Privacy Policy

Akordo plays two different roles, depending on the data:

• Akordo is the controller for your Account data (your login, name, email, photo, phone, language), for billing data, and for support messages you send us. Here, the individual operating Akordo decides how the data is used and answers for it.
• The Business is the controller for the data about its team and its work: who works there, schedules, availability, requests, tasks, announcements and pay rates. Akordo processes that data on the Business's behalf, as its processor, under our Data Processing Agreement.

If you work at a Business that uses Akordo, your employer decides what it records about you there. Questions about that are best asked to your employer first; we will help them answer.

Account and profile. Your name, email address and password (stored by our authentication provider only as a secure hash — we never see it), your language choice, and optionally a profile photo and a phone number. Profile photos are stored at a public web address so they can be shown in the app; anyone who has that exact address can open the image. Your phone number is visible only to the Owners of each Business you belong to and the Managers of your home location there — not to your coworkers or to other Managers.

Membership in a Business. Your role (Owner, Manager or Employee), status (invited, active or deactivated), home location, department and position, and optionally an employee code and hire date. For invitations: the invited email address and name, and who sent the invitation.

Work data. Shifts and breaks, shift notes, open shifts you claim or decline, weekly availability and exceptions, time-off requests and their reasons, shift swap requests, decisions on requests and who made them, a log of changes to published shifts, tasks and their completion, announcements, and which announcements you have read. The people who post an announcement, the Owners, and Managers in its audience can see who has read it.

Pay rates and labor cost. If an Owner enters hourly pay rates, Akordo stores each rate with the date it took effect and calculates estimated labor cost from scheduled shifts. Only Owners can see or change this — never Managers or Employees, including about themselves.

Notifications. The notifications Akordo creates for you, whether you have read them, your email and push notification settings, and a queue of emails and push messages waiting to be sent.

Push notifications. If you turn on push notifications on a device, we store that device's push address and encryption keys, and your browser's description of the device (user agent), so we can send it notifications.

Billing. For each payment: the plan, amount, currency, transfer date, our reference code, the bank reference and any note you enter, which Owner submitted it, and whether we approved or rejected it. We keep a history of the Business's subscription status. We never handle card details.

Support messages. When you contact support from the app, we store your message together with your name, email, role, language and which Business you wrote from, so we can answer.

Technical data. Like any website, our hosting provider receives technical information with every request — such as your IP address, browser type and the page requested — to deliver pages and protect the service. Our authentication provider keeps security logs of sign-ins. We also use a small set of strictly necessary cookies and browser storage, listed in our Cookie Policy.

• We don't sell or rent personal data.
• We don't show advertising or use advertising trackers.
• We don't use analytics or tracking tools. No analytics cookies, no third-party tracking scripts.
• We don't use your data to train AI models or build profiles of you.

Akordo currently uses no analytics service of any kind. If that ever changes, we will update this section, our Cookie Policy and our sub-processor list before it is switched on.

• To provide Akordo — run Accounts and Businesses, show each person the right information, send notifications and reminders. Basis: performing our contract with you or the Business, and, for staff data, the Business's instructions.
• To bill — match bank transfers, manage trials and subscription status. Basis: our contract, and our legal obligations to keep financial records.
• To keep the service secure — prevent abuse, investigate problems, keep logs. Basis: our legitimate interest in a safe, working service.
• To support you — answer messages you send. Basis: our contract, and our legitimate interest in helping our customers.

We apply the Law on Protection of Personal Data of the Republic of Kosovo and follow the standards of the EU General Data Protection Regulation (GDPR), on which it is based.

Access inside a Business follows roles, and it is enforced by the database itself, not just by the app's screens:

• Owners see everything in their Business, across all locations.
• Managers see and manage only the locations they are assigned to. They cannot see pay rates or labor cost.
• Employees see the published schedule of their own home location, their own requests and tasks, and announcements addressed to them. A shift's note is visible to an Employee only on their own shift. Draft schedules are hidden from Employees until they are published.

One Business can never see another Business's data. If you belong to several Businesses, each one sees only your membership in it.

To run and support the service, a small number of Akordo administrators can see a directory of Businesses, their billing status and payments, and support messages.

We use a few trusted providers to run Akordo. They process data only on our instructions:

• Supabase — database, login and file storage. Akordo's database and files are hosted in Supabase's Frankfurt, Germany (EU) region.
• Cloudflare — hosting of the application and website on its global network, and a page cache. Requests are handled at the Cloudflare location nearest to you.
• Resend — sending notification emails. Resend is based in the United States, so the email address and the contents of a notification email pass through the US.

The full, current list is in our sub-processor list. Where data leaves the EU, we rely on our providers' standard safeguards for international transfers, such as the EU Standard Contractual Clauses.

We share personal data with anyone else only if the law requires it — for example, a valid order from a court or authority.

Some data is deleted automatically, every day:

• emails and push messages already sent, or that failed, are removed from the sending queue after 14 days;
• notifications are deleted 60 days after you read them, and unread ones after 120 days;
• "not interested" marks on open shifts are deleted 7 days after the shift started;
• a device's push subscription is deleted when you turn push off on it, or when the push service tells us the device no longer exists.

Other data is kept while the Business uses Akordo, because it is the Business's working history: schedules, requests and decisions, tasks, announcements, and the change log of published shifts. When a team member is deactivated, their access ends but the Business's records about their past work stay. Invitations expire after 7 days.

If a Business stops paying, its data is kept, frozen, until the Owner pays again or asks us to delete it. We don't delete it automatically.

You can ask us to delete your Account, and an Owner can ask us to delete their Business, at support@akordoapp.com. We handle each request individually and confirm by email when it is done. We keep payment records, the subscription status history and our administrators' action log for as long as we need them for accounting, legal obligations and resolving disputes. Support messages are kept while we need them to handle your request and our support history.

Every request travels over an encrypted connection (HTTPS). Passwords are stored only as secure hashes by our authentication provider. Each Business's data is isolated from every other Business at the database level, and access within a Business is limited by role, as described above. Pay rates are restricted to Owners at the database level. No system is perfectly secure, but if we learn of a breach that affects your data, we will tell you and, where required, the authorities.

You have the right to access the personal data we hold about you, to correct it, to have it deleted, and to restrict or object to how it is used. To get a copy of your data, write to us and we will send it to you. You can change your name, photo, phone, language and notification settings yourself in your profile at any time.

For anything else, write to support@akordoapp.com. If your request is about data a Business holds about you as its staff member, we will pass it to that Business, or help it respond, because it decides about that data.

You also have the right to complain to the data protection authority — in Kosovo, the Information and Privacy Agency.

Akordo is a tool for businesses and their working staff. It is not meant for children, and we don't knowingly collect data from them.

We may update this policy as Akordo changes. The date at the top shows the last change. If a change is significant, we will email users before it takes effect.

Privacy questions or requests: support@akordoapp.com.