Privacy · Ortie mobile app

Version mobile-production-20261013-v1 · 13 October 2026.

Provider and scope

Ortie is provided by YES Buddy, Dutch Chamber of Commerce number 93889402, VAT ID NL005052680B38, Snippenhof 30, 7064 DZ Silvolde, Netherlands. Privacy contact: yes__@hotmail.com, +31 6 27485338. This notice covers the production iOS and Android apps and their connected workplace service. App Store, Google Play and TestFlight also process information under their own privacy notices.

Responsibilities and legal bases

Your organisation determines the purpose, access and retention of employee work information; YES Buddy processes it on the organisation’s instructions. Ask your organisation about its lawful basis and employee information arrangements. YES Buddy is responsible for its own business contacts, service security and handling statutory requests. Depending on the purpose, these activities rely on performing an agreement, legal obligations or a necessary, proportionate legitimate interest in operating and securing the service. Device notification permission is not blanket consent to employee monitoring or other processing.

Account, work and activity information

We process your name, email address, account ID, organisation, assigned workplace, role and sign-in information for access and permissions. Tasks, checklist answers, handovers, updates, messages and private To-do are processed to provide the features you use. Ownership, status, timestamps, read confirmations, reactions and active days support coordination and team insights. This information is linked to your account. Opening the app or acknowledging a message does not prove productivity, understanding or completed work. Ortie does not automatically make employment decisions. Feedback and account/privacy requests are processed for support and handling those requests.

Who can access the information?

Authorised colleagues see shared work within their configured workplace. Conversation participants see the conversations they are allowed to access. Supervisors have additional management and insight features. Private To-do is available only to its owner in the app and is not included in supervisors’ team insights. Data is processed on the server; this is not end-to-end encryption. Restricted technical administration can be necessary for security, support and privacy requests. Platform account-erasure administration requires two-step verification.

Phone notifications and local storage

Optional notifications use an installation identifier, an Apple or Firebase device token, your account binding and notification preferences. They contain a general category description and an allowed destination, rather than chat content or colleagues’ names. Tapping a notification opens the relevant section or conversation after access is checked. The server checks Ortie’s Do not disturb preference before sending. Signing out detaches that installation’s binding and clears its local session; already delivered notifications cannot be recalled. iOS uses app-private Keychain storage; Android uses an encrypted app-private vault with a key protected by Android Keystore. Ortie does not store your password in that vault. Necessary browser sign-in cookies and local preferences support website access.

Infrastructure, recipients and international processing

Supabase provides authentication and the primary production database in Frankfurt. Vercel hosts the website and server functions; the configured function region is Frankfurt. Google Firebase Cloud Messaging delivers Android notifications and Apple Push Notification service delivers iOS notifications. Resend provides configured service emails. Infrastructure providers process network addresses, request times, technical status and errors to operate and secure their services. European database and function regions do not mean all supplier processing is limited to the EEA; providers also use international infrastructure. Their applicable processing terms and transfer arrangements govern this processing. The mobile app does not request card or bank details or provide an in-app payment checkout.

Retention, archiving and account deletion

Your organisation must keep work information only while needed for its lawful work and accountability purposes and determine an appropriate retention schedule. Completing or archiving an item, or a visibility period ending, does not erase it. Account deletion and data requests can be made inside the app or without signing in at ortie.app/account-hulp. We verify and handle requests; submitting a request is not immediate erasure. Personal account information and private content are addressed in the deletion process. Shared work history is assessed separately for lawful retention needs; any applicable exception is explained. Support and request records are retained while necessary to handle and substantiate the request or meet a legal obligation, and must not be kept indefinitely without a purpose.

Supplier records and backups

Unlinking notifications prevents further authorised sends to that binding; it does not erase work history or every supplier record. Firebase installation deletion on a reachable Android device can take time; Firebase describes a period of up to 180 days for completing deletion across its systems. Backups may retain earlier data until they expire and are used for recovery rather than ordinary access. Prior deletions must be reapplied before restored data is made available again. Daily database backups do not by themselves prove a recovery guarantee or cover separate uploaded files.

Your rights and contact

You may request access, correction, deletion or restriction, object to legitimate-interest processing and, where applicable, request portability. Contact your organisation for employee work information; YES Buddy assists with handling it. Contact yes__@hotmail.com directly for YES Buddy’s own processing or account assistance. We may need proportionate verification; do not send a password or identity document without being asked. Requests are answered in principle within one month; any legally permitted extension is explained within that period. You can complain to the Dutch Data Protection Authority.

Practical limits

Ortie is intended for team work from age 16. It is not a client record or medical system. Do not enter identifiable client information, medical details, employee health information or sensitive personnel records, including in chat or private To-do. This release contains no advertising identifiers, advertising trackers, GPS tracking or Firebase Analytics. Necessary functional activity and infrastructure processing described above still take place.

Account deletion and privacy requests