AwayDayPrivacy Policy
Last updated 19 September 2026
This explains what personal data AwayDay (provided by Talls) collects, why, and what your rights are. AwayDay is built on Supabase, and stores nothing beyond your own device unless you choose to sign in and sync.
1. Controller and processor
For your own account details (your name, email, login), Talls is the data controller. For any information your workspace stores about your team - names, absence records, notes - the company running that workspace is the data controller, and Talls acts only as a data processor on their behalf, processing it solely to provide the service.
2. What we collect
| Data | Why |
|---|---|
| Name, email, password (hashed), profile photo | To create and secure your account |
| Two-factor authentication status | Account security |
| Workspace data you or your team enter (teams, people, absence entries, notes, shift patterns) | To provide the calendar/tracking features you're using |
| Basic usage data (e.g. sign-in times) | Security, fraud prevention, and diagnosing problems |
If you only ever use AwayDay in local-storage mode (never signing in), none of your calendar data ever leaves your browser or reaches us at all.
3. Legal basis
We process this data to perform our contract with you (running the service you've signed up for), and, in a small number of cases like fraud/abuse prevention, on the basis of our legitimate interests.
4. Who else sees it (sub-processors)
We use a small number of infrastructure providers to run AwayDay - they only ever process data to help us provide the service, never for their own purposes:
- Supabase - database, authentication and file storage.
- Cloudflare - sends transactional emails (invites, password resets) and runs a small piece of backend code for those emails.
We don't sell personal data, and we don't share it with anyone for advertising purposes.
5. International transfers
Our infrastructure providers may process data outside the UK/EEA as part of running their global platforms. Where that happens, it's covered by their own standard contractual safeguards for international data transfers.
6. How long we keep it
We keep your data for as long as your account or workspace is active. If you ask us to delete your account or workspace, we'll do so within a reasonable period, except where we need to retain something briefly for legal or security reasons.
7. Your rights
Under UK GDPR, you can ask us to: give you a copy of your data, correct it, delete it, restrict how we use it, or provide it to you in a portable format. To exercise any of these, email awayday@talls.co.uk. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO).
8. Cookies and local storage
AwayDay uses your browser's local storage to keep the app working offline and to remember things like your signed-in session and display preferences. We don't use third-party advertising cookies or trackers.
9. Security
Data in transit is encrypted (HTTPS). Each workspace's data is isolated at the database level so one company's data is never visible to another, even via a direct API call, and we support two-factor authentication on every account.
10. Children
AwayDay is a workplace tool and isn't directed at, or intended for use by, children.
11. Changes to this policy
We may update this policy as the product changes. We'll post the updated version here with a new "last updated" date.
12. Contact
Questions about this policy, or want to exercise your data rights? Email awayday@talls.co.uk.
← Back to AwayDay