DEEN
Free beta
Back to the homepage

Privacy Policy — Operator App

Effective: 2026-10-26 · Version: 1.11

1. Controller

Mobistro
Alexander Schäfer, sole proprietor
Nauheimer Weg 9a
65550 Limburg
Germany

Email: datenschutz@mobistro.app
General contact: kontakt@mobistro.app

No data protection officer has been appointed. Please send data protection inquiries to datenschutz@mobistro.app.

2. Scope

This privacy policy applies to the operator web app at pitstop.mobistro.app and to the native Mobistro app for iPhone and iPad (app identifier app.mobistro.operator). Where a section describes only one of the two surfaces, this is stated expressly in that section; all other sections apply equally to the web app and the native app.

Mobistro is intended for mobile food and beverage businesses. An organization is created by signing up in the web app; it invites further people itself. The native app is available on the Apple App Store; Mobistro also distributes pre-release versions to individual invited testers via Apple TestFlight (Section 5.7). Accounts cannot be created in the native app: only existing business accounts can sign in.

New organizations can first try Mobistro free of charge. If an organization purchases a paid plan, Paddle bills it as a reseller (Section 5.6). The agency app and AI features are not covered by this policy. Before they are activated, the associated data flows and notices will be separately added and reviewed.

3. Data Processed and Purposes

3.1 Account, Authentication, and Organization

In particular, we process email address, password hash, name, organization membership, role and permissions, the times of security-relevant authentication events, and documented acknowledgments of legal text versions. This serves to set up and secure the account, sign-in, session management, password recovery, and tenant isolation — regardless of whether sign-in takes place via the web app or the native app. No new account can be created in the native app; only existing business accounts can sign in. During registration, sign-in, and password changes, passwords are transmitted to Supabase Auth over a TLS-encrypted connection and processed there for authentication. A password hash is stored, not the plaintext password.

3.2 Operational Data Entered by the Customer

Depending on use, organization, event, location, vehicle, inventory, checklist, team, and document data is processed. This content may contain personal data if the customer organization enters such data. Mobistro processes this data to provide the selected product features and, in relation to the customer organization, generally in accordance with its documented instructions. Authorized people can also enter or edit the name and phone number of an event's on-site contact in the native app. These details are stored as operational data of the organization and synchronized with the server.

3.3 Technical and Security Data

To transmit and secure requests, technically necessary network and request data is processed, in particular IP address, time, browser/device information, and security attributes. The Pitstop Nginx access log is configured so that it logs neither the IP address nor the URL, query, referrer, or user agent. Upstream infrastructure and security providers may process this data to the extent technically required.

The native app sends its requests encrypted via HTTPS directly to Supabase (Section 5.1). For technical reasons, Supabase processes the device's IP address as well as the time and technical metadata of the request. The Supabase software development kit adds the “X-Client-Info” header to every request. It states only the name and version of the development kit (such as “supabase-swift/” and the version number) and contains no information about the device. For the security check at sign-in, the app loads a page from pitstop.mobistro.app in an embedded browser component (Section 5.4); the statements above apply to its access log. The app neither reads nor transmits the operating system's device or advertising identifiers.

3.4 Maps and Place Search

The web app uses Geoapify to search for event addresses and display map tiles. When a place search is entered, the browser sends the search text, selected language and public project key directly to Geoapify. Displaying a map requests the required map areas. Geoapify also receives the IP address and necessary request data, such as HTTP headers and timestamps. Mobistro does not transmit account names, email addresses, membership lists or session tokens in these requests. Selected place names and coordinates are stored in the organization when the event is saved. The web app does not request access to the device's current location for this purpose. Manual place entry remains possible; automatic search requests may also occur while typing a place manually.

On click, the web app opens Google Maps to show an event's location or to calculate a route there. The stored coordinates or, if none are available, the place name are transmitted to Google in the link. From the moment it is opened, Google processes this information as a controller in its own right under its privacy policy. Mobistro does not use Google as a service provider for this and receives no data back from Google.

The native app offers no map or place search feature of its own and does not request location access. On tap, it can hand off an event address to a maps app on the device (Section 3.14).

3.5 Required Information

Email address, password, and organization assignment are required for access. Without this information, we cannot provide an account. Other operational and profile data is generally voluntary; without the information required for a specific feature, that feature cannot be used or can be used only to a limited extent.

