← Back to home

Privacy Policy

Last updated: September 2026

1. Introduction

Qrew (“we”, “our”, “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our time-tracking SaaS platform and related services.

We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable Italian data protection legislation.

2. Data Controller

The data controller is Arcanode di Alessandro Pasqualetti, trading as Qrew, registered office at Via Corte, Panicale — 55041 Camaiore (LU), Italia, VAT number IT02755170467. You can contact the data-protection point of contact at [email protected].

No Data Protection Officer (DPO) is appointed: the controller does not meet the criteria of Art. 37 GDPR. Requests under the data-subject rights below are handled directly by the controller.

3. Data We Collect

  • Account data: name, email address, phone number, company name.
  • Worker data: phone number, display name, clock-in/out timestamps, GPS coordinates (captured only at clock-in/out and during active sessions for geofence boundary checks — no continuous location trail is stored), device identifiers.
  • Biometric & verification data: verification photos (base64-encoded, stored in the application database), liveness-detection scores, WebAuthn passkey credentials.
  • Device fingerprint data: canvas rendering hash, WebGL vendor/renderer, AudioContext fingerprint, screen resolution, timezone, hardware concurrency, installed fonts, browser plugins — used exclusively for anti-spoofing and device-trust scoring (see Section 4 below).
  • Usage data: session durations, location assignments, payroll calculations, penalty records, break records, compliance audit logs.
  • Billing data: the approximate country inferred from your request IP address (via Cloudflare) at checkout, used solely to present and charge prices in a local currency (EUR, GBP or USD). No precise location is stored and the inference is not used for any other purpose.
  • Server & security logs: when you reach our websites or API, the web server records connection metadata in its access log — your IP address, the date and time, the requested resource, the HTTP status, the volume transferred, and the browser and referring-page information (User-Agent and Referer). Your IP address is additionally stored in the application’s authentication, signup and compliance audit records as a security and legal-obligation measure. This data is used only to keep the service secure, to investigate abuse, and to measure traffic in aggregate (see Sections 7 and 8); it is never used to build an individual profile of a visitor. Aggregate traffic statistics are produced on our own server with AWStats, which hashes visitor addresses and resolves country-level geolocation locally.

4. Legal Basis for Processing

  • Contract performance: processing necessary to provide the time-tracking service.
  • Legitimate interest: fraud prevention, security, service improvement.
  • Consent: push notifications, optional photo verification.
  • Legal obligation: compliance with employment law record-keeping requirements.

5. Data Retention

Personal data in the operational database is retained for the duration of the worker's active employment plus 30 days, during which period workers may view, export, or delete their data via the Privacy Dashboard.

Payroll-relevant records (session durations, hourly rates, overtime calculations) are retained for 10 years as required by Italian civil-law record-keeping obligations (Art. 2949 Codice Civile). Audit logs and chain-of-custody records are likewise retained for 10 years for tribunal-ready compliance evidence.

Verification photos are deleted alongside the worker's session data when they exercise their right to erasure (see Section 6). Photos are stored in the application database and are accessible only to the owning admin (the tenant that created the workplace).

You may request earlier deletion where permitted by law via the in-app Privacy Dashboard or by contacting [email protected].

6. Your Rights (GDPR)

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)

To exercise your rights, contact [email protected].

7. Data Processors & Sub-Processors

We use the following sub-processors to deliver the service:

  • Stripe (payment processing) — EU-based data centres with Standard Contractual Clauses for any sub-processing outside the EEA.
  • WAHA (WhatsApp HTTP API) — used to deliver clock-in PIN verification messages and push notifications to workers. Phone numbers and message content are transmitted to Meta Platforms Ireland Ltd under their Business Policy. See WhatsApp's privacy policy.
  • Mailcow self-hosted email server — transactional email (OTP codes, billing receipts).
  • Cloudflare — content delivery network and reverse proxy that sits in front of qrew.it, app.qrew.it and api.qrew.it. Cloudflare terminates TLS at its edge, filters abusive traffic, and forwards requests to our server; it also supplies the country-level inference used for billing (Section 3) and may set the technical cookies described in our Cookie Policy. Processing runs within Cloudflare’s network. See Cloudflare's privacy policy.
  • Contabo — our API, application and database are hosted on a Contabo VPS located in Germany (EU). Database files are stored on encrypted-at-rest volumes.
  • AWStats — a free, open-source log-analysis tool we run on our own server to produce aggregate, non-identifiable traffic statistics (page hits, countries, browsers). It reads the web-server access log described in Section 3, sets no cookies, hashes visitor addresses in its database, resolves country-level geolocation locally from an IP-to-country file, and shares no data with any third party.

We do not transfer personal data to third countries without appropriate safeguards (EU Standard Contractual Clauses or adequacy decisions).

8. Security

We implement appropriate technical and organisational measures including:

  • Encryption at rest (database volume) and in transit: TLS is terminated at the Cloudflare edge and re-encrypted between the edge and our origin server.
  • HttpOnly, Secure, SameSite=Lax session cookies in production.
  • CSRF protection via double-submit token pattern.
  • Audit logging with HMAC chain-of-custody verification for tribunal evidence.
  • Device fingerprinting and trust scoring for anti-spoofing.
  • Role-based access control (admin can only access data belonging to their own tenant).
  • Regular security reviews.

9. Changes

We may update this policy. Material changes will be communicated via email or in-app notification at least 30 days before they take effect.