Privacy Policy

1. Introduction

This Privacy Policy describes how SMILING ATMOSPHERE ‒ LDA ("Company", "we", "us", or "our"), a company registered in Portugal under NIPC 517944596, with its registered address at Rua Capitão Salgueiro Maia, nº 3, 2925-228 Azeitão, Setúbal, Portugal, collects, uses, and protects your personal data when you use the WorkTime Tracker mobile application ("App").

We process personal data in accordance with the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) and applicable Portuguese data protection legislation.

2. Data Controller

3. Data We Collect

3.1 Account Data

• Authentication data: OAuth provider identifier (Google, Apple, or other OAuth provider), email address, display name, and profile picture URL.
• Profile data: First name, last name, phone number (optional), user role (owner/admin/employee).

3.2 Business Data (for business owners)

• Business name, workplace name, workplace address, workplace code.
• Employee roster and schedule information.

3.3 Time Tracking Data

• Clock-in and clock-out timestamps.
• Shift start and shift end events.
• Break start and break end events.
• Event type, status (approved/pending/rejected), and optional comments.

3.4 Location Data

Location data is collected only at the moment of clock-in or clock-out when the GPS Verification feature is enabled by the business owner.

• We do NOT collect background location data.
• Location is accessed only in the foreground when the employee scans a QR code to register attendance.
• Location data (latitude, longitude, distance to workplace) is used solely to verify that the employee is within the workplace radius.
• The GPS Verification feature is optional and must be explicitly enabled by the business owner. It is available as a paid add-on subscription.

3.5 Camera Data

The App uses the device camera exclusively for scanning QR codes at workplace entrances. We do not capture, store, or transmit photos or videos. Camera access is requested only when the user opens the QR scanner screen.

3.6 Subscription and Purchase Data

The App offers paid subscription plans (Starter, Business) and an optional GPS Verification Add-on, processed through Google Play Billing.

We collect and store the following subscription-related data:

• Subscription plan type (Free, Starter, Business).
• GPS Verification Add-on subscription status.
• Google Play purchase tokens and order identifiers.
• Subscription state (active, cancelled, expired, paused).
• Subscription expiry dates and auto-renewal status.
• Date and time of last subscription verification.

Important: All payment processing is handled exclusively by Google Play. We do not collect or store credit card numbers, bank account details, or any other direct payment information. For details on how Google processes your payment data, please refer to the Google Privacy Policy.

3.7 Device and Notification Data

• Push notification tokens (for shift reminders, late arrival alerts, and administrative notifications).
• Device platform (iOS or Android).

3.8 Data We Do NOT Collect

• Contacts or address book data
• Photos, videos, or media files
• Browsing history
• Credit card numbers or bank account details
• Health or biometric data
• Microphone or audio recordings

We do not use advertising SDKs or tracking libraries, and we do not sell personal data to advertisers.

4. Purpose of Data Processing

We process your personal data for the following purposes:

• User authentication and identification — to securely log you in and identify your account.
• Workplace management — to allow business owners to manage workplaces, employees, and schedules.
• Time tracking — to record working hours, breaks, and generate attendance reports.
• Location verification — to verify employee presence at the workplace during clock-in/clock-out (only when GPS Verification is enabled).
• QR code scanning — to allow employees to register attendance by scanning workplace QR codes.
• Notifications — to deliver shift reminders, late arrival alerts, and administrative messages.
• Subscription management — to manage your subscription plan, process upgrades/downgrades, and verify purchase status with Google Play.
• Reports and analytics — to generate attendance reports and export data for business owners (available on paid plans).

Legal bases for processing include:

• Contract performance (Art. 6(1)(b) GDPR) — processing necessary to provide the App's services.
• Legitimate interest (Art. 6(1)(f) GDPR) — for security, fraud prevention, and service improvement.
• User consent (Art. 6(1)(a) GDPR) — for location data access and push notifications.

