Legal
Kupaly privacy policy
Kupaly holds rotas and staff records for other people's businesses, and it talks to the people who run them. Who answers for that data depends on whose it is, so this policy starts there.
Who we are
Kupaly is made and operated by Neirfeno Limited.
| Who runs Kupaly | Neirfeno Limited |
|---|---|
| Company number | SC514019, registered in Scotland |
| Registered office | 7 Thorter Way, Dundee, DD1 3DF |
| Support and data protection | support@kupaly.com |
| ICO registration | ZB673603 |
This policy covers the Kupaly preview in the browser at app.kupaly.com, and this website. It should be read alongside our terms and conditions, which contain the data-processing terms between us and the businesses that use Kupaly.
Who controls what
This is the part that decides who you should go to, so it comes first.
Kupaly is used by businesses to manage their own staff. That produces two different sets of data with two different people answerable for them.
| Data | Who is the controller | Our role |
|---|---|---|
| Rotas, shifts, shift notes, availability, holidays, team lists, roles, locations, the rules the business tells the assistant, and the chat used to write them | The business you work for | We are its processor — we hold and handle this on the business's instructions and do not use it for our own purposes, except the preview-improvement use described below |
| Your sign-in and account record, support messages you send us, analytics, security logs, and how you interact with the preview | Neirfeno Limited | We are the controller |
If you are a member of staff and your question is about your rota, your hours, your availability or your holidays, ask your employer first. They decide what goes in, what it is used for and how long it is kept. We cannot change or delete their records on your say-so, and it would be wrong of us to — but we will help them respond to you, and we are required to.
If your question is about your sign-in, an email you sent us, or Kupaly itself, come to us at support@kupaly.com.
What we collect
Your account
You may sign in with Google, with Apple, or with an email address and password. From Google or Apple we receive an account identifier and your email address. If you use Sign in with Apple and hide your email, we receive Apple's relay address and that is all we see from them. Where you create an email-and-password account, we hold the email address and a hashed password — we never hold the password in a form we can read.
A User who has been given a share code may enter the preview anonymously. We then hold only the fact of that session until an email and password are added, or the session ends.
We also hold which business or businesses you belong to and your role in each — whether you are staff or run the place.
What the business puts in
Under the business's control, Kupaly holds team members' names and roles, the locations they work at, published rotas and shift assignments, notes attached to a shift, availability, holiday and time-off records and their approval, the working-time and cover rules the business tells the assistant, and the chat used to draft and change the rota.
The business decides what goes in here. If it enters something it should not — a health detail in a shift note or in chat, for example — that is its responsibility as controller, and we would ask it to stop.
How you use the preview
We may use how you interact with the preview — which screens you open, what you ask the assistant, whether a draft is approved or sent back — to improve the product. That use is part of joining the preview programme, and the app tells you so before you accept these documents.
Your device
If you turn on notifications, we hold a push token for your device so we can send you a shift alert. You can turn this off in your browser or phone settings at any time, and the token stops working.
We collect technical information through Google Analytics for Firebase: app version, device model, operating system version, language, approximate location derived from your IP address at country or city level, a randomly generated instance identifier, and which screens are used. Your consent governs this — see analytics and your device.
What we do not collect
Kupaly does not track where you are. It has no clock-in or clock-out feature, it does not record your position when you are working or at any other time, and it does not record audio.
We do not monitor individual staff for the business, and we do not build a productivity or attendance profile of anyone.
When you contact us
If you email us, we hold your email address or account identifier, what you wrote, and anything you include.
Why we use it, and our legal basis
These bases are the ones we rely on for the data we control. For rota and staff data, the business is the controller and it decides the basis — usually the performance of your employment contract, or its own legitimate interests in running the place.
| What we do | Data | Legal basis |
|---|---|---|
| Sign you in and connect you to the right business | Account, membership | Performance of a contract |
| Provide Kupaly to the business | Rota, staff and assistant-chat data | The business's instructions, under our contract with it |
| Improve the preview | How you interact with Kupaly | Legitimate interests — making the preview better for the businesses on it. You are told this before you accept |
| Send you a notification about a shift | Push token | Consent, given by turning notifications on |
| Keep the service secure and stop abuse | Account, technical | Legitimate interests — protecting the service and its users |
| Answer your support message | Your correspondence | Legitimate interests — dealing with an enquiry you sent |
| Understand which features are used, and fix what is broken | Analytics | Consent |
| Meet legal obligations and defend legal claims | Whatever is relevant | Legal obligation, and legitimate interests |
Analytics and your device
Analytics involves storing and reading information on your device, which under the Privacy and Electronic Communications Regulations needs your consent. It is not necessary to run Kupaly — the preview works fully without it — so we ask, and you can decline.
