Privacy statement

1. Three kinds of people

Visitors of the website (afiyet.co / afiyetapp.co). Venues with an account: the owner or manager who signs up and manages the venue. Employees invited by their venue who use the app for availability, roster and hours.

For visitors and for a venue's account holder we are the controller. For employees the venue is the controller and we are the processor: the venue decides who is in Afiyet and what is recorded. If you work at a venue that uses Afiyet and have questions about your data, your employer is the first point of contact; we help them with it.

2. Website: no tracking

The website sets no advertising or tracking cookies. We only use what is technically needed for the site and the login page to work (for example your language choice).

For visitor statistics on the public pages (home, pricing, switching, signup) we use PostHog on servers in the EU, as our processor: which pages are viewed, from which type of device and country, and where visitors click. Without cookies: a random number lives only in the memory of your browser tab and disappears when you close it. We build no profiles, record no screens and share nothing with advertisers. Inside the app itself (behind the login) we measure nothing.

Clicking the WhatsApp button takes you to WhatsApp, where WhatsApp's privacy policy applies.

3. Venue accounts

At signup we process: name, email address, phone number, venue name and address, Chamber of Commerce number (optional) and your payment details. Payments run through Stripe; we never see or store bank or card numbers, only a reference to your subscription and the invoice status.

Purpose: providing Afiyet, invoicing, support and legal retention duties (we keep invoices for 7 years for the tax authority). Legal basis: performance of the contract and legal obligation.

4. Employee data

The venue enters: name, email address, phone number (optional), date of birth (only for the youth-wage check by age), position, type of employment and hourly wage, start and end date.

Use of the app produces: availability and preferences, rosters, clocked and approved hours, leave and sick reports (type and date only — never a reason or medical information), tip distribution, and push notifications if the employee turns them on.

Location: we process no location data. Clocking in via the QR code or NFC sticker at the venue only records that a scan or tap happened, not where the phone is.

Purpose: scheduling, time registration, tip distribution and the monthly report for the venue's payroll. We never use employee data for our own purposes.

5. Where and how long

Data is stored in the European Union (database and authentication at Supabase in Stockholm). Connections are encrypted; each venue only sees its own data (enforced in the database); changes to hours are logged.

Retention: account data for as long as the subscription runs plus 30 days, then we delete everything, backups within 30 days after that. Invoices 7 years. Employee data for as long as the venue decides; the venue can end employments and have data deleted.

6. Who we share with

Only parties needed to run Afiyet, under a data processing agreement: Supabase (database, authentication — EU), Vercel (app hosting), Stripe (the venue's payments and invoices), Brevo (emails such as invitations and password resets — EU) and the Apple and Google push services (an anonymous device address only, never the content of your roster).

We sell no data and share nothing with advertisers. We give data to authorities only when the law requires it.

7. Your rights

You have the right to access, correct, delete, restrict, object to and transfer your data. Account holders can do much of this in the app; employees ask their venue, or us if that doesn't work.

Email hello@sublimed.io; we respond within 30 days. If you are not satisfied you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Changes

When we update this statement, the new version appears here with a new date. For material changes we inform account holders by email.