Privacy Policy for the App (Servicesoft)

Controller

Ad Revolution AB
Email: info@servicesoft.io

About this policy

This Privacy Policy applies to our SaaS application for time reporting and assignment management (the "App"). It explains what personal data we process, why we process it, how long we keep it, and the choices and rights you have.

Roles and responsibilities

In our relationship with customer organizations (employers), Ad Revolution AB typically acts as a data processor. The customer is the data controller for data about its employees and assignments. For certain processing related to operations, security, billing, and account administration, Ad Revolution AB acts as a data controller.

Data we process

User data: name, email address, user ID, roles/permissions.

Time reports: working time, projects, assignment information.

Assignment data: customer and project information, assignment status.

Technical data: IP address, device and app version, login logs, system usage.

Location & trip logs (new): GPS positions, timestamps, start and stop addresses, and distances generated only in connection with active assignments. The App may collect location data in the background while an assignment is in progress to ensure a complete trip log.

Purposes and legal bases

Contract performance

To deliver App functionality such as time reporting, assignment management, and evidence of completed work.

Trip logs & location data

To create and retain trip logs linked to assignments (e.g., distance, start/stop address) for the customer's operations, follow-up, and finance.

Legal bases: legitimate interests (the customer's need for traceability and assignment/vehicle usage follow-up) and legal obligation on the customer to keep records for accounting/tax purposes under applicable law.

Security & operations

Logging, troubleshooting, and abuse prevention.

Legal basis: legitimate interests.

Legal obligation

Retention of accounting/tax records where required.

Note: In an employment context, consent is generally not relied upon for location processing. Processing is based on contract, legitimate interests, and/or legal obligation. The employer (customer) is responsible for internal policies and informing employees when location collection occurs.

How location collection works

When we collect

Location data is recorded only when a user has an active assignment started in the App. When the assignment is paused or ended, collection stops.

Background mode

To avoid gaps in the trip log, the App may collect location data in the background while the assignment is active—even if the App is not open.

Accuracy

The App may request precise location to correctly determine start and stop addresses.

Visibility & control

Users can see assignment status in the App and can end or pause the assignment. Location permissions can be changed at any time in device settings; doing so may prevent the trip log and certain features from functioning as intended.

Storage and security

Technical storage: Data is stored securely in Supabase (PostgreSQL) within the EU.

Security measures: encryption in transit and at rest (where applicable), access controls, role-based permissions, and continuous security monitoring.

Retention periods:

• Trip logs (including start/stop addresses): 7 years
• Time reports & assignment data: for the duration of the customer contract + 36 months (unless a longer period is required by law)
• Accounting records: up to 7 years under accounting legislation
• User data: while the account is active (and thereafter for up to 12 months for traceability/support)
• Logs: typically 12 months

Data recipients

• Customer organization (employer): as per contract and permissions
• Supabase (EU): database/hosting provider
• Other sub-processors: may be used for operations/security (e.g., log management). A list is available on request. We do not use personal data for marketing without the customer's instructions.

Transfers outside the EU/EEA

Our intent is to process and store personal data within the EU/EEA. If a transfer outside the EU/EEA is necessary, we will implement lawful safeguards (e.g., Standard Contractual Clauses).

Your GDPR rights

You have the right to information, access, rectification, erasure (where applicable), restriction, objection, and data portability. Because we often act as a processor, some rights may need to be exercised via your employer, who is the data controller.

App-specific privacy (iOS – location permissions)

To enable trip logs, the App requires location permissions. iOS will display system dialogs explaining why access is needed. The following Info.plist strings are recommended:

The App may request "Always Allow" so trip logging can continue even when the App is not open — but only while an assignment is active.

Complaints

If you believe our processing violates GDPR, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Contact

Questions about this policy or our processing of personal data: info@servicesoft.io

Last updated: September 9, 2025