Privacy Policy

1. Who processes your data

The data controller is:

Snail Rollers s.r.o.
Kurzova 2222/16, Stodůlky, 155 00 Prague 5, Czech Republic
Company ID (IČO): 23380551, Tax ID (DIČ): CZ23380551
registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 426173
Email: info@spooler.cz

We have not appointed a Data Protection Officer. Please send any questions about your data to the email address above.

2. What this policy covers

This policy describes how personal data is processed in the Spooler service, namely:

• the Spooler mobile app for Android and iOS,
• the web app at app.spooler.cz,
• the cloud backend that both apps sync with,
• communication between the app and the Spooler measuring device over Bluetooth.

On the spooler.cz website and the docs.spooler.cz documentation we measure visits. We only use cookies on spooler.cz and only with your consent (see section 4.6 and the cookie policy).

3. Workspaces and organizations

Data in the app belongs to an organization's workspace, for example your company's. Members of an organization can see the data in its workspace, including records you have created.

If you use the app as a member of an organization (for example as an employee), that organization manages the workspace content. For data the organization and its members put into the workspace (such as records of work done), we act as a processor on the organization's behalf, so we handle requests about that data together with the organization. For your user account data, error reports and analytics, we are the controller.

4. What data we process and why

4.1 User account

• What: first and last name, email address, internal user ID, organization memberships and roles. If you sign in with a third-party account (such as Google), we receive your name and email from that provider. Sign-in tokens are stored in the phone's secure storage (Keychain or Android Keystore).
• Why: to create and manage your account, sign you in and give you access to your organization's workspace.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4.2 Workspace data

• Measuring devices: serial number, the device's Bluetooth / MAC address, model, hardware and firmware version, battery level, time last seen, and any name, location and notes you add.
• Spools and cables: spool label, cable type, initial and current length, location, NFC tag identifier.
• Projects and labels: names, descriptions, colors.
• Cable consumption records: measured length before and after, length consumed, start and end timestamps of the measurement, project, device, and the user who created, edited or approved the record. Optionally also technician name, crew size, work order number, temperature, place and a note.
• Device measurement history: timestamps and measured lengths transferred from the device over Bluetooth.
• Why: this is the core of the app: tracking cable consumption, keeping an overview of stock, preparing job billing, and syncing between phone, web and colleagues.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR). For organization data, we process it on the organization's instructions.

4.3 Change history (audit log)

• What: who created, changed or deleted a workspace record and when, the old and new values, and the IP address the change came from.
• Why: to keep changes traceable, resolve disputes about measured values, and for security.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in trustworthy records and protection against misuse.

4.4 AI assistant

• What: the text of your question, earlier messages in the same conversation, which screen you are asking from, and the workspace data the assistant needs to answer (for example spool stock or consumption on a project).
• Why: to answer your question. The assistant is only used when you write to it.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• The conversation history is kept only in the app's memory and is gone when you close the app. We do not store questions or answers on our server. They are sent for processing to the language model provider (Anthropic, see section 6).

4.5 Error reports and diagnostics

• What: error description and where in the code it happened, app version, phone model and OS version, the sequence of events before the error, response times of selected operations (for a sample of sessions), and a screenshot and screen structure at the moment of the error. The screenshot may include whatever was shown in the app at the time, such as a project or spool name. Server-side errors may include your user ID and email.
• Why: to find and fix bugs and keep the app stable and secure.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a working and secure service.

4.6 Usage analytics

• What: app lifecycle events (install, update, open, move to background), app version, device and OS type, and a random installation identifier. After you sign in, we link these to your user ID and email.
• Why: to understand how many people use the app, on which versions and devices, and to plan development and support accordingly.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in improving the service. You can object to this at any time (see section 9).
• spooler.cz and docs.spooler.cz websites: anonymous visitor statistics only, i.e. pages visited, where you came from, browser and device type, and approximate country. Your IP address and browser details are processed for this. Without your consent nothing is stored in your browser, and repeat visits on the same day are recognised only by a one-way fingerprint that changes every day (legal basis: legitimate interest). If you allow cookies on spooler.cz, we store a cookie with a random identifier for 1 year to recognise repeat visits (legal basis: consent, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the Cookie settings link in the website footer.

4.7 Technical data and support

• Technical data: each connection to our servers involves processing your IP address, the time of the request and app details, to keep the service running and protect it against attacks (legitimate interest).
• Support: when you write to us, we process your email address and message so we can reply (legitimate interest or performance of a contract).

We do not use your data for advertising, we do not sell it, and we do not carry out automated decision-making or profiling with legal effects.

5. What stays on your phone

• Offline database: the app keeps a copy of workspace data and any unsent changes in a local database (SQLite) so it works without a connection. Changes are sent to the server once you are back online. Uninstalling the app deletes the local data.
• Bluetooth: used to connect to the Spooler measuring device and transfer measurements.
• Location: older Android versions require the location permission to scan for Bluetooth devices. The app does not read, store or send your phone's location.

6. Who we share data with

Data is processed by the following providers, who act as our processors under a contract and may use it only on our behalf:

Transfers outside the EU: Where data reaches a provider in the USA, the transfer relies on the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified providers, and otherwise on Standard Contractual Clauses approved by the European Commission. Under its commercial terms, Anthropic does not use API data to train its models.

Other recipients: other members of your organization (within the workspace), public authorities where the law requires it, and any acquirer of our company or service, who would be bound by this policy.

7. How long we keep data

• User account: for as long as the account exists. After the account is deleted, we remove the data from our systems and from the sign-in provider within 30 days.
• Workspace data and audit log: for as long as the organization's workspace exists. When you delete your account, the organization's records in its workspace remain, but are no longer linked to your user account.
• Backups: deleted data may remain in backups for a limited time until they are overwritten in the regular cycle. Backups are only restored for disaster recovery.
• Error reports and analytics: for the retention period configured with the provider (Sentry, PostHog), after which they are deleted automatically.
• AI assistant: not stored on our server. The language model provider keeps it only for the period set in its terms for processing and abuse monitoring.
• Server technical logs: for as long as needed for operation and security, then continuously overwritten.
• Support communication: until your request is resolved, then for up to 3 years in case of a dispute.
• Accounting and tax records (if you are a customer): for the period required by accounting and tax law, up to 10 years.

8. Security

All communication between the app and our servers is encrypted (HTTPS/TLS). Each organization's data is kept separate and access is permission-based. Sign-in tokens are stored in the phone's secure storage. Only authorized people have access to the servers.

9. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data erased, including deleting your account (see Account deletion),
• restrict processing,
• data portability in a machine-readable format,
• object to processing based on legitimate interest (error reports, analytics, audit log),
• lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority in your EU country of residence.

To exercise your rights, email info@spooler.cz, ideally from the address linked to your account. We will reply without undue delay and within one month at the latest.

10. Children

Spooler is a work tool for companies and tradespeople and is not intended for anyone under 16. We do not knowingly process children's data.

11. Changes to this policy

We may update this policy, for example when we add a new feature. The current version is always at this address, with the effective date shown at the top. We will notify you of material changes in advance in the app or by email.