Privacy Policy — Veihus Time

Effective date: 2026-05-21
Last updated: 2026-09-15 (corrected the iOS background-location description in §3 — the iOS app no longer uses "Always Allow" / background location)

1. Who we are

Data controller: Veihus AS, Ormerudveien 3 B, 1410 Kolbotn, Norway. Org. nr. 825 603 972.
Contact: gk@veihus.no, +47 968 51 70.
Application: Veihus Time (web at https://app.veihus.no, Android app on Google Play, and iOS app on the Apple App Store).
Intended users: employees of Veihus AS and authorised subcontractors who perform on-site work.

2. What personal data we collect

Category	Examples	Purpose	Legal basis
Account identifiers	Full name, email, Firebase Auth user ID, language preference	Sign-in, access control, multilingual UI	Performance of employment contract (GDPR art. 6(1)(b))
Work registration data	Project, start/end timestamps, lunch-break flag, work description, extra hours	Time-tracking, payroll, customer invoicing	Performance of contract; legitimate interest (art. 6(1)(f))
Precise location (GPS)	Lat/long at job start, job end, and during an active session (foreground; background on Android only)	Verify on-site presence; auto-close session when worker leaves the job site (geofence)	Performance of contract; legitimate interest. Collected only while a session is active.
Photos	Pictures the worker takes during a session	Document work; attach to PDF reports for customers	Performance of contract
Device permissions metadata	OS version, app version, granted permissions	Diagnostics, security	Legitimate interest (art. 6(1)(f))

We do not collect: contacts, calendars, messages, microphone audio, browsing history, advertising identifiers, biometric data, payment information.

We do not sell personal data. We do not use it for advertising or analytics profiling.

3. Background location — why and when

On Android, the app requests ACCESS_BACKGROUND_LOCATION so the timesheet can automatically close an open session when a worker leaves the job site, even if the screen is off or the app is backgrounded. This prevents forgotten sessions that would otherwise inflate hours.

On iOS, the app uses session-scoped ("When In Use") location only — it does not request "Always Allow" and does not use background location. Automatic closing works while the app is open; if the app is closed, a secure server-side check closes forgotten sessions after the normal shift length.

On both platforms, location is used only while a work session is open. As soon as the session ends, collection stops entirely. The worker can revoke the permission at any time from device Settings; the app will fall back to manual end only.

4. Where data lives

All personal data is stored on Google Cloud Platform (Firebase) in the EU region (europe-west1, Belgium): Firestore, Cloud Storage, Authentication, Cloud Functions. Google acts as our data processor under a Data Processing Addendum.

5. Transfers outside the EU

Data is processed in europe-west1. Google may, for backup, fail-over or sub-processor reasons, replicate it to data centres outside the EU/EEA, under Standard Contractual Clauses (SCCs).

6. Retention

Active registrations: retained as long as needed for payroll and invoicing, plus the Norwegian bookkeeping retention period of 5 years (regnskapsloven §13).
User profiles: retained while the worker is employed. On request, an administrator can deactivate or delete the profile.
Photos: retained with the registration record.

7. Recipients

Veihus AS administrators and managers — full access.
Workers — their own data only.
Customers — may receive PDF reports that include the worker's name, work date, hours and (optionally) photos. No GPS coordinates or email addresses are shared.
Google (as processor) for hosting.
Public authorities — only when legally required.

8. Your rights (GDPR)

You may request access, correction, erasure (subject to legal retention), or object to processing. To exercise rights or lodge a complaint contact gk@veihus.no. You can also complain to the Norwegian Data Protection Authority, Datatilsynet.

9. Security measures

TLS 1.2+ encryption in transit; encryption at rest via Google Cloud.
Role-based access via Firestore Security Rules (default-deny).
Photo uploads only via server-side function; direct client writes are disabled.
Firebase App Check (anti-abuse) is being phased in.
Cloud Function audit logging; failed-login monitoring.

10. Children

The service is intended for Veihus AS employees and is not directed at children under 16. We do not knowingly collect data from minors.

11. Changes

Material changes are published on this page with an updated "Last updated" date.

12. Contact

Data protection contact: gk@veihus.no
Postal: Veihus AS, Ormerudveien 3 B, 1410 Kolbotn, Norway
Phone: +47 968 51 70
Supervisory authority: Datatilsynet, https://www.datatilsynet.no/