DOMIQ PRIVACY POLICY (edition 2.15)
Written short and to the point. Ask about anything unclear and we will answer in plain language: support@domiqteam.com
1. WHO THE CONTROLLER IS
Firetech Engineering BG EOOD, company number 208214428, registered at: България, гр. София 1000, р-н Средец, ул. Леге № 6.
Privacy contact: support@domiqteam.com — questions about personal data, requests to exercise your rights and complaints. Where a local law requires a named contact for data protection — the person in charge of the protection of personal information (Québec), the encarregado (Brazil), the chief privacy officer (Republic of Korea), the data protection officer (Singapore, the Philippines, Nigeria) — this is that contact.
We have not appointed a data protection officer under the GDPR: the law requires one for large-scale monitoring or large-scale processing of special categories of data, and we are far from either. When the obligation arises we will appoint one and name them here.
We do not need a representative in the European Union: the company is established in a member state.
Our representative in the United Kingdom is named in section 10.
2. WHO ANSWERS FOR WHAT
We are the controller of the household owner's data: Domiq decides why and how to process it.
The employer is the controller of their staff's data: they decide which people to add, what to keep about them and why. Here we are the processor — we act on their instructions and do not use that data for our own purposes. The terms of those instructions are in the Data Processing Agreement.
You control your own use of "My work". We decide how those personal records are processed; your employer does not.
3. WHAT WE PROCESS AND ON WHAT BASIS
Running the service — basis: performance of our contract with you.
- Account: name, email, phone, role, photo.
- App settings: language, time and date format, units of measurement, theme, the
layout of the Today screen, information about the workspace you last opened, marks of what the app has already shown and your other choices in the app. We store these settings with your account so we can restore them when you sign in to that account again.
- Personal work records you keep yourself: workplaces, work hours, payments,
expenses, receipts and notes.
- Documents that workers upload to their personal profiles (passports, driving licences, diplomas). By default, employers cannot access these documents. An employer can view only the documents a worker chooses to share when joining their team or later in the Documents section.
- Household data you enter: properties, family members, tasks and reports on them, shifts, cash advances and expenses, instructions, documents, messages, photos and attachments.
- Technical information: device model, app version, error reports.
Information about app usage — basis: your separate consent.
- Which screens people use and where they abandon what they started. These records contain no names, addresses, messages or amounts, but each carries your identifier: that makes them personal data, not anonymous data. Calling them anonymous would be untrue.
Your answer to "How did you hear about Domiq?" — basis: our legitimate interest in understanding how people find us.
- The question is optional and is asked of the workspace owner after sign-up. The answer is one of six options (a friend or someone you know, Instagram, YouTube, searching the app store, an ad, other); it is stored with the workspace and does not affect how the app works.
The text AI assistant — basis: your separate consent.
- The text of your request. It goes to the provider so that a phrase can be turned into a task, a draft procedure suggested, or a support question answered.
Speech recognition — basis: your separate consent.
- An audio recording of what you said. This is a separate decision: sending your voice is not the same as sending a typed phrase, and tying them to one switch would take that choice away from you.
Automatic translation — basis: the legitimate interest of workspace members in understanding each other.
- The text of tasks, comments, instructions, requests, messages and expenses that a person writes to someone else is translated into the recipient's interface language when shown. The text goes to the AI provider (Groq); the original is not changed and is stored as written; the translation stays only on the recipient's device and is marked "Translated by AI" with an "Original" button. To turn it off: "Translate text into my language" in settings. You can object to the translation of your texts by writing to support. There is no translation in the Russian contour.
Emails about getting started and about your subscription — basis: our legitimate interest in helping you use the service you set up and in learning why you leave it.
- To the workspace owner: three days after the workspace is created — one tip on what to do next; after two weeks — a request for an honest review in the store (only if at least one task was completed in that time); after a subscription is cancelled — a question about the reason; after it ends — an offer to come back, if the store makes one. The emails use your name, email, language, the workspace name, the number of staff and tasks, the plan and the date the subscription ends.
- Every such email has a link that unsubscribes you from these emails in one tap, without signing in. Service emails — address confirmation, password, data export, payments — are not affected. We write about new features separately and only with your consent — see "Product emails" below.
Anonymous aggregated data — basis: your separate consent.
- Rules and standards of running a household, with no names, addresses or anything pointing to you or your people.
Product emails — basis: your separate consent.
Transfer to the United States for residents of the countries listed in section 10 — basis: your separate consent. Without it, push notifications, automatic translation and the AI features stay off.
Any optional consent is withdrawn in settings, the «Consents» section, with a single switch. Withdrawal does not affect the rest of the app.
