Privacy policy
In short
- Calls, staff names, messages and history stay on the venue's Wi-Fi. We cannot see them and they never go through our servers.
- Live voice is not recorded and not stored. A voice message is held encrypted and temporarily (at most 10 minutes), only until it has been heard, then erased; there is no sound history.
- Team messages are kept encrypted on the station and on the phones for 7 days, then deleted.
- All that reaches us: licence facts from Google Play (as a one-way code, no email or name), what you email us yourself, what you type into the "first 10 venues" form on the website, and the website's technical logs.
- The venue (the employer) is responsible for its staff data; we are responsible for the licence, support email and the website.
- "First 10 venues" form: email, business name, city and country, type and number of staff, and whether the team uses iPhones. Kept in a Cloudflare database in the EU and deleted when you ask at support@passbell.app.
- No ads, no tracking cookies, no analytics.
- For any request: support@passbell.app. You can complain to a data protection authority (in Greece www.dpa.gr).
1. Who we are
Controller for what sections 7 to 10 describe: TODO_COMPANY, TODO_ADDRESS. Email: support@passbell.app. We have not appointed a Data Protection Officer because our processing does not require one.
2. Who is responsible for what
PassBell is software that the venue installs on its own devices. The venue (the employer) decides who joins the team and how the app is used, so it is the controller for staff data (sections 3 to 6). We have no access to that data.
If you work at a venue that uses PassBell, contact your employer first about shift data. If you write to us, we will help you find the right recipient.
3. What stays in the venue
- Staff names and devices: the name the venue types, a device id and the pairing code. Kept until the person is removed.
- Calls: who was called, when, whether it was delivered and answered. History is kept 30 days by default (the venue can change it).
- Per-person statistics: off by default. If the venue turns them on, it must inform its staff.
- Team messages: text up to 500 characters, sender, recipients and delivered/seen ticks. Encrypted on the station and the phones, deleted after 7 days (at most 1,000 per station), never included in the backup. The sender or the station can delete a message for everyone.
- Watch: the notification also shows on the watch through the phone; you control this in the phone's settings.
- All of this travels only over the local network and works without internet. Legal basis for the venue: its legitimate interest in running the shift, or the employment contract (GDPR Art. 6(1)(f) or (b)). Staff are not asked for "consent".
4. Voice and push-to-talk
When you hold the voice button, PassBell uses your microphone and sends the sound directly to the other PassBell devices of your team on the same Wi-Fi network. The microphone is never used when the app is not on the screen or the button is not held, and there is no background microphone service.
The sound does not go to the internet and is not recorded as a file or history. Live voice (push-to-talk) is not stored at all. A voice message (hold and send) has to reach everyone: until they have heard it, the station and the sender's phone keep it encrypted (AES-128-GCM) and temporarily, in memory or in a device file, for at most 10 minutes. When everyone has heard it or the time is up, it is erased. Everything that travels on the local network (calls, messages, live voice and voice messages) is encrypted; still, use the staff Wi-Fi, not the guest network.
5. Backup in Google Drive
If you turn it on, the station saves an encrypted copy of its setup (stations, groups, names, paired phones; no history, no messages) in a hidden app folder of your own Google Drive. The key is derived from the manager PIN. We have neither access nor the key; Google keeps it as the provider of your own account. The copy is deleted when you delete it in Google Drive settings (Manage apps).
6. Google sign-in on the station
The manager can sign in with a Google account on the station, for the Drive backup and to recognise the licence. The email is shown only on the station screen. No email or name reaches us, only the one-way code in section 7.
7. The licence server
To check that the app is a genuine Google Play install and which plan is paid for, our server keeps, per account: a one-way hash of the Play account id (not the email or the name), the plan facts from Google Play (product, state, expiry), a hash of the purchase token, the seat and a hash of the station install id, the venue id, timestamps and the Play Integrity verdict. It stores no email, name, phone number, IP address, device model or call content. IP addresses are used in memory only, for rate limiting.