3.6 Native App: Sign-In Data and Offline Access in the Keychain

After sign-in, the native app stores the access and refresh tokens of the Supabase sign-in session, as well as an additional offline access credential, in the device's Keychain. The Keychain is a storage area provided by Apple, encrypted on the device, that can be read only within the app and only while the device is unlocked; synchronization via iCloud Keychain is not enabled for it. The offline access credential contains the user and organization identifiers, the time of the last online check, the authentication level reached, and the signed-in person's name, email address, organization name, role, and the storage location of their profile picture (only the file path in file storage, not the image itself), so that the app remains usable on site without a network connection and knows who is signed in. It becomes invalid no later than 72 hours after the last online check. It is removed upon sign-out and upon a workspace switch — that is, when the same person switches in the app to another organization they also belong to. If the server revokes permission, the app removes the credential once it detects the revocation during an online check. Without a network connection, the app cannot detect an intervening revocation; local offline access may therefore continue until the credential expires (Section 3.11).

The same Keychain also holds, under separate services and apart from this sign-in data, the encryption keys for the document, image, and photo caches described in Sections 3.8 and 3.9.

3.7 Native App: Local Operational Data and Pending Synchronization

So that work can continue on site even without a continuous network connection, the native app keeps event, packing list, vehicle, cleaning, damage, loss, teardown, recipe, and preparation data of the active organization, as well as information about its documents (name, type, file size, and expiry date), in a local device database (Apple SwiftData). Where the organization has recorded them, event data also include the name, phone number, and email address of the on-site contact person and the name, contact person, phone number, and email address of the organizer. Actions not yet transmitted — such as a recorded packing step, a loading, a cleaning, a damage or loss report, or a change made via quick edit — are also stored locally until they have been successfully synchronized with the Supabase database. If the server rejects an action, it remains on the device for review until the person discards it or signs out. Unlike the areas described in Sections 3.8 and 3.9, this local database is not additionally encrypted by the app; it is subject to the standard iOS file protection on the device. Unlike the queue for documents to be uploaded (Section 3.13), it is not excluded from device backups and may therefore be contained in iCloud or computer backups created for the device. It is fully cleared upon sign-out, upon a workspace switch, and when the app detects a revocation of permission (Section 3.11).

For offline use, the app also stores the organization's access status last confirmed by the server, including available features, any expiration time and the time of the check. This record is associated with the signed-in account and the organization. Prices, payment data and Paddle customer or subscription identifiers are not stored on the device for this purpose.

If the person chooses, the native app sends a reminder about an event on the day before the event's first on-site day at 3:00 p.m. in the organization's local time. The app calculates these reminders on the device from the locally stored operational data and schedules them in the iOS notification system. A reminder contains the event title, the vehicle name if the organization has multiple vehicles, the setup or start time, and the status of the packing list; it does not contain contact details or information about the event organizer. No data is transmitted for the reminders, not even to a push service. Depending on the iOS notification settings, their content may also be visible on the lock screen. The app schedules reminders only if the person has turned them on and has granted iOS permission for notifications. The permission can be revoked at any time in the iOS settings, and the reminders can be turned off in the app's profile. After each sync with the server, the app reschedules the reminders and removes those that no longer apply, for example because an event was canceled.

3.8 Native App: Encrypted Document, Profile Picture, and Vehicle Image Caches

So that documents, the user's own profile photo, and vehicle images remain visible without being downloaded again, the native app stores these files locally in separate caches encrypted with AES-GCM. The respective key is stored separately in the Keychain, per signed-in person and organization, and separately from the sign-in data described in Section 3.6. The profile photo and vehicle images are only downloaded from Supabase Storage and cached locally; taking or selecting these images in the native app itself is not provided for, and the profile photo is managed in the web app. Documents uploaded in the native app (Section 3.13) are also placed in this cache after transmission. These caches are purely technical caches: they are automatically rebuilt from Supabase Storage as needed and are fully cleared upon sign-out, upon a workspace switch, and when the app detects a revocation of permission (Section 3.11).

3.9 Native App: Temporary Encrypted Damage Photos

A photo for a vehicle damage report is stored locally under the same rules as in Section 3.8, encrypted with AES-GCM and kept separately per signed-in person and organization, but in a separate area for damage not yet reported. It remains there only until the associated damage report has been successfully transmitted to the server and is then automatically removed.