5. Subscriptions and In-App Purchases

5.1 Subscription Plans

Plan	Features
Free	Up to 3 employees, basic time tracking, schedules, notifications
Starter	Up to 10 employees, attendance reports, CSV export, charts
Business	Unlimited employees, all features including PDF export, GPS verification, multi-location support

5.2 GPS Verification Add-on

The GPS Verification Add-on is an optional monthly subscription that enables location-based attendance verification. It includes a 3-day free trial period for new subscribers.

5.3 Payment Processing

All subscription payments are processed exclusively through Google Play Billing. We do not process payments directly. Subscription prices are displayed in your local currency as determined by Google Play.

5.4 Auto-Renewal

All paid subscriptions (Starter, Business, GPS Verification Add-on) are auto-renewing. Payment is automatically charged through Google Play at the end of each billing period unless you cancel before the renewal date.

5.5 Cancellation

You can cancel your subscription at any time through:

• Google Play Store → Subscriptions → WorkTime Tracker → Cancel subscription.
• The App's subscription management screen.

Upon cancellation, you retain access to paid features until the end of the current billing period. After that, your account reverts to the Free plan.

5.6 Refunds

Refund requests are handled by Google Play in accordance with Google Play's refund policy. We do not process refunds directly.

6. Data Storage and Security

• All data is stored on secure servers within the European Union.
• Data is encrypted in transit (TLS/SSL) and at rest.
• Access is restricted to authorized users through authentication and role-based access controls.
• Server-side rate limiting and security headers are implemented to prevent abuse.
• Industry-standard security practices are applied, including input validation and XSS protection.

7. Data Retention

• Active accounts: Data is retained while the account exists and the user actively uses the App.
• Deleted accounts: All personal data is permanently removed within 30 days of account deletion.
• Time tracking records: Retained according to applicable employment and labor law requirements.
• Subscription data: Purchase tokens and subscription status are retained for the duration of the subscription and up to 30 days after account deletion for audit purposes.

8. Data Sharing

We do not sell, rent, or trade personal data.

Data may be shared only in the following limited cases:

• Within your organization: Business owners and administrators can view employee time tracking data for their workplace.
• Google Play: Subscription purchase tokens are verified with Google Play Developer API to confirm subscription status.
• Infrastructure providers: Essential cloud hosting and database services that process data on our behalf under data processing agreements.
• Legal requirements: If required by law, court order, or legal process.

9. Third-Party Services

Service	Purpose	Data Shared
Google Play Billing	Subscription payment processing	Purchase tokens, subscription status
OAuth Providers (Google, Apple)	User authentication	Authentication tokens, email, name
Push Notification Services (FCM/APNs)	Delivery of notifications	Device push tokens, notification content
Cloud Hosting Provider	Data storage and server infrastructure	All app data (encrypted)

Each third-party service processes data according to its own privacy policy. We encourage you to review the privacy policies of these services.

10. Your Rights (GDPR)

Right	Description
Right of access (Art. 15)	Request a copy of your personal data
Right to rectification (Art. 16)	Correct inaccurate personal data
Right to erasure (Art. 17)	Request deletion of your personal data
Right to restriction (Art. 18)	Restrict processing of your data
Right to data portability (Art. 20)	Receive your data in a portable format
Right to object (Art. 21)	Object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3))	Withdraw consent at any time

To exercise your rights:

• Account deletion: Use the in-app feature (Profile → Delete Account).
• Data requests: Email us at admin@smilingatmosphere.pt.

We respond to all requests within 30 days.

11. Children's Privacy

The App is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we discover that we have collected data from a child under 16, it will be deleted immediately.

12. International Data Transfers

Data is processed within the European Union. If transfers outside the EU are necessary, appropriate safeguards such as Standard Contractual Clauses (SCCs) will be used in accordance with GDPR requirements.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Users will be notified through the App or by email if significant changes occur. The "Last Updated" date at the top of this policy indicates when the latest revision was made.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights:

You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD): https://www.cnpd.pt