Legal basis: performing the licence contract (GDPR Art. 6(1)(b)) and our legitimate interest in preventing fraud (Art. 6(1)(f)). This data is pseudonymous, not anonymous. A record is deleted automatically 400 days after its last change. A Free station is never stored. Calls, messages and voice never go through this server.
8. Purchases on Google Play
Google takes the payment under its own terms and privacy policy. We never see card details, name or address; we receive only the plan state (section 7) and aggregated sales reports for our accounting (legal obligation).
9. Support email and "Send diagnostics"
If you tap "Send diagnostics" or write to us, we receive your email address, your message and, in a diagnostic, the app and Android versions, device model, role, station name, link quality, which checks fail and how many recent calls there were. Never passwords, keys or staff names. Nothing is sent unless you tap it. Legal basis: legitimate interest in answering your request. We keep the correspondence for 12 months.
10. This website
It uses no cookies, no analytics and no external fonts. The host (Cloudflare) briefly logs technical details of each visit (IP address, browser, page) for security and operation. Legal basis: legitimate interest. "First 10 venues" form: if you fill it in, we receive your email and, if you type them, your business name, city and country, type of business and number of floor staff, and, if you tick it, that some of your team use iPhones. We keep them in a Cloudflare database stored only in the EU so we can write to you about PassBell, until you ask us to delete them. To have them deleted, write to support@passbell.app. Legal basis: your consent (the tick box "You may write to me about PassBell"), which you can withdraw at any time. The form sets no cookies and uses no tracking. Referrals: a referral code contains no names, and in the app only the code is stored. On the form we keep the "Who referred you?" line only if you fill it in.
11. How long data is kept
| Data | Where | Kept |
|---|---|---|
| Staff names and devices | Station | Until the person is removed |
| Call history | Station | 30 days (default) |
| Team messages | Station, phones | 7 days, up to 1,000 |
| Voice message | Station and sender's phone (encrypted) | Until heard, at most 10 minutes |
| Live voice | Local network | Not kept |
| Backup | Your Google Drive | Until you delete it |
| Licence record | Licence server | 400 days after last change |
| IP address at the server | Memory | Not stored |
| Support email | Our mailbox | 12 months |
| Website logs | Cloudflare | A few days, as set by the host |
| "First 10 venues" form data | Cloudflare (EU) | Until you ask for deletion |
12. Recipients and transfers outside the EU
We use Google (Google Play, Play Integrity, Google Cloud for the licence server), Cloudflare (website hosting, and the list from the "first 10 venues" form, stored in the EU). The licence server will run in an EU region. These companies belong to US groups; where data is transferred, it relies on the EU-US Data Privacy Framework or the Commission's Standard Contractual Clauses (GDPR Art. 45 and 46). We do not sell or share data for advertising.
13. Security
Pairing uses a QR code and the manager's approval, and calls and messages are encrypted on the local network. Messages and the backup are stored encrypted (AES-256). The server keeps only hashed codes. No system is perfectly secure: lock the station with a PIN, keep devices updated and remove people who leave. If a breach affects you, we will inform the authority and, where required, you.
14. Your rights
You have the right of access, correction, deletion, restriction, portability and not to be subject to decisions based solely on automated processing. Write to support@passbell.app; we answer within one month. To find a licence record without an email, we will ask for the id the station shows in its settings.
Right to object: where we rely on legitimate interest, you can object at any time on grounds relating to your particular situation (GDPR Art. 21).
Deletion (step by step: Delete your data): on the station, "Remove person" deletes the pairing and "Clear all" deletes messages; uninstalling deletes everything from the device. For the licence record, write to us; we delete it unless we must keep it for an active subscription or fraud prevention, and we will tell you so.
You can complain to the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr) or to the authority of your country.
For venues: a ready staff notice template.
15. Children
PassBell is a business tool and is not directed at children. We do not knowingly collect data of children under 16.
16. Changes
If something material changes, you will see it in the app and here before it applies. The date at the top shows the last change.