Personal work records. If you use “My work”, we store the information you enter about workplaces, work hours, payments, expenses, receipts and notes to provide your personal record-keeping features. This information is linked to your account. Employers, partners and managers do not have access to it through their roles in Domiq. You choose whether to share a statement and with whom; workplace notes are not included in the statement. If your notes mention other people, include only the information needed for your work. Records you delete and workplaces in the archive stay in your personal records, where you can view and restore them; deleted records do not count in totals or new statements. They are erased when you delete your account. Statements you have already saved or sent are not changed by deleting records or your account. The retention periods and deletion procedures described in this policy also apply to your personal work records.
4. WHO WE PASS DATA TO
We do not sell data and do not pass it to advertisers. Processing is carried out by:
- Supabase — database and file storage, sign-in. Servers in the European Union.
- Groq — processing of AI model requests, speech recognition and text translation. Servers in the United States. Under the provider's terms the data is not used to train its models. Our organisation has full zero data retention enabled: requests and responses are not written to the provider's logs and are not kept after processing. Batch processing and model fine-tuning, which require retention, are switched off for us.
- Sentry — crash reports. Servers in the European Union. What is sent: the place in the code where the failure happened, the build version, the platform and the device model. What is not sent: your name, email, network address, screen contents or the app own log entries.
- Expo — delivery of push notifications to the phone. Servers in the USA. What is sent: the device’s push token, the title and the text of the notification (for example, a task name); Apple or Google then deliver it under their own rules. Notifications can be switched off in the app or phone settings — the push token is then deleted, and everything important still waits in Inbox. Expo also delivers app updates: after you sign in, and then no more than once every 6 hours, the app checks through Expo whether an update is available. Expo then receives the IP address, the phone’s platform and system information, the app version, the number of the installed update and a random installation identifier created on the phone that is not linked to your account; if the previous update failed to start, also the text of that error. If your workspace is on the Russian server or you connect through our gateway in Russia, the app does not contact Expo for updates.
- Resend — email delivery: address confirmation, password recovery, staff invitations, emails about getting started and about your subscription (section 3). Servers in the European Union. What is sent: the recipient address and the text of the message.
- Cloudflare — backup storage for files: photos, receipts, documents. Servers in the European Union. The copy exists in case the main storage fails: our database backups do not include files.
- Open-Meteo — weather at the place where a property is located. What is sent: the property coordinates rounded to about a kilometre; no name, address or account.
- Frankfurter — currency rates used to convert amounts. Only the rate request is sent, with none of your data.
- Geoapify — address and city suggestions while typing, and property coordinates. Servers in the European Union. What is sent: the address text being typed and the country; the request goes from our server, so the provider does not see your network address. No name or account is sent.
- RevenueCat — in-app purchases: confirms your subscription with the Apple or Google store and tells us its state. What is sent: your account identifier and the purchase identifier; card numbers and payment details never reach us or RevenueCat — the store keeps them. On iPhone, if you installed the app from an Apple Search Ads ad, RevenueCat also receives the ad's attribution from Apple (campaign, keyword) — with no tracking across apps. Servers in the USA.
Sign in with Apple and Sign in with Google, if you choose them, are described in section 5.
The list is maintained in the app and updated when it changes.
5. WHERE YOUR DATA IS AND WHO RECEIVES IT ABROAD
Your account and workspace data — the database, files and their backups — are stored in the European Union; for residents of Russia, in Russia (section 10). Some parts of the service are provided by companies in the United States. They receive only what is listed here, and only for the purpose stated.
Providers acting on our instructions:
- Groq (USA) — AI requests, speech recognition and translation of texts between workspace members. What is sent: the text you typed or the audio recording of what you said — each only with your separate consent — and texts shown to another member in translation. In typed requests the names, property names, addresses, phone numbers and emails known to the app are replaced with placeholders; audio is sent as recorded. The provider keeps neither requests nor responses after processing.
- Expo (USA) — delivery of push notifications and app updates. What is sent: for notifications — the device’s push token, the title and the text of the notification, which Apple (APNs) or Google (FCM), also in the USA, then deliver to the phone; when checking for updates — the IP address, the phone’s platform and system information, the app version, the number of the installed update and a random installation identifier, and, if the previous update failed to start, the text of the error.
- RevenueCat (USA) — in-app purchases. What is sent: your account identifier and the purchase identifier; on iPhone, the Apple Search Ads attribution if you came from such an ad. Card numbers and payment details are kept by the app store and never reach us or RevenueCat.
The transfer to these three providers is based on the European Commission's standard contractual clauses (Decision 2021/914), which form part of our agreement with each of them; for Expo and RevenueCat the clauses are part of the provider's terms, which also set out how they process data on our instructions. For the United Kingdom, our agreements with Groq and RevenueCat also include the UK addendum to those clauses. Expo also participates in the EU-U.S. Data Privacy Framework together with its UK Extension and the Swiss-U.S. Data Privacy Framework, which covers transfers to Expo from the United Kingdom and Switzerland.
