Privacy Policy

This policy applies to the Yuvio work management platform and its web, Android and Windows desktop versions, as well as the iOS version when it becomes available. It also applies to the public login and privacy policy pages. It does not describe any separate cookies or marketing tools used by the public website yuvio.me.

Yuvio is intended for companies and their authorised users, not for children. Accounts are created by a company administrator; public self-service user registration is not available.

The company that created your account determines the purpose of its business records, who can access them and which features are enabled. Yuvio provides the technical platform. For questions about employee records, also contact your company; for questions about the platform and privacy, contact info@yuvio.me.

The scope of data depends on your role, the features your company uses, and the content you or an authorised administrator enter.

• Account data: full name, username, user and company identifiers, role, account status, department and position, and optionally nickname and gender. Passwords are stored as hashes, not as readable text.
• Business records: sign-ins and sign-outs, working, active and idle time, breaks, daily and evening reports, review requests, tasks, projects, warnings, absences and non-working days.
• Leave and sick leave: the type and period of absence and any notes. Sick leave status or the text of a note may contain sensitive health information; do not enter medical documentation or other unnecessary sensitive data.
• Content you enter: business chat messages, notes, events and other text content in the features you use.
• Technical and security data: IP address, sign-in time, browser and operating system information, session and device identifiers, and records of administrative changes. During sign-in, device characteristics such as the screen, language, time zone, processor, memory and graphics environment may be used to generate hashed identifiers and manage sessions.

When the Windows desktop agent is enabled for a user and the user is signed in, it may record the active application name, window title, available page address from the active browser, activity times and durations, window state and inactivity. It may record the number and duration of keyboard and mouse activity events, but does not record the content of typed characters. A window title or URL may nevertheless contain personal information.

This feature does not capture screenshots or make audio or video recordings. The company is responsible for clearly informing employees about enabled monitoring, its purpose, rules and the basis for its use.

The Android app does not run the Windows desktop agent and does not monitor which other apps or websites you use on your phone. Current mobile features do not require access to contacts, the microphone, camera or GPS location.

Yuvio currently does not include advertising SDKs or Firebase Analytics. We do not sell personal data or use it for targeted advertising.

The company must establish an appropriate basis for processing business and sensitive records under the rules that apply to it. This policy does not replace the company's notice to employees; signing in alone is not consent to all forms of monitoring.

• To sign users in, maintain sessions, check permissions and separate different companies' data.
• To keep work records, process reports, requests and absences, organise tasks and support communication within the company.
• To deliver permitted notifications about business events and prevent repeated delivery of the same message.
• To display the weather forecast for the city selected in settings.
• To protect accounts, resolve technical errors, review changes and respond to user requests.

Data may be available to authorised users in your company according to their role and the feature they use. The platform administrator has privileged access to manage companies and users and provide technical support. Different companies' data is not intended to be accessible to one another.

Infrastructure and hosting are used to store and process the application and database. Processing through external services may take place outside your country, depending on where their infrastructure is located. For information about providers and applicable data transfer terms, you can write to info@yuvio.me.

We use Google Firebase Cloud Messaging for mobile notifications. Data processed includes the push token, installation identifier, device platform and the link to the account and company. A message sent to the service may contain the sender's name, event type and technical identifiers needed to open an item; it does not contain the full text of a business report. When iOS is used, delivery also goes through the Apple Push Notification service.

For weather forecasts, the server sends the selected city's coordinates and altitude, if configured, to MET Norway, without a username or account identifier in the request. This does not automatically determine your current GPS location.

Data may be provided to competent authorities where there is an applicable legal obligation. External services' terms and policies apply to the part of the processing they carry out.

• Google Firebase — privacy and security
• Apple — privacy policy
• MET Norway — API terms of service

The bp_session session cookie is used to keep you signed in. Language preference, data needed for the interface, the mobile installation identifier and a limited record of previously displayed notifications may be stored locally. The PWA or desktop version may cache static resources and local data used by the application.

A super administrator's session may last up to 90 days, and other roles' sessions up to 7 days, unless revoked earlier. Signing out ends the current session; clearing local data or uninstalling the app may remove the local sign-in, but does not by itself delete the account or business records on the server.

You can decline push permission or disable it later in your phone settings. Signing in and viewing business data do not depend on push permission. Notifications about requests and reports are intended for authorised super administrators and administrators in the same company; they are not sent to mega/master administrators, mini administrators or employees. Depending on your phone settings, a push message may display the sender's name on the lock screen.

The system supports automated cleanup for each company. The default periods below are not legally prescribed retention periods: they can be changed in company settings, and removal is carried out when the cleanup job runs.

Not every category of data is automatically deleted after the same number of days. Active accounts, unfinished tasks, projects, personal notes and other data not covered by cleanup remain until deleted through the relevant feature or following a request. Minimal hashed event keys used to prevent repeated delivery are retained longer and removed with the company.

If the company or hosting provider maintains backups and infrastructure logs, their retention and removal practices may differ from those of the active database. You can request the specific retention periods for your company and backups through the contact listed in this policy.

• Detailed desktop activity records: 60 days by default. Before deletion, daily summaries by application are created; these summaries are not a detailed history of window titles and URLs.
• Business records covered by cleanup — reports, sick leave and annual leave, time records, daily activity summaries, warnings, completed tasks, finished events, chat messages and associated audit records: 1095 days by default, approximately 3 years.
• Push delivery records: 90 days by default. System notifications are removed under this period when they have already expired or been marked as removed.
• Expired sessions are removed through cleanup and the sign-in flow. Push device registration is linked to the account, company and a valid session.

The service is accessed over HTTPS. Passwords are stored as bcrypt hashes. The session cookie is HttpOnly and Secure in production; the server checks sign-in, role and company membership before protected operations. Private server and upload keys are not included in the public repository or mobile package.

No system can guarantee absolute security. Protect your password, do not share your account and secure your device, especially when persistent sign-in is enabled. If you suspect unauthorised access, notify your company's administrator and the Yuvio contact.

For privacy questions, requests for access or correction, or account or data deletion, write to info@yuvio.me with the subject “Yuvio — privacy”. Include your company, username and what you are requesting. Do not send your password, private keys or unnecessary medical documentation.

We handle requests concerning business records with appropriate identity verification and coordination with the company that maintains those records. Administrators can delete users and companies; deactivating an account is not the same as deleting it.

Deleting an account does not necessarily automatically remove every associated archived, shared or audit record. Remaining data and any justified retention periods are considered when handling a request; we will inform you if certain data needs to be retained and why. Where applicable, requests for restriction, objection or data portability and contact with the competent authority are handled under the rules applicable to your processing.

Yuvio — privacy contact: info@yuvio.me. Official website: https://yuvio.me.

We update this policy when features or data processing change. The last updated date is shown at the top. We will inform users about significant changes affecting data use through the application or communication with the company.