3.10 Native App: Camera and Photo Library

When recording a vehicle damage report, a photo can either be taken with the device camera or an existing image can be selected from the photo library; both are optional. Before being stored locally under Section 3.9, the image is downscaled and fully re-encoded. In the process, all metadata of the original image is discarded, including any location coordinates (GPS EXIF) — only the image orientation is retained so that the photo is displayed upright. The app uses the same camera to scan documents (Section 3.13).

The app expressly asks for camera access for these purposes. When selecting from the photo library, it receives, via the iOS picker, only the selected images and no access to the rest of the library. The app does not access location, microphone, or contacts.

3.11 Native App: Cleanup upon Sign-Out and Revocation of Permission

Signing out, a workspace switch (Section 3.6), and a server-side revocation of permission detected by the app clear the same local data in the native app: the offline access credential in the Keychain (Section 3.6), the local device database (Section 3.7), the reminders scheduled in and already delivered by the iOS notification system (Section 3.7), and all encrypted caches, pending damage photos, and pending documents (Sections 3.8, 3.9, and 3.13). The app detects a server-side revocation only during an online check. Offline, the maximum validity of the access credential in Section 3.6 applies; no remote deletion takes place without a connection to the device.

A restriction to read-only access does not revoke membership or access to the organization. It deletes neither locally stored operational data nor pending actions and files. Transmissions held back because of read-only access are retried once the app detects that access is active again.

Upon a workspace switch, only the data of the newly selected workspace is retained; all other data is removed. For the encrypted caches, the key is deleted first and only then the encrypted file, so that no residue remains that could still be decrypted. Any server-side error that occurs in the process is logged without personal data and does not prevent the local cleanup.

3.12 Native App: No Analytics, Advertising, or Tracking Software

Apart from the Supabase software development kit and the technical libraries on which it is built, the native app does not include any other third-party libraries. In particular, it contains no analytics, advertising, tracking, or crash reporting software and does not transmit usage or device profiles to third parties. Which crash and usage data Apple itself passes on to Mobistro is set out in Section 5.7.

3.13 Native App: Uploading Documents

Persons with the Admin or Manager role can upload organization documents in the native app; documents for an event can additionally be uploaded by Staff. A document can be scanned with the camera, selected as a photo from the photo library, or imported as a file (PDF, JPEG, PNG, WebP, Word, or Excel, no more than 10 MB) from the Files app. For each document, a name, a document type, and, for organization documents, optionally an expiration date are recorded. For scans and photos, the app suggests “Scan from …” or “Photo from …” with the date as the name, and for imported files, the file name; the suggestion can be changed.

Scans and photos are downscaled to at most 2400 pixels and fully re-encoded on the device, and scans are additionally combined into a PDF. In the process, all metadata of the original image is discarded, including any location coordinates. For the photo library and file selection, the app uses the iOS pickers and receives only the file that was selected. When scanning, iOS detects the edges of the document on the device; the app does not evaluate any text recognition. Files imported from the Files app are transmitted unchanged. Any metadata they contain is therefore retained, for example the location and time a photo was taken, or the author name and editing times of PDF, Word, or Excel files. The documents themselves may contain personal data, for example a trade license or a certificate of food hygiene training; the customer organization decides which documents are uploaded.

Until it has been transmitted successfully, the file is kept in a separate, AES-GCM-encrypted queue on the device. As in Section 3.8, the key is stored separately in the Keychain, per signed-in person and organization; the folder is excluded from device backups. The name, document type, file size, and status of the pending upload are stored in the local device database (Section 3.7). The app uploads the file to the organization's private file storage at Supabase (Section 5.1); for this purpose, Mobistro stores the name, document type, file size and file type, the expiration date where applicable, the storage location, and the uploading person. After transmission, the file is removed from the queue and moved into the cache described in Section 3.8.

If the server rejects a pending upload, for example because the permission to upload has been withdrawn or the organization's document quota has been reached, the file remains encrypted on the device until a later upload succeeds, the person discards it, or signs out. Upon sign-out, upon a workspace switch, and when the app detects a revocation of permission, the queue is cleared in accordance with Section 3.11; documents not yet transmitted are lost in the process.

The app displays Word and Excel files using the iOS preview. To do so, it briefly stores the file unencrypted in the app's temporary folder, protected by iOS file protection, and deletes it when the preview is closed, or at the latest the next time the app starts.