Services you choose to use yourself:
- Apple (USA) — Sign in with Apple. Apple confirms who you are and, only if you allow it, gives us your name and email. When you delete your account, our server sends Apple a one-time code so that the link is revoked.
- Google (USA) — Sign in with Google. Google confirms who you are and gives us the email address and the name of your Google account.
Apple and Google act under their own terms and privacy policies, as independent controllers.
What this means for you. The United States has no general federal law on the protection of personal data comparable to European law, and US authorities can, under US law, require US companies to hand over data. That is why only the minimum listed above goes there, the AI provider keeps nothing after processing, and transmission is encrypted. Before starting these transfers we assessed these risks. A copy of the safeguards is available on request: support@domiqteam.com.
6. HOW LONG WE KEEP DATA
- Account and household — while the account is active.
- After account deletion — up to 30 days in backups, then irreversibly.
- Documents a worker has shared with an employer stay with that employer after the worker deletes their account: the employer decides what happens to them (section 2). To have such a copy removed, contact the employer or us (section 12).
- Consent records — 3 years after withdrawal: this is the evidence of what a person agreed to and when, and it cannot be destroyed sooner.
- Money records — while the household exists. Domiq is not an accounting or payroll system and does not know what mandatory retention periods apply to your employer: they keep mandatory documents outside the app.
- Error reports — 90 days.
- App crash reports — 30 days.
Deleted items archive. When someone deletes a record in a workspace (an event, a task, an instruction, a work document, an attachment, a message), it no longer appears in the app’s regular lists. When someone removes or changes certain details (the text of a message, details of a property, skills and languages in a profile), the previous value no longer appears on the card. The server keeps a copy in the workspace’s archive so that the history of the workspace stays available, for as long as the workspace exists. The workspace owner and partner can read the whole archive of the workspace except messages; messages are visible only to the people in the chat. Everyone else sees only records that name them as the author, the assignee or the person the record is about, and only while they are members of the workspace. Copies of personal documents you delete are not kept in the archive. Deleting a workspace deletes its whole archive. Deleting your account deletes from the archive your messages, comments, scheduled shifts, shift reports, work documents, library templates, staff card and profile, together with their files; in other records it removes the mark that you deleted them and your access to them. Backup copies are kept for up to 30 days.
7. YOUR RIGHTS
Obtain a copy of your data. Correct what is inaccurate. Erase it. Restrict processing. Object to processing. Withdraw consent at any time. Not be subject to a decision based solely on automated processing.
Account deletion is in settings, by you. «Export my data» is there too: a copy is assembled as a file in a machine-readable form, without contacting us and without an internet connection. An employee receives their own data; no colleagues' data is in their export — we do not trade their rights for someone else's.
For anything else write to support@domiqteam.com; we will answer within 30 days, or sooner where your law requires it (section 10).
If our answer does not satisfy you, you may complain to a supervisory authority. Ours is the one where the company is established: Комисия за защита на личните данни (КЗЛД), гр. София 1592, бул. «Проф. Цветан Лазаров» № 2, kzld@cpdp.bg, cpdp.bg. You may also complain to the authority in your own country of residence — the choice is yours.
8. CHILDREN
Domiq accounts are only for people aged 18 or over: at sign-up everyone confirms this with a separate tick, and we record the date and time of that confirmation. Children in the household have no accounts. Information about them is entered by an adult owner as a card and is used only to run the service: so that a «take to school» task knows who it is about. It does not go into app usage records or into anonymous aggregated data.
About external AI models we will be more precise. We do not put children's cards or health information into a request. More than that: the names of your people, the names of properties, addresses, phone numbers and emails are replaced with placeholders before sending and put back in the response — the provider does not see them.
But that is not complete protection, and we will not claim it is. A name the app does not know — a neighbour, a doctor, an acquaintance — goes through as it is; some grammatical forms are not caught either. For anything truly sensitive it is better not to use voice input.
9. SECURITY
Access is separated on the server side: each person sees only their own household, and the database checks that, not the interface. Within a household the database separately restricts family member cards — they are seen by the owner, the people assigned to them and whoever has a task about that person. The remaining separation by role and property is still done by the app; we are moving it to the server and we do not present the current state as more than it is.
Transmission is encrypted. Files are kept in closed storage and served through links with a limited lifetime.
If an incident affects your data we will tell you and the supervisory authority within the required time.
