Privacy Policy
Version 2026-10-20-v5
1. Scope and roles
Under the General Data Protection Regulation (GDPR): • ByteSense is the data controller for the personal data of the account holder (the person who creates the account, sets up the subscription and communicates with us). • ByteSense is the data processor for the personal data that customer companies enter into Zelo about their staff and their clients.
2. Personal data processed
A. Account holders (controller: ByteSense) • Company name, person's name, email, phone, subscription status and records of document acceptance (version and timestamp). B. Staff and system users (controller: the Customer) • Profile: name, email, interface language and system roles; managers also give a contact phone number. Zelo does not collect other staff members' phone numbers, nor anyone's home address, PPS number, banking or health data. • Work records: check-in and check-out times, the device's GPS position and estimated accuracy recorded only at those two moments, distance to the client's address, and whether the device was inside or outside the geofence. • Logs and corrections: manual corrections made by managers with a written justification; a rolling 90-day log of every check-in attempt (time, GPS, accuracy, distance, result); and a log of who opened a client's confidential information and when. C. Clients of the Customer / householders (controller: the Customer) • Name, address, Eircode, phone, email, operational notes and geographic coordinates derived from the Eircode. • Confidential access information: alarm or key-safe codes, shown to the assigned cleaning team only within a time window around the scheduled visit. • Media: photos taken during visits and incident or damage reports, which may incidentally show people.
3. Purposes
Data is processed only to provide the contracted service: managing client lists and teams, weekly route planning, validating attendance through GPS check-ins and handling support. We do not sell data or use it for advertising.
4. GPS and location
Zelo does not track anyone in real time. Location is read only when a staff member taps check-in or check-out on their phone, solely to confirm they are at the client's address. The Customer is responsible for having a legal basis and for informing its staff about this processing under Article 13 GDPR.
5. Infrastructure providers and location
Data is stored on servers in the European Union (Ireland). We use the following providers: • Supabase, Inc.: database, user authentication and photo storage, in the EU region (Ireland). • Vercel, Inc.: app hosting; server functions pinned to Dublin, Ireland; the edge network is global. • Stripe (Stripe Payments Europe, Ltd., Ireland): sells and bills subscriptions as merchant of record, through Stripe Managed Payments and Link. It receives the account holder's email and payment details, which Zelo never sees or stores; Zelo only keeps the Stripe customer and subscription identifiers. • Resend, Inc.: transactional emails, Ireland region. • Cloudflare, Inc.: bot protection (Turnstile) on the login and sign-up pages, global network. • Google LLC (Geocoding API): converts a client's Eircode into coordinates and receives only the Eircode. Zelo keeps the resulting coordinates for at most 30 days, as required by Google's EEA terms. International transfers: where a provider is a US-headquartered company, transfers rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
6. Retention
• Check-in attempt log: deleted automatically after 90 days. • Coordinates from the Eircode: renewed or deleted within 30 days; replaced by the cleaner's GPS position after the first valid check-in. • Staff records and deletion: kept while the company keeps the person active. When a person is deactivated, their data is kept but hidden from day-to-day screens. A manager can permanently erase that person's profile, login and attendance records; the related visits, incident reports and photos are kept for the company's records, with the author shown as "Removed person". The app warns if the last work record is less than 3 years old (Irish Organisation of Working Time Act) but does not block the deletion. • Account closure: there is no automated self-service account deletion yet, so data is kept while the account is active. On an explicit request to close the account, the operator deletes the company's database records and stored files manually within thirty (30) days, subject to any retention required by Irish law.
7. Data subject rights
People whose data was entered into Zelo by a company should contact that company first; we help the company answer requests for access, correction or deletion. Questions about data where ByteSense is the controller: privacy@zelo.ie. Anyone can lodge a complaint with the Data Protection Commission in Ireland.