Faro Privacy Policy

1. Who we are

Faro is made by Corvus Reach, a Spanish autónomo. Contact: contact@corvusreach.com · data protection & legal requests: legal@corvusreach.com.

2. What we store

Faro is a shift-scheduling and time-tracking tool. When an organisation signs up and adds people, we store:

• Account data — name, email address, role within the organisation, and the organisation name. Used to sign people in and to show who is on the rota.
• Shift and schedule data — planned shifts, actual clock-in and clock-out times, break records, and the resulting worked-hours totals.
• Time-off records — leave requests, approvals, balances and the type of leave.
• Organisation settings — shift templates, overtime rules, public-holiday calendars, and theme preference.

We do not collect GPS location, device identifiers, biometric data, or anything outside what is listed above.

3. Who can see what

An organisation's data belongs to that organisation. Admins see everyone's hours and schedule. Team members see their own hours and the shared rota. No organisation can see another's data. Corvus Reach staff access data only for support or debugging, under the same confidentiality obligations.

4. Authentication

Faro authenticates through Nido, our identity hub. The sign-in session is a secure, HTTP-only cookie scoped to .corvusreach.com. Nido's own privacy policy covers the authentication layer; this policy covers everything Faro does after sign-in.

5. Crash & error reports

If the app hits an error, technical details are sent to our error-monitoring tool (Sentry): the error code, app version, screen/route, and browser or OS type. We never send your personal data, your schedule, or anything you typed — only what is needed to find and fix the bug. The in-app "Report a problem" button attaches the same error code so support can find the exact spot.

6. Why we can process this (legal basis)

Your account and its data exist because your organisation signed up for the service — processing necessary to provide that service (GDPR Art. 6.1.b). Your employer or organisation admin is the data controller for employment-related records (shift times, leave); Corvus Reach is the data processor acting on their instructions.

7. What we do NOT do

• No advertising, and no advertising identifiers
• No tracking across other apps or websites
• No analytics profiling of individuals
• Your shift data is never sold, rented, shared or used to train anything
• No third party is given your data except the infrastructure listed in section 8

8. Where it lives

Our servers are hosted on Railway (EU West region), inside the EU. The database is PostgreSQL, also hosted on Railway in the EU. Transactional email (account invitations, password resets) is sent through Resend. All traffic is encrypted over HTTPS.

9. Keeping and deleting

• Removing a person — an admin can remove a team member from the organisation. Their profile is deactivated; historical shift records are kept for the organisation's payroll and legal obligations (Spanish labour law requires employers to keep time records for four years).
• Deleting an organisation — contact legal@corvusreach.com. All organisation data, including every member's records, is permanently deleted.
• Personal data export — request a copy of your data at the same address.

10. Your rights (GDPR)

You can ask for a copy of your data, correction of it, or its deletion, and you can object to processing. For employment-related records your employer is the controller — direct those requests to them first. For anything held by Corvus Reach as processor, or for your account data, email legal@corvusreach.com. You may also complain to the Spanish data protection authority (AEPD, aepd.es).

11. This page and cookies

This page is part of corvusreach.com, which uses cookies as described in the Corvus Reach Privacy Policy. See our Faro cookie notes for the short version. The Faro app itself uses a session cookie for authentication and no tracking cookies.

12. Children

Faro is a workplace tool and is not directed at children under 16.

13. Changes

If this policy changes materially, we will note it here and update the date at the top.

14. Contact

Problems and bugs: it-admin@corvusreach.com
Privacy and legal: legal@corvusreach.com
Data controller (for account data): Corvus Reach, Costa Blanca, Alicante, Spain. Full legal identification available on request at the email above.