3.14 Native App: Handoff to Maps, Phone, and Mail Apps

If a person taps “Start navigation” in the event details, the app hands off the event address entered as text to Apple Maps or, if Google Maps is installed on the device and selected, to Google Maps. Only the address text is handed off — no coordinates and no device location. If a person taps a phone number or email address of an event contact, or the support address, the app opens the device's Phone or Mail app with that entry.

The handoff takes place only at the person's initiative. From the moment of handoff, the respective app or its provider processes the information under its own responsibility in accordance with its privacy terms — for Apple Maps, for example, Apple, and for Google Maps, Google. Mobistro does not use these providers as service providers and does not receive any data back from them.

3.15 One Trial per Business

Each business is entitled to the free trial once. So that we can check this, we create an entry in a trial register when an organization is set up with a trial. It contains no plain text, only check values (hash values formed with a secret key, HMAC) of

  • the email address of the registering person, standardized (lower case, without a "+" suffix, without dots for Gmail),
  • the domain of this address, if it does not belong to a general email provider,
  • the company name from the conclusion of the contract, standardized (without legal form, spaces, and punctuation).

The key is kept separately from the register; the check values remain pseudonymous personal data. With every new registration, we form the same check values and compare them with the register. If the email address or company domain matches, the new organization starts without a trial; a plan can be booked immediately, and we review the individual case on request. A matching company name alone changes nothing; we only look at such cases individually. The entry remains even after the organization is deleted and is automatically deleted after 24 months. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to protect the free trial against multiple use. You may object to this processing on grounds relating to your particular situation (Section 10).

4. Legal Bases

For its own account management, authentication and provision purposes, Mobistro relies on Art. 6(1)(b) GDPR where the data subject is personally a contracting party or requests pre-contractual steps. For employees and other authorized users of a customer organization, we base these processing activities of our own on Art. 6(1)(f) GDPR. Our legitimate interest is to provide and manage the agreed access for the designated people. Security and abuse prevention are also based on Art. 6(1)(f) GDPR; our interest is secure and reliable operation. Retention required by law is based on Art. 6(1)(c) GDPR.

This is distinct from operational and employee data processed by Mobistro on the organization's instructions. The customer organization determines the purposes and legal bases as controller; our processing is governed by the DPA. An invitation or technical role does not make an employee a contracting party to the SaaS agreement.

The transmission of the billing email address and purchase data to Paddle and the processing of subscription data (Section 5.6) serve to purchase and carry out a paid plan. They are based on Art. 6(1)(f) GDPR; our legitimate interest lies in performing the contract concluded with the organization. Where the data subject is a party to the contract themselves, for example as a sole proprietor, they are based on Art. 6(1)(b) GDPR.

To the extent Mobistro processes operational data on behalf of a customer organization, the customer organization is the controller and Mobistro is the processor pursuant to Art. 28 GDPR.

5. Recipients and Service Providers

5.1 Supabase

Supabase Pte. Ltd provides database, authentication, file storage, Realtime services, and server-side Edge Functions. The database, authentication, file storage, and Realtime of the Mobistro project use Frankfurt (eu-central-1) as their primary region. Edge Functions are provided via a distributed, region-dependent runtime and, unless expressly bound to an EEA region, may also process data outside the EEA. Supabase Pte. Ltd is based in Singapore. Processing is based on Supabase's contractual data protection terms; there is no adequacy decision of the European Commission for Singapore, so the EU Standard Contractual Clauses apply as the transfer mechanism. Any further third-country transfers are subject to the transfer mechanisms and safeguards provided for therein.

For database access, sign-in, file storage, and Realtime updates, the native app connects directly to the same Supabase services as the web app. The native app itself does not call any Supabase Edge Function. For certain background tasks that also concern invited operator accounts — such as sending the invitation email when a new team member is added — Mobistro continues to use Supabase Edge Functions on the server side; the native app is affected only indirectly, because the invited account later signs in through it. The regions, roles, and transfer mechanisms described above apply unchanged to all Supabase services.

5.2 Hetzner

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the web delivery and the Coolify, Docker, and Traefik infrastructure managed by Mobistro in Germany. The daily backup of the database and files is also kept on a server and a separate storage at Hetzner in Germany; the storage receives it only in encrypted form. Processing on our behalf is subject to the requirements of Art. 28 GDPR. Further provider information: Hetzner privacy policy.

