Privacy Policy

This Privacy Policy describes how BoltOrigin ("we", "us", or "our") collects, uses, and protects your personal data when you use the WageWarden application ("App"). We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Dutch implementation law (Uitvoeringswet AVG).

BoltOrigin is based in the Netherlands and operates under Dutch and European law.

The data controller for your personal data is:

BoltOrigin
[Address to be added upon company registration]
The Netherlands
KvK: [To be added upon registration]

For questions about this privacy policy or your personal data, you can contact us at: privacy@boltorigin.com

3.1 Data you provide to us

When you create an account:

• Name
• Email address
• Profile picture (optional)
• Timezone (optional)

3.2 Data you enter in the App

Work and shift data:

• Jobs (name, employer, hourly rate, currency)
• Shift types (name, color, default start/end time, breaks)
• Shifts (start/end time, notes)
• Premium rules (bonuses for evening/night/weekend shifts)
• Holidays

Team and social features (optional):

• Team name and description
• Display name within teams
• Shared schedules
• Shift trade requests

3.3 Automatically collected data

• Device ID (for synchronization)
• App version
• Platform (Android/iOS)
• Push notification tokens (if you enable notifications)
• Last synchronized timestamp

3.4 Purchase data

If you purchase premium features:

• Transaction ID
• Purchase platform (Google Play/App Store)
• Purchase date
• Validation status

We process your data for the following purposes:

Performance of contract (Art. 6(1)(b) GDPR)

• Providing App functionality
• Synchronizing data between your devices
• Processing premium purchases
• Providing customer support

Legitimate interest (Art. 6(1)(f) GDPR)

• Improving and optimizing the App
• Fraud prevention and security
• Technical debugging

We have conducted a balancing test and determined that our legitimate interests do not override your privacy rights, as this processing is strictly necessary for a secure and well-functioning App and involves minimal personal data.

Consent (Art. 6(1)(a) GDPR)

• Sending push notifications (you can disable this at any time)
• Sharing your schedule with team members

Automated decision-making (Art. 22 GDPR)

WageWarden does not use automated decision-making or profiling as defined in Article 22 GDPR. All decisions regarding your data are made by humans or are purely functional (such as calculating your earnings based on the data you enter).

5.1 Local storage

The App works primarily offline. Your data is stored locally on your device using encrypted SQLite databases.

5.2 Cloud synchronization (optional)

If you create an account, your data is synchronized with our servers hosted in the European Union. We use:

• Encrypted connections (TLS 1.3)
• Encrypted storage
• Access control based on user authentication
• Regular security audits

5.3 Data processors

We use the following service providers:

• Hosting provider (EU-based)
• Google Firebase (for push notifications) - subject to EU-US Data Privacy Framework
• Apple Push Notification Service (for iOS notifications)

5.4 Data sharing

We do not sell your data and do not share personal data with third parties for advertising or marketing purposes. Data is only shared with processors that are necessary for the operation of the App, as listed above.

• Account data: Retained as long as your account is active
• Shift and work data: Retained as long as your account is active
• Purchase data: 7 years (legal retention requirement)
• Technical logs: Maximum 90 days

After account deletion, your data will be permanently deleted within 30 days, except where legal retention requirements apply.

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request a copy of all data we hold about you.
• Right to rectification (Art. 16 GDPR): You can have incorrect data corrected.
• Right to erasure (Art. 17 GDPR): You can request deletion of your data ("right to be forgotten").
• Right to restriction (Art. 18 GDPR): You can request restriction of processing of your data.
• Right to data portability (Art. 20 GDPR): You can request your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You can object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw previously given consent at any time.

To exercise your rights, contact us at privacy@boltorigin.com. We will respond within 30 days.

In the App

You can delete your account and all associated data via Settings > Account > Delete Account.

What gets deleted

• Your user account and profile
• All jobs, shifts, shift types, and premium rules
• Team memberships (teams are not deleted if you are not the owner)
• Shared schedules
• Shift trade requests
• Synchronization data
• Push notification tokens

What is retained

• Purchase data (7 years, legal requirement)
• Anonymized statistical data

After account deletion, you can still use the App in offline mode without an account.

The App itself

The WageWarden mobile app does not use cookies. We use:

• Local storage for app settings
• Secure storage for authentication tokens

This website

This website (wagewarden.app) only uses functional cookies for:

• Theme preference (light/dark mode)
• Language preference

We do not use tracking cookies or analytics on this website.

Cross-app tracking

We do not use your data for tracking across third-party apps or websites. Your data is only used within WageWarden for the purposes described in this policy.

Your data is primarily stored within the European Economic Area (EEA).

For push notifications, we use:

• Google Firebase Cloud Messaging: Google LLC is certified under the EU-US Data Privacy Framework
• Apple Push Notification Service: Apple Inc. uses Standard Contractual Clauses (SCCs)

We ensure all international data transfers comply with GDPR requirements for adequate protection.

WageWarden is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and discover that your child has provided data to us, please contact us at privacy@boltorigin.com.

We may update this privacy policy from time to time. For significant changes:

• We will send a notification via the App
• We will post a notice on this website
• We will update the "Last updated" date

We recommend reviewing this policy regularly.

If you have complaints about how we process your data, you can:

1. Contact us at privacy@boltorigin.com
2. File a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
   • Website: autoriteitpersoonsgegevens.nl
   • PO Box 93374, 2509 AJ The Hague, Netherlands

You also have the right to file a complaint with the supervisory authority in your EU member state of residence or place of work.

For questions about this privacy policy or your personal data:

BoltOrigin
Email: privacy@boltorigin.com

We aim to respond to general inquiries within 5 business days and to GDPR requests within 30 days.