Data Processing Addendum

OnYou · on-you.app · Annex to the Terms of Service · Last updated: August 17, 2026

This addendum applies when you use OnYou to work with other people's data: when you add someone to your contact book, assign them a task, receive the photos they completed it with, or look at their history. In that case there are two distinct roles, and it is worth having them written down.

1. Who decides and who carries it out

You decide. You choose who goes into your board, what for, what you ask of them and how long you keep it. In legal terms you are the controller of those people's data.

We carry it out. Alfa Marketing S.A. — the company behind OnYou, domiciled in Quito, Ecuador — stores and processes that data following your instructions, which are the actions you take inside the app. We are the processor.

Put briefly: if one of your workers asks why their phone number and their photos are in OnYou, the answer is "because their employer put them there to manage their work". We answer for having stored it properly; you answer for the relationship with that person.

For your own account data — your email, your name, your number — this addendum does not apply: there we are the controller, and that is covered by the Privacy policy.

2. What we process, whose, and what for

What	Whose	What for
Name and WhatsApp number	The people you add to your contact book or assign tasks to	Being able to direct work to them and get them their link
Email, city and company	The contacts where you fill them in (optional)	Making your contact book useful to you
Task content	What you write about the assigned work	It is the service itself
Backing photos	Whoever completes a task that requires them	Leaving evidence that the activity was done
Comments and history	Whoever takes part in a task	Follow-up: what was done, by whom and when

The processing consists of hosting, displaying, organising, backing up and deleting that data in order to provide you the service. Nothing else. We do not build profiles, we do not cross your data with other customers', we do not sell or hand it over, and we do not use it to train artificial intelligence models.

Duration: for as long as your account is active, plus the deletion periods in clause 8.

3. What we commit to

Acting only on your instructions. The instructions are the actions you take in the app. We do not process that data for our own purposes. If the law ever required us to do otherwise, we would tell you first, unless the law itself forbids it.
Confidentiality. Anyone with access to this data through working on OnYou is bound to keep it confidential, and that duty continues after they stop working with us.
Security. The measures in clause 4, reviewed whenever the system changes.
No blind subcontracting. We only use the sub-processors in clause 5, under the same obligations we take on here.
Helping you when someone exercises their rights (clause 6) and when there is a security incident (clause 7).

4. How we protect this data

These are not intentions: they are the measures the system has today.

Isolation between accounts at the database level. Every query goes through security rules in the database itself (RLS), so one account cannot read another's data even when trying from outside the app. It is not a check the screen performs: the database enforces it.
All traffic is encrypted over HTTPS, and passwords are stored encrypted: we never see them in the clear.
The links you send to people without an account open only their own: just the tasks addressed to their number, within your board. They do not receive your contact book or the index of your books and sections.
You control those links. They expire after 90 days without use, and from Tools › Team access links you can deactivate them or change the code so the previous one stops working.
We minimise what leaves the system. When you use the AI generator, the only thing that travels is the text you have just written describing the activity: not your name, not your contacts, not your photos, not the rest of your board.

5. Sub-processors

To operate we need infrastructure providers. These are all of them, with none left out:

Who	What they do
Supabase	Database, authentication, storage of the photos and sending of the service emails
Netlify	Hosting of the web application
Anthropic	Only if you use the AI checklist generator: processes the description you write
Browser Web Push providers	Only if you turn on alerts: they deliver the notifications to the device

With the first three we have a data processing agreement in force, with contractual protection clauses. If we ever change provider or add a new one, we will announce it on this page and inside the app with reasonable notice, so you can object before the change happens. If you object and we cannot find an alternative, you may terminate your account.

Data leaving Ecuador

Those providers' servers are outside Ecuador. The transfer rests on those agreements, which incorporate standard contractual clauses and bind them to a level of protection equivalent to the one Ecuadorian law requires. Part of the transfer is also simply necessary in order to provide you the service: without hosting and without a database there is no app.

6. When someone exercises their rights

If one of the people in your board wants to know what data of theirs exists, correct it, take it with them or have it deleted, you are the one who must attend to them: it is your relationship with them. We give you the tools to do it inside the app — view, edit, export and delete — and we help you if something cannot be resolved from there.

If that person writes to us directly, we do not decide for you: we explain that the board is yours, pass it on to you and wait for your instruction, unless the law requires otherwise.

7. If a security breach happens

If we detect unauthorised access, or an improper loss or disclosure affecting data in your board, we notify you without undue delay and give you what you need to meet your own obligations: what happened, when, which data and which people were affected, what we have done and what you should do.

On our side, we notify Ecuador's Superintendency of Personal Data Protection within fifteen (15) days of becoming aware of the incident. Notifying the affected people, where required, falls to you as controller, and we assist you with it.

8. How long the data lasts and what happens at the end

Completed tasks are archived and delete themselves according to the window you configure (48 hours by default).
Backing photos delete themselves 3 months after being uploaded. We warn you inside the app three weeks beforehand.
The rest of the content is kept for as long as your account is active.
When you delete your account — from More › Tools › Session › Delete my account, or from on-you.app/borrar-cuenta.html — your boards, tasks, contacts, comments, history and photos are removed. It is immediate and cannot be undone. That satisfies our obligation to return or delete the data at the end of the engagement: you can export whatever you need beforehand.

We keep no copies beyond the above, except what the law requires us to retain for a time.

9. What falls to you

As controller, by using OnYou you confirm that:

You have a legitimate reason to process the data of the people you load (for example, an employment or collaboration relationship).
You have informed them that their data is managed with a tool like this one, to the extent the law requires of you.
Your instructions — that is, the use you make of the app — do not break the law.
You do not load sensitive data (health, beliefs, biometrics and other special categories) into fields that are not meant for it. OnYou is a task management tool and is not designed to process it.

10. Information and verification

You can ask us for the information you need to verify that we comply with this addendum, and we will give it to you: what measures we have, which sub-processors we use and how the deletion periods work. Write to hello@on-you.app.

11. How it is accepted and how it changes

This addendum forms part of the Terms of Service, which incorporate it by reference: by accepting the terms you also accept this addendum, with no need to sign anything separately. If we amend it, we will update the date above and, if the change is significant, we will tell you inside the app.

In case of conflict between this addendum and the terms, this addendum prevails in everything relating to the processing of third-party data.

12. Contact

hello@on-you.app