Checkmate Privacy Policy

Version 1.1 · The effective date is displayed with this version in the app and on the website.

1. Who we are

Checkmate helps organizations coordinate accommodation operations: properties, reservations, teams, cleaning, deliveries, inventory and key custody.

The service is jointly operated by two individuals, without an incorporated company:

• Daniel Del Dago Naranjo, Palacio de Bueño, La Isla s/n, La Isla, Colunga, Asturias, 33341, Spain.
• Miguel Suárez Obando, Carrera 28b #71a-30, Conjunto Castilletes Casa 4, Manizales, Caldas, Colombia, 170001.

You can contact both operators about any privacy matter at thebestcheckmate.support@gmail.com or at the addresses above. This is also our channel for requests to exercise your rights. You do not need to contact each operator separately.

2. Our responsibilities and those of your organization

Checkmate's own purposes. Daniel and Miguel are joint controllers for managing personal service accounts, customer and contact relationships, the platform's own security, handling rights requests, and preparing and retaining study data, combining observations across companies, and developing and validating the models described in section 7, including while de-identified data remains personal. Both determine these purposes and their essential means.

Organizations' operational data. When we host and manage information about teams, properties, tasks, inventory or keys following an organization's instructions, we act as processors. The organization determining its use is responsible for informing the people concerned and establishing a justification for that processing. If it acts on behalf of another entity, it must demonstrate the corresponding chain of instructions and authorizations. The legal role does not depend simply on whether an account has the Owner or Admin role.

Our policy does not replace the employment or professional privacy information your organization must provide, nor does it authorize every use of your statistics. It also does not automatically make an employee a legal representative of their company.

Essence of the arrangement between the operators. We both retain equal decision-making authority and responsibility. Daniel coordinates the receipt and handling of rights requests and documentation; Miguel coordinates technical execution and operational relationships with providers. We cover for one another when necessary. You may exercise your rights against either operator, and this internal allocation does not reduce your protections or limit responsibilities established by law. You may request a copy of the essential information about the arrangement at our shared email address.

3. Who this policy covers and where data comes from

This policy covers the Android application, its supporting services, Checkmate's informational website, service communications and distribution of test versions.

Data may come from you, the people managing your organization or a task, calendars connected by the organization, and records generated through use of the service. We may also process information about external helpers without accounts and third parties included in operational information.

If someone else adds you, they must provide you with this policy and the organization's privacy information. We coordinate that information before disclosing your data to new recipients and within the applicable legal period. You can ask us which specific organization or source supplied your data.

The service is exclusively for people aged 18 or over, including external helpers. We request an adulthood declaration; anyone adding an external helper must confirm that condition and that they have informed the helper. We do not routinely collect a copy of an identity document or a complete date of birth. A declaration is not documentary verification.

4. What information we process

Account, profile and access

First name, first surname, email address, language, time zone and account identifier; a password protected using a hash, access checks, temporary verification or recovery codes, and session credentials. Middle name, second surname and personal photo are optional. We do not request a phone number for a possible future use.

We retain limited evidence of the version of information presented, declarations made and, where applicable, consents. We do not use passwords for other purposes or send passwords by email.

Organizations, properties and reservations

Organization and property names and settings; accommodation address, city, floor area, rooms, bathrooms, beds, capacity, equipment, schedules and time zones; members, roles, assignments, joining and leaving.

When an iCal calendar is connected, we receive its URL and download the document to interpret events, reservations and changes. We process event identifiers, dates, statuses and technical fingerprints. The original document may contain guest names, contact details or notes even if Checkmate has no dedicated field for them. We do not need those details to create a guest dossier: we limit their processing to handling the source and do not include them in studies or ordinary diagnostic logs.

An iCal URL can function as a credential. Connect only authorized sources and do not include unnecessary information about other people.

Operational activity and collaborators

Tasks, leads, internal collaborators and external helpers, invitations and responses, acceptances, rejections, cancellations, assignments, schedules, start, completion, duration and the origin of status changes.

Checklists and operational reports may record content, status, author and date. Inventory records exact quantities, restocking, stockouts, dates, authors and cycles. Key records cover copies, custody, movements, participants, pickup instructions, locations and incidents.

For an external helper, we record their full name, relationship with the person adding them, and participation information. Being recorded does not, by itself, give them an account or application access.

Photos and files

Profile or property photos you choose to provide, and the technical data needed to receive, transform and serve them. An original image may contain people or location metadata; we therefore limit retention of originals and remove unnecessary metadata from published versions.

A personal photo is not used for facial recognition or as a biometric template. Avoid uploading documents, guest images or other personal data that is not necessary.

Device, communications and reliability

Installation identifiers, notification tokens, account associations, IP addresses and technical request and error data. Protected credentials, preferences, caches and minimal pending-operation data are retained locally.

Deduplication receipts associate an operation with its user, identifier, timestamps, request fingerprint and result references; they are not complete copies of every request. They allow retries to be resolved without recreating a resource that has already been deleted.

Notifications may contain task data, dates, time zones, properties, organizations or people. Android lets you control their display. Refusing permission to display notifications does not necessarily prevent all Firebase initialization or technical processing.

We do not use continuous GPS tracking to coordinate tasks. This does not exclude information in a photo or the approximate location a provider may derive from an IP address.

If you contact us, we receive your email address, message and attachments. For test versions, Firebase App Distribution manages tester and distribution data; if you use its feedback features, it may receive text and screenshots. Do not send passwords or codes to support.

5. Purposes, grounds and limits

The legitimate interests stated for other purposes are weighed against your rights; they are not unlimited authorization. You may object on grounds relating to your particular situation. Personal studies require the affirmative choice above: we do not switch to legitimate interests to continue studying your data after you refuse or withdraw permission. Refusing or withdrawing does not prevent app use and must not disadvantage your tasks, access or working conditions. Your organization must not pressure you or make your work conditional on participation.

Where Colombian legislation applies, we will obtain the prior informed authorization it requires, unless an applicable legal exception is documented. Merely invoking legitimate interest under the GDPR does not replace that requirement. Nor does a contract between a company and Checkmate, by itself, authorize processing for every individual.

Data strictly necessary for access or carrying out an operation cannot be omitted while retaining that same function. Profile options and study exclusion do not prevent use of the remaining functions. Being informed of this policy, contracting the service, granting an Android permission and consenting to processing are separate acts.

We do not use this data for advertising campaigns or sell it for advertising.

6. Automated coordination rules and organization statistics

Checkmate applies coordination rules: it checks permissions and scheduling conflicts, opens response windows, distributes notifications, escalates unassigned tasks and records certain status changes. These rules may influence which tasks you can accept; a temporary scheduling conflict is not a rejection by you.

The organization can view authorized operational statistics, such as tasks, statuses and durations. Automatic closure or a calculated duration does not, by itself, establish hours actually worked. Checkmate is not offered as a substitute for a legally compliant working-time recording system.

We do not use study models to make automatic decisions about disciