StirsPrivacy Policy
Who processes the data
Stirs is a system for field sales representatives (a phone app, a web panel and order approval pages), used by companies under an agreement with the system operator.
- Data controller: the company that uses Stirs and created your account (e.g. your employer), or the company that sent you an order proposal. It decides what data is processed and why.
- Data processor: the operator of the Stirs system – processes data only on the company's instructions, under a data processing agreement (Art. 28 GDPR).
- Contact about data: first the company acting as controller. Operator of the Stirs system: Piotr Syroczyński, e-mail pomoc@stirs.pl.
What data we collect
| Whose | Data | Source |
|---|---|---|
| App and panel users (sales reps, managers, administrators) | name, e-mail, phone, region, department, role; address for delivery of promotional materials (if provided) | the account is created by the company administrator; the address is entered by the user |
| Users – work | customer visits, visit photos, orders, notes, sales results | entered by the user or the company (import) |
| The company's customers (stores, contact persons) | store name and address, customer numbers, contact e-mail and phone, signature made on the rep's phone, name of the signatory | the company and the sales rep |
| Customers approving an order via a link | the decision (approval, changes, rejection), time, IP address, browser or device type | approval page – recorded in the consent archive |
| Technical data | the phone's notification identifier, app version, server logs (e.g. IP address, request time) | the app and the server |
The app does not collect the phone's location, contacts or health data.
Why and on what legal basis
The data is used only for the sales work of the company that uses Stirs. The legal basis is determined by the company as controller – usually performance of a contract (Art. 6(1)(b) GDPR) or the company's legitimate interest (Art. 6(1)(f)), e.g. handling orders and managing sales work.
- handling visits, orders and their approval (approvers, customers, customer service);
- the consent archive – documenting who approved an order and when, for audits and possible disputes;
- sales and team performance reports for the company;
- notifications about order status changes;
- system security (sign-in, change log, abuse detection).
We do not use the data for advertising, do not sell it and do not profile users.
Phone permissions
The app asks only for the permissions it needs; each can be turned off in the phone's settings.
| Permission | Purpose |
|---|---|
| Camera and photos | visit photos (shelves, displays); removed from the app's storage after upload to the server |
| Notifications | information that an order was approved, rejected or changed |
| Face ID / fingerprint / screen lock | unlocking the app; recognition happens on the phone – the app never receives or stores biometric data |
The app does not track users across other companies' apps and websites and contains no ads or third-party analytics.
Where the data is and for how long
All company data is stored in the European Union. The operator uses the following providers (sub-processors):
| Provider | Used for | Data | Location |
|---|---|---|---|
| Supabase | database, sign-in, files, server logic | all data described above | EU (Ireland) |
| Resend | sending order e-mails | e-mail content and PDF attachments | USA – EU Standard Contractual Clauses and EU-US Data Privacy Framework; e-mail copies kept 30 days |
| Expo, Google Firebase, Apple | delivering app updates and notifications | notification identifier and notification content (order number, store name) | USA / EU – EU Standard Contractual Clauses |
| Netlify | panel and approval web pages, and this website | no company data (only page files and access logs) | USA / CDN |
How long: for the duration of the company's agreement with the operator. When the agreement ends, the data is handed over to the company (export) and deleted within the period set in the agreement. The consent archive and change log are kept as long as the company requires for audits. Database backups – 7 days.
Security and your rights
Security: encrypted connections (TLS) and data (AES-256), permissions enforced by the database (everyone sees only their company's data and what their role allows), app lock with fingerprint or PIN, two-factor sign-in to the panel, a change log and a consent archive that cannot be edited.
Your rights: you have the right to access, rectify and erase your data, to restrict processing, to data portability and to object – as provided by the GDPR. Please send requests to the company acting as controller (e.g. your employer); the operator helps the company fulfil them. Accounts are not created in the app by users – an account is deleted by the company administrator or by the operator on the company's instructions (you can also send a request to pomoc@stirs.pl – we will pass it on to the company). You also have the right to lodge a complaint with a data protection supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).
Changes to this policy: the current version is always on this page, dated at the top. We inform companies using Stirs about significant changes.