5.3 Resend

Transactional authentication emails are sent via Resend, operated by Plus Five Five, Inc., USA. Mobistro also sends the invitation email to new team members via Resend; it contains the organization's name, the intended role, and the invitation link. In the process, at least the recipient address, sender, message content, and delivery metadata are processed. Link and open tracking are disabled for Mobistro authentication emails. The Resend DPA incorporates the EU Standard Contractual Clauses and describes primary processing in the USA.

5.4 Cloudflare Turnstile

On authentication pages, Cloudflare Turnstile from Cloudflare, Inc., USA, is loaded as abuse protection. Turnstile runs small security checks in the browser and, for this purpose, processes browser, device, interaction, and network attributes. The result is validated on the server side as a short-lived token. Mobistro does not use Turnstile for advertising or user profiles; the integration implemented in the web app does not request pre-clearance. In the native app, Turnstile runs in an embedded browser component. Technically required cookies and local browser storage may persist on the device so that the security check retains its state. Mobistro does not store the short-lived validation token there.

To the extent Cloudflare provides Turnstile for Mobistro and processes the resulting personal data on Mobistro's instructions, Cloudflare acts as a processor. Under the Turnstile Privacy Addendum, Cloudflare may at the same time use certain data as a controller in its own right to improve its bot detection and security services. For these purposes of its own, Cloudflare determines the processing itself. Cloudflare provides contractual data protection terms, including terms for third-country transfers.

5.5 Geoapify (Maps and Place Search)

Geoapify is operated by KEPTAGO LTD, N. Nikolaidi & T. Kolokotroni, 8011 Paphos, Cyprus. Processing for the requested map and search features covers the data described in Section 3.4. Where event addresses are processed on behalf of the customer organization, this processing falls within the DPA. For its own technical provision and security purposes, Mobistro relies on Art. 6(1)(f) GDPR; our legitimate interest is reliable place search and map display for event planning.

The web app calls Geoapify through its EU endpoint. For this endpoint, Geoapify commits to processing requests exclusively in the EU; delivery is handled by BunnyCDN (BUNNYWAY, informacijske storitve d.o.o., Slovenia). This commitment does not cover the route data takes across the public internet. Geoapify also uses request data for access protection, usage counting and troubleshooting. According to the provider, successful requests are generally retained for no more than 24 hours; this statement does not apply indiscriminately to error cases. Further information: Geoapify privacy policy. Nominatim, CARTO and Google Maps are not embedded as web app map providers. Section 3.4 applies when opening Google Maps from the web app, and Section 3.14 when opening a maps app from the native app.

5.6 Paddle (Payment for Paid Plans)

Paddle sells paid plans to the organization as a reseller (merchant of record). The contracting party for order, payment, and invoice is Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom; for purchases from the USA, Paddle.com Inc., New York, USA, and from Canada, Paddle.com (Canada) Ltd., Toronto, Canada. Paddle processes the information collected during checkout, such as name, billing address, VAT identification number, and payment details, under its own responsibility in accordance with its privacy policy (https://www.paddle.com/legal/privacy) and is not a sub-processor of Mobistro. Mobistro does not receive payment details such as card numbers.

To assign a purchase, Mobistro transmits technical identifiers of the organization and checkout, as well as the selected plan, billing interval, and, where applicable, a discount or remaining trial period to Paddle. An existing Paddle customer identifier is used where available. Otherwise, Mobistro uses the billing email address provided when the organization was created or, failing that, that of the person making the purchase, to find or create a Paddle customer account. The browser also sends the transaction identifier and selected language to the Paddle checkout. When loading the payment script and during checkout, Paddle also processes network and browser data generated in the process, in particular IP address and browser information, in accordance with its privacy policy. Only admins of the organization can purchase or change a plan and open Paddle's billing and payment management. Cancellation is done through this management at Paddle.

Mobistro receives from Paddle the status and key details of the subscription: Paddle identifiers of the customer, subscription, and checkout, the plan, billing interval, currency, billing period, scheduled changes and, where applicable, a discount code. From this, Mobistro derives the scope of the organization's access. The complete, signed notifications from Paddle may contain customer, address, and company identifiers and are visible only to the operator. Their content is retained for traceability and is normally removed by the daily cleanup once it is more than 90 days old; the event type, timestamps, and status are retained. Cleanup also applies during data return or organization deletion. Statutory erasure rights remain unaffected.