10. YOUR RIGHTS BY COUNTRY
Wherever you live, you have the rights in section 7 and exercise them the same way: in the app or by writing to support@domiqteam.com. We answer within the period set by the law of your country, and in any case within 30 days. Your own law may give you more; nothing here takes that away. What differs by country:
European Union and European Economic Area (including Norway, Iceland and Liechtenstein). The General Data Protection Regulation applies. The controller is established in Bulgaria; the bases of processing are in section 3. Our lead supervisory authority is named in section 7; you may also complain to the authority of your own country — in Spain, the Agencia Española de Protección de Datos (AEPD), aepd.es.
Switzerland. The Federal Act on Data Protection applies, and you have the rights in section 7. You may complain to the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.
United Kingdom. The UK GDPR gives the same rights, and we honour them equally. Storage in the European Economic Area is recognised as adequate; transfers to the United States are described in section 5. We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the United Kingdom (UK), under Article 27 of the UK GDPR. Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/19121534240 — Prighter's portal for our company. You may complain to the Information Commissioner's Office (ICO), ico.org.uk.
United States. State privacy laws give residents the right to know what personal data we hold and to get a copy of it, to correct it, to delete it, and to opt out of its sale, targeted advertising and profiling. Some of these laws apply only above revenue or data-volume thresholds; we do not rely on thresholds and give these rights to every US resident, with no penalty for using them. We do not sell personal data, do not share it for cross-context behavioural advertising and do not use it for targeted advertising. If we decline your request, you may appeal: reply to our answer or write to support@domiqteam.com with the word «Appeal». We will answer within 45 days and explain the decision; if you disagree, you may contact the attorney general of your state. Domiq accounts are for adults (section 8).
United Arab Emirates. Processing follows Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; cross-border transfers are made on the bases in section 5. Domiq accounts are for people aged 18 or over (section 8).
Russia. For accounts whose country of residence is Russia, the controller of personal data is the individual entrepreneur Луговская Владислава Владимировна, OGRNIP 321784700217622, INN 784801184004, address: 196158, Санкт-Петербург, ул. Ленсовета, д. 90, литер А, кв. 19; requests go to support@domiqteam.com. Such accounts in their entirety — database, files, backups — are stored on a server in Russia and never reach the European database. The exception is an account that has joined an employer whose workspace is stored on the Domiq server in Ireland: with the separate consent you give when joining, your name, contact details, tasks, reports, photos, personal documents, shift records and payment information are first recorded on a server in Russia, then transferred to that server. Your employer does not see your personal documents unless you choose to share them. Processing follows Federal Law No. 152-FZ "On Personal Data". The bases are the same as in section 3: our contract with you and your separate consents.
Of the services in sections 4 and 5, Sentry, Geoapify and Open-Meteo remain in the Russian environment — a cross-border transfer to Germany, a country with adequate protection of personal data — and Resend, which delivers emails (sign-up code, password reset, subscription emails): your email address and the text of the email are transferred to the USA. The controller notifies Roskomnadzor of cross-border transfers before processing starts. Push notifications go through Expo, Apple and Google without content: only the device’s push token and a request to open the app cross the border, while the notification text stays on the server in Russia. The app does not contact Expo for updates — they come through the app stores. Groq is not used: task drafts are assembled on the phone without an external model, and there is no automatic translation. File backups are kept on the same server rather than in Cloudflare. RevenueCat is involved only when you buy through an app store.
The rights under Article 14 of the law — to know what is processed about you, to require clarification, blocking and destruction of data, to withdraw consent — are exercised the same way as in section 7; we answer a request within 10 working days, the period the law sets. Complaints go to Роскомнадзор: 109992, Москва, Китайгородский пр., д. 7, стр. 2, rkn.gov.ru.
Countries whose law requires consent for a transfer to the United States: Argentina, Armenia, Belarus, Chile, Colombia, Costa Rica, Morocco, Panama, Ukraine, Uzbekistan. If you live in one of them, we ask at sign-up for your separate consent to the transfers in section 5 and tell you the risks. Without it Domiq still works: push notifications, automatic translation and the AI features stay off, and we ask again before an in-app purchase. You can withdraw this consent in Settings → Consents.
Countries where Domiq is not yet available. In some countries the law requires registration with the regulator, a local representative or storage inside the country before a service starts. Until we meet those conditions, Domiq is not offered in their app stores and does not accept sign-ups from them.
Other countries. We will not claim that the European regulation protects you if you live outside the European Economic Area: it does not, and your supervisory authority is your own. But your data is still stored in the European Union, and we give the same protection — the same rights from section 7, the same retention periods, the same providers. In many countries the law does not apply to a private person running their own household; where that is so, we still apply this policy to data about staff and family members and answer their requests directly.
11. CHANGES
If what data we process or why changes, we will notify you in the app and ask you to accept the new edition. We will not silently carry an old consent over to a new text.