Privacy, explained

01Who we are

Leavely is a leave-management service operated by Emre Turan, based in Portugal. For questions about your data, contact us at support@leavely.co.

Leavely is multi-tenant: companies invite their people to manage time off together. For account data (your name, email, login) we are the data controller. For the leave data your employer manages about you, we act as a processor on your employer's behalf, and your employer is the controller.

In plain terms: Your login is between you and us. The time-off records your employer keeps are governed by your employer.

02Data we collect

We collect only what the service needs to work:

Account

Name, email address, and password (stored hashed).

Company

Your role, department, and company memberships.

Leave

Requests, balances, approvals, and work schedules.

Media

Profile photos and company logos you upload.

Technical

IP address and device data in sign-in security checks and error logs, plus cookie-free page analytics.

In plain terms: Name, email, and the leave records that make the product function. Nothing we don't use.

03Why we use it

We process your data to provide the service: authenticating you, showing who is away, calculating balances, routing approvals, and sending the emails the product depends on. We do not sell your data, and we do not use it for advertising.

In plain terms: To run Leavely for you and your team. We never sell it.

04Our legal basis

We rely on two lawful bases under the GDPR. Where you or your employer have a contract with us, we process data to perform that contract. Where we improve security or prevent abuse, we rely on our legitimate interest, balanced against your rights.

05Who we share it with

We share data with a small set of service providers: hosting and database providers, a payment processor, an email delivery service, an error-monitoring service, and a sign-in security service. Each is bound by a data processing agreement and acts only on our instructions. We do not share your data with anyone else unless the law requires it.

In plain terms: A short list of vendors that help run the product, each under contract. No one else.

06International transfers

Some of our providers operate outside your country. When data is transferred internationally, we rely on safeguards such as the EU Standard Contractual Clauses to keep it protected to the same standard.

07How long we keep it

We keep your data while your account is active. When you delete your account, we delete your account and sign-in details immediately, except where we must retain records to meet a legal or accounting obligation. A company that employed you keeps your employee record and leave history, with the name and email address you had at that time, because those records belong to the company. A company admin can anonymize that record at any time, and it is deleted with the company. Provider backups expire on their own rolling schedule.

In plain terms: Active account: we keep it. Deleted account: your sign-in is gone right away, minus anything the law makes us hold. A company that employed you keeps your leave history, with your name and email address, until an admin anonymizes it or the company is deleted.

08How we protect it

Data is encrypted in transit and at rest. Access is limited to what each part of the system needs, and administrative access is restricted and logged. See our Security page for more detail.

09Your rights

Under the GDPR you can request access to your data, correct it, delete it, export it, restrict or object to certain processing, and withdraw any consent you have given. Email us and we will respond within one month. Where your employer is the controller of leave data, we may direct you to them for those records.

You also have the right to lodge a complaint with a data protection supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD); you may also contact the authority in your own country.

In plain terms: Ask to see, fix, delete, or export your data any time. We answer within a month, and you can also complain to a data-protection regulator.

10Cookies

We use cookies that are strictly necessary to sign you in and keep the app working. We do not run advertising or non-essential tracking cookies without your consent.

In plain terms: Only the cookies that keep you logged in. No ad trackers.

11Changes to this policy

We may update this policy as the service evolves. When we make a material change we will update the date above and, where appropriate, notify you.

12Contact us

For any privacy question or to exercise your rights, email support@leavely.co. We are here to help.