Last updated: 15 August 2026
Mobile App Privacy Policy
1. About this policy
Zinevu ("we", "us", "our") develops and operates the Zinevu mobile application for iOS and Android (the "App"). This Privacy Policy explains what personal data we collect through the App, why we collect it, who we share it with, and what rights you have.
This policy applies specifically to the App. Where it differs from or adds to our general Privacy Policy for the Zinevu platform, this document governs your use of the App.
We process personal data in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679).
2. Data controller
The controller for the processing described in this policy is Zinevu. All data protection queries can be sent to [email protected]. We aim to respond within 30 days.
3. Information we collect
3.1 Information you provide
- Account information — name, email address, phone number, company name and password (stored encrypted).
- Profile information — profile photo, language preference and notification preferences.
- Business content — quotes, customer records, pricing rules, product catalogues and other data you create or upload within the App.
- Photos and videos — images and videos you attach to projects, tasks or quotes in the App.
- Communications — the content of messages and attachments you exchange with team members or clients through the App.
- Support requests — the content of your questions, complaints and deletion requests.
3.2 Information collected automatically
- Device and technical data — device type and name, operating system and version, app version, platform (iOS/Android), language setting and IP address.
- Push token — a unique notification token from your device, together with platform, app version and device name, so that we can deliver push notifications. The token is revoked when you sign out.
- Usage and error data — server-side technical logs (including IP address, timestamp and the function called) and error reports, used for security and troubleshooting.
3.3 What we do not collect
To avoid any doubt, and in addition to the data labels shown on the App Store and Google Play:
- The App does not request access to your device's GPS or precise location.
- We do not use advertising identifiers and no third-party SDKs for advertising, tracking or cross-app or cross-site profiling.
- We do not include third-party analytics or crash-reporting SDKs in the App. Should we introduce any in future, we will update this policy and the store data labels first.
- Biometric data (Face ID, Touch ID, fingerprint) is processed exclusively by your operating system and never leaves your device. Zinevu only receives a "success" or "failure" result.
- We do not sell your personal data and do not share it with data brokers.
4. Device permissions
The App only asks for permissions that a specific feature needs. You can withdraw any permission at any time in your operating system settings; the App will continue to work, but the related feature will not.
| Permission | What it is used for |
|---|---|
| Camera | Taking photos for projects, tasks or quotes inside the App |
| Photo library | Attaching existing photos to projects, tasks or messages |
| Notifications | Push notifications about quotes, messages, appointments and project status |
| Face ID / biometrics | Locking and unlocking the App on your own device |
5. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account and profile | Performance of a contract (Art. 6(1)(b)) |
| Processing quotes, projects and customer data in the App | Performance of a contract (Art. 6(1)(b)) |
| Communication through the App | Performance of a contract (Art. 6(1)(b)) |
| Push notifications about projects, quotes and messages | Performance of a contract (Art. 6(1)(b)), combined with the permission you grant at device level |
| Customer support and dispute resolution | Contract and legitimate interest (Art. 6(1)(b) and (f)) |
| Security, fraud prevention and abuse detection | Legitimate interest (Art. 6(1)(f)) |
| Troubleshooting and improving the App | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations (tax, accounting) | Legal obligation (Art. 6(1)(c)) |
| Marketing and newsletter | Consent (Art. 6(1)(a)), withdrawable at any time |
6. Sharing with third parties
We do not sell your personal data. We share data only in the following circumstances:
- With processors — service providers acting on our behalf, such as our hosting provider and the service that delivers push notifications. They may process your data only for us and on our instructions, under a data processing agreement.
- Where required by law — when we are legally obliged to do so, or in response to a valid request from a competent authority.
7. Third-party services used in the App
| Service | Role | Purpose |
|---|---|---|
| Expo Push Notification Service (Expo, US) | Processor | Delivering push notifications; processes the push token and notification content |
| Apple Push Notification service (Apple, US/EEA) | Processor | Delivering push notifications on iOS |
| Firebase Cloud Messaging (Google, US/EEA) | Processor | Delivering push notifications on Android |
| Hosting provider | Processor | Server infrastructure and storage, within the EEA |
Firebase Cloud Messaging is used in the App solely to deliver notifications on Android. Firebase Analytics and Firebase Crashlytics are not included in the App.
8. International transfers
Our own storage and processing take place within the European Economic Area. Where data is nevertheless processed outside the EEA — in particular for the delivery of push notifications via US providers — this is done on the basis of appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914) and, where applicable, the EU–US Data Privacy Framework.
9. Retention periods
| Category | Retention period |
|---|---|
| Account and profile data | Up to 2 years after account closure |
| Project, quote and customer data | Up to 7 years after project completion (statutory tax retention) |
| Messages and attachments | 2 years after project closure |
| Push tokens | Until sign-out, app removal, or 90 days of inactivity |
| Log files and IP addresses | Maximum 90 days |
| Marketing consent | Until consent is withdrawn |
10. Account and data deletion
You can have your account and associated personal data deleted at any time. There are two routes:
- In the App — open Account → Settings → Delete account and confirm. Your account is closed immediately and you are signed out on all devices.
- By email — send a request from your registered email address to [email protected].
Upon a valid request we permanently delete or irreversibly anonymise your profile data — including your name, email address, phone number, profile photo and login credentials — and revoke all access tokens and push tokens. This is completed within 30 days. Data we are legally required to keep is retained only for the periods set out in section 9 and deleted once those periods expire.
11. Security
We apply appropriate technical and organisational measures, including TLS encryption of all traffic between the App and our servers, encrypted storage of session tokens in your device's secure storage (iOS Keychain / Android Keystore), password hashing, encryption of personal data at rest, need-to-know access controls, and a data breach notification procedure (within 72 hours to the supervisory authority).
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
12. Children's privacy
The App is intended for business use by individuals aged 18 and over. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact [email protected] and we will delete it as soon as possible.
13. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw your consent at any time (Art. 7(3)). Requests can be sent to [email protected].
We respond within 30 days. You also have the right to lodge a complaint with the competent data protection authority.
14. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with an updated date at the top. For material changes we will notify you in advance through the App or by email.
15. Contact
Email: [email protected]
Phone: +31 85 401 31 68
Website: zinevu.com