1. Controller and contact
Alexander Schmitz, NovaApps, Am Rottenbach 3, 31008 Elze, Germany, is responsible for operating this website and for account and service security. Contact: info@novaapps.de.
2. Your business's responsibility
The business using All Gets Done determines why employee, location and task data is processed. It is the controller for that data. We process workspace data on its instructions; processing on behalf of a business requires an agreement under Article 28 GDPR. Employees should normally address requests concerning workplace records to their employer. We can help identify the appropriate contact.
3. Visiting the public website
The hosting service processes connection information such as IP address, requested resource and time to deliver the website and protect it from misuse. Our legal basis is our legitimate interest in secure operation under Article 6(1)(f) GDPR. The public pages do not use advertising trackers or analytics. A manually chosen language is saved in your browser; otherwise we use your preferred browser language. We do not request your geographic location to choose a language.
4. Accounts and workspace content
We process the owner's email address, contact and business details; team members' names, usernames, roles and account states; locations and addresses; task assignments, deadlines, recurring work, status changes, comments and uploaded photos. Authentication also involves credentials and session tokens. Provide only information needed for the work, and avoid including bystanders or unnecessary personal information in photos. Camera or photo-library access is requested when you choose to add a photo.
5. Purposes and legal bases
Account setup, provision of the agreed service and support rely on Article 6(1)(b) GDPR when you are our contracting party. For business contacts and necessary service security, we rely on Article 6(1)(f). Statutory duties may require processing under Article 6(1)(c). The business determines the applicable legal basis for its employees' data. Optional processing based on consent, if offered, will be explained separately; consent may be withdrawn for the future.
6. Firebase and service providers
We use Google Firebase for hosting, authentication, database, file storage and server functions, and Firebase App Check with reCAPTCHA Enterprise to protect requests. Database, file storage and functions are configured in Frankfurt (europe-west3). This does not mean all processing is confined to Germany: authentication and global infrastructure can involve processing in the USA and other countries. Google's applicable data-processing terms and transfer safeguards apply, including standard contractual clauses where required. See Firebase privacy and security, the Firebase data-processing terms and Google's privacy policy. reCAPTCHA is also subject to Google's terms.
7. Login protection and access
Failed employee login or activation attempts are counted to limit misuse. The application uses a hashed IP identifier for rate limiting and records relevant account lock events. Business owners can receive an in-app notice naming the account, time and reason. An IP hash can still be personal data. Authorized people in the same business can access records according to their roles; data is not a public team directory. We do not sell workspace data or use it for advertising.
8. Storage on your device
The app uses browser or device storage for your language and appearance preferences, session information, and encrypted cached work and pending changes. Necessary storage supports login, security and the offline functions you use; requested preferences are stored for that purpose. The legal basis for strictly necessary device access is Section 25(2)(2) TDDDG, with subsequent processing as described above. Signing out clears the app's local user vault. On shared devices, sign out after use. Clearing site data can discard changes that have not yet synced.
9. Retention and deletion
Workspace records are retained for the provision of the service until deletion is requested or required. Archiving a task or disabling an account does not itself erase historical records. Security counters have expiry timestamps; technical deletion can be delayed. Provider logs and backups follow the provider's retention cycles, so deletion is not necessarily immediate everywhere. Legal duties or establishing and defending legal claims may require longer retention. Contact us to arrange workspace or account deletion; we review any remaining legal retention duties. Avoid uploading information that your business no longer needs.
10. Your rights
Subject to the GDPR's conditions, you may request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your situation. You can complain to a supervisory authority, including the Lower Saxony authority, Die Landesbeauftragte für den Datenschutz Niedersachsen. Contact us at the address above. We do not use this app to make solely automated decisions with legal or similarly significant effects about you.
11. Contact requests and changes
When you email us, we use your contact details and message to respond and manage the request. Do not send passwords or activation codes. This notice may be updated when functionality or processing changes; the current version is available here.
Last updated: 14 October 2026