There is an adequacy decision of the European Commission for the United Kingdom. For processing by Paddle in the USA, in Canada, or in other third countries, the transfer mechanisms set out in Paddle's privacy policy apply.

5.7 Apple (App Store, TestFlight, Diagnostic Data)

The native app is distributed via the Apple App Store and, for pre-release versions, via Apple TestFlight. The provider of these services in the EU is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple processes the downloading, installation, and updating of the app, as well as the Apple Account management required for this, under its own responsibility in accordance with its privacy policy (https://www.apple.com/legal/privacy/). Mobistro does not receive any information about individual persons in this process.

App Store: If a person has allowed sharing analytics data with app developers on their device, Apple provides Mobistro with crash reports and aggregated usage and performance data for the app, such as the number of sessions, active devices, and crashes. They contain no names or account data. This permission can be revoked at any time in the iOS settings under “Privacy & Security” → “Analytics & Improvements” → “Share With App Developers”.

TestFlight: Pre-release versions are tested by individual people whom Mobistro invites personally. Apple automatically collects crash reports and usage data, such as installations and sessions, and passes them on to Mobistro together with feedback from the app, including attached screenshots; the device setting for sharing analytics data does not prevent this. The data is linked to the name and email address from the invitation.

Mobistro uses this data only to troubleshoot and improve the app and does not share it with third parties.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the distribution and troubleshooting of the native app. Apple may also process data in the USA; the transfer mechanisms set out in Apple's privacy policy apply to this.

5.8 Sub-processors

The current list of sub-processors engaged to provide the services is available in the web app at /legal/subprocessors.

6. Third-Country Transfers

With Supabase, Resend, Cloudflare, Paddle, and Apple, processing may take place by providers based in the USA, in the United Kingdom, or outside the EEA. Depending on the provider, adequacy decisions, EU Standard Contractual Clauses, and supplementary measures are used as the basis for transfers. Mobistro bases this processing on the applicable provider terms, the roles described in Section 5, and the transfer mechanisms named there.

7. Storage on the Device

7.1 Web App

The web app stores the Supabase authentication session, including access and refresh tokens, in the browser so that sign-in is maintained and the session can be renewed. In addition, language, color scheme, and local UI states may be stored. When an invitation is accepted, the web app remembers the user identifier for the confirmed invitation for no more than 24 hours so that an interrupted process can be resumed. During an organization deletion, it keeps the identifier of the ongoing deletion process until it expires. This storage access is intended for the sign-in requested by the user, the respective process, or the respective setting.

The web app does not use analytics or advertising cookies. Only when an admin selects a paid plan does the web app load Paddle's payment script; loading it already establishes a connection to Paddle with the technical data described in Section 5.6. Checkout runs in a Paddle window that may use storage access by Paddle that is technically required for the requested payment (Section 5.6).

7.2 Native App (iPhone/iPad)

What the native app stores on the device, and for how long, is described in detail in Sections 3.6 to 3.13: sign-in data and the offline access credential in the Keychain, local operational data and pending synchronization, the reminders calculated on the device and scheduled in the iOS notification system, the AES-GCM-encrypted caches for documents, profile picture, and vehicle images, temporary encrypted damage photos, the encrypted queue for documents to be uploaded, and the cleanup behavior upon sign-out, workspace switch, and revocation of permission. Whether events are displayed as a list or a calendar, and the state of the reminders, are stored in the app's settings on the device. The content and lock-screen visibility of the reminders and the revocation of notification permission in the iOS settings are described in Section 3.7.

8. Retention Period and Deletion

We store personal data only for as long as it is required for the contract with the organization, the handling of support and security cases, or legal obligations. Statutory retention obligations, for example under commercial and tax law, remain unaffected.