You can withdraw consent at any time. Withdrawing stops further collection. We do not use advertising SDKs or cross-app tracking in Kupaly.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. Our sub-processors are:
| Provider | What they do for us |
|---|---|
| Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage) | Sign-in, the database, the server logic and file storage |
| Google (Firebase Cloud Messaging) | Delivering push notifications |
| Google (Analytics for Firebase) | Usage analytics, only where consented |
| Google Workspace | Our support mailbox |
Within Kupaly, your rota data is visible to the people your employer gives access to — normally the managers and owners of the business you belong to, and colleagues where the business publishes a shared rota. Your employer controls that.
Google and Apple act as controllers in their own right for the sign-in you use, under their own policies.
Otherwise we disclose data only where legally required — a court order, or a lawful request from a regulator or law enforcement — or to our professional advisers under a duty of confidence, or to a buyer if the business is sold, in which case we would tell customers first.
Where it is kept
Accounts, rotas and staff records are stored in the United Kingdom and the European Economic Area.
Analytics is the exception: Google processes it on servers in the United States. That transfer is covered by the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, which forms part of our contract with Google. Decline analytics and none is collected, so none is transferred.
How long we keep it
| Data | Kept for |
|---|---|
| Rota and staff data | For as long as the business's account is open. When a business closes its account we delete it within 90 days, unless the business asks for it back first. The business may ask us to delete sooner. |
| Your account and sign-in record | While you have a role in at least one business. Deleted within 30 days of you asking — see deleting your account. |
| Preview-improvement records | While the preview is running, then deleted or anonymised within 90 days of the preview ending, unless we must keep a record of acceptance. |
| Analytics | Up to 14 months from collection, then deleted automatically. |
| Support correspondence | 24 months from the last message. |
| Encrypted backups | Deleted data persists in backups for up to 90 days before being overwritten. |
Your employer may have its own obligation to keep working-time records — under the Working Time Regulations 1998 that is two years. That is its duty and its retention decision, not ours.
Your rights
UK data protection law gives you rights over the personal data we hold about you. They are not all absolute: some apply only in particular circumstances, and some are limited where we have to keep data to meet a legal obligation or to establish, exercise or defend a legal claim.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and for an explanation of how and why we use it. |
| Rectification | Have inaccurate data corrected, and incomplete data completed. |
| Erasure | Ask us to delete your data — for example where we no longer need it, where you withdraw consent we were relying on, or where you object and we have no overriding grounds to continue. |
| Restriction | Ask us to stop using your data, while keeping it, when you are contesting its accuracy or our grounds for holding it. |
| Objection | Object to processing we carry out on the basis of our legitimate interests. Where we process for direct marketing, your objection is absolute and we must stop. |
| Portability | Receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another provider where that is technically feasible. |
| Withdraw consent | Withdraw consent at any time where consent is the basis we rely on. This does not affect the lawfulness of processing carried out before you withdrew it. |
| Automated decisions | Not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. |
To exercise any of these, email support@kupaly.com. We may need to confirm your identity before we act, so that we do not disclose your data to somebody else. We respond within one month. We can extend that by a further two months where a request is complex or where you have made several — if we need to, we will tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we have a chance to put it right, but you do not have to.
One qualification specific to Kupaly: for rota, shift, availability, holiday and assistant-chat data, your employer is the controller, so exercise those rights against your employer. If you ask us, we will tell you and pass the request on, but the decision is theirs to make.
Security
Data is encrypted in transit and at rest. Our database rules separate each business's records, so one business cannot read another's, and a member of staff cannot read a business they do not belong to. Access to production systems is restricted and protected by multi-factor authentication.
No system is perfectly secure. Where we are the controller and a breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it and tell you directly if the risk is high. Where we are the processor, we will tell the business without undue delay so it can meet its own obligations.
Young workers
You must be at least 16 to hold a Kupaly account. A business may lawfully employ someone younger under the rules on child employment, but they should not be given an account — the business should manage their shifts outside Kupaly.
Automated decision-making
Kupaly drafts rotas and suggests cover from the rules and team the business has given it. Those drafts are shown for a person at the business to approve. That is not a solely automated decision that produces legal effects concerning you or similarly significantly affects you. The business remains responsible for what it publishes.
Changes to this policy
When we change this policy we publish it with a new version date. Where a change materially affects how we use data we will tell affected businesses by email or in Kupaly before it takes effect, and where a change needs consent we will ask rather than assume.
Contact us
Email support@kupaly.com or write to Neirfeno Limited, 7 Thorter Way, Dundee, DD1 3DF.