encryption key.

For records a professional holds about their customers, contact that professional first. SoloDesk's operator assists the responsible professional with applicable requests.

GDPR normally requires a response within one calendar month. Where a permitted extension is necessary, you must be informed within that month.

You can complain to Ireland's Data Protection Commission or another competent supervisory authority.

TestFlight

Apple automatically collects beta crash logs and usage information and shares them with the app developer. Feedback and screenshots you submit are also shared. This can include device and app versions, sessions, crashes and, depending on how you were invited, your name and email address.

This collection is separate from the app's own features and does not require an analytics SDK in SoloDesk. See Apple's TestFlight privacy information for its handling, invitation-type differences and retention.

Apple's retention terms do not define how long SoloDesk's operator keeps any separately retained feedback or diagnostic information.

This website

The website code contains no analytics, advertising, forms or cookie-setting scripts. Cloudflare receives technical request information to deliver and protect the pages. Optional tracking must remain disabled; review of the live hosting configuration and its log retention is outstanding.

Changes to this notice

The notice will be updated when the service or its data handling changes. Each version will show its update date; material changes requiring further information or consent must be communicated as applicable.