  • User account: If a person deletes their account in the web app, Mobistro first removes the files listed in the person's profile-picture storage, then the account, sign-in data and profile. If file removal fails, account deletion is not completed; the person receives an error and can retry or contact us. Statutory erasure rights remain unaffected. Entries that the person created for their organization remain as the organization's data.
  • Organization: An Admin can delete the organization in the web app and request the return of its data beforehand. Deletion permanently removes the organization's operational data, including its files. It is blocked as long as a paid plan has not been canceled. If a paid plan ends, the organization continues to exist with read-only access until it is deleted. Records of concluded agreements, such as a data processing agreement, are kept separately by Mobistro.
  • Removed team members: If an Admin removes a person from the organization, their membership ends. Their user account remains until the person deletes it or requests its deletion from us.
  • Invitations: Invitations, including the invited email address, remain stored even after acceptance, expiry, or revocation until the organization is deleted.
  • Export log: Mobistro logs who triggered a complete data export of the organization and when. The entry is kept without a fixed period; deleting the organization removes its link to the organization, and deleting the account removes its link to the person.
  • Deleted entries: Entries deleted in the platform are first hidden by Mobistro. They are permanently removed no later than when the organization is deleted.
  • Trial register: Entries under Section 3.15 are automatically deleted 24 months after they were created, even if the organization was deleted earlier.
  • Backup copies: Mobistro backs up the database and files daily and keeps each backup for no longer than 28 days; the backup storage also keeps snapshots for seven days. Deleted data may therefore still be contained in backup copies, as a rule for no longer than six weeks after deletion. Mobistro uses backup copies only for restoring data.

Deletion requests can be sent to datenschutz@mobistro.app at any time.

For the native app, the on-device deletion behavior upon sign-out, workspace switch, and revocation of permission, as described in Section 3.11, is also relevant.

Mobistro stores subscription data under Section 5.6 for as long as the organization exists and billing questions may remain open; Paddle issues invoices and retains them in accordance with the obligations applicable to Paddle. The daily cleanup after 90 days described in Section 5.6 applies to the complete notifications from Paddle.

9. Security Measures

The measures include TLS, role- and organization-bound database policies, server-side access controls, private file storage, short-lived access tokens, abuse protection, and an unprivileged, read-only web container. In the native app, these are supplemented by the device-protected Keychain for sign-in data and the AES-GCM encryption of local document, image, and photo caches and of the queue for documents to be uploaded (Sections 3.6 to 3.9 and 3.13). Security logs are limited to what is required for operation and troubleshooting.

No technical system offers absolute security. Security incidents are assessed and handled in accordance with the applicable legal requirements.

10. Rights of Data Subjects

Subject to the statutory requirements, data subjects have the right of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, that consent can be withdrawn with effect for the future.

Please send requests to datenschutz@mobistro.app. You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for the controller's place of business is, in particular:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden
https://datenschutz.hessen.de/

11. Automated Decision-Making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. AI features are not active. The check under Section 3.15 only decides whether a new organization starts with a free trial. A plan can be booked at any time; on request, we review the individual case personally.

12. Notice for Persons in the US

Mobistro is intended for businesses. For organizations and persons in the US, the preceding sections apply unchanged; their data is also stored in the primary region of Frankfurt (Section 5.1). In addition:

  • No sale, no sharing for advertising: Mobistro does not sell personal information and does not share it for cross-context behavioral advertising. Mobistro does not use personal information for targeted advertising and does not create profiles that produce legal or similarly significant effects.
  • Categories, sources, purposes, and recipients: Which data Mobistro processes, from which sources, and for which purposes is set out in Section 3; to whom it is disclosed, in Section 5; and how long it is retained, in Section 8. Passwords are transmitted over an encrypted connection to Supabase Auth for authentication and stored there as a hash (Section 3.1).
  • Requests: Individuals can request access, correction, and deletion via datenschutz@mobistro.app, including through an authorized agent. Before responding, Mobistro verifies that the request comes from the individual concerned, and does not discriminate against anyone who makes such a request. If a request concerns operational data that Mobistro processes on behalf of an organization, Mobistro forwards it to that organization.
  • Do Not Track and Global Privacy Control: Mobistro does not track individuals across third-party websites and services. Browser signals such as Do Not Track or Global Privacy Control therefore do not change how data is processed.
  • Children: The web app and the native app are not directed to children. Accounts are created for work in a business. Mobistro does not knowingly collect personal information from children under 13. If Mobistro learns that data of a child under 13 has nevertheless been stored, it will be deleted.

13. Changes and Contact

We update this policy when the legal situation, providers, or product data flows change. The current version is available at https://pitstop.mobistro.app/legal/privacy.

Contact for data protection inquiries: datenschutz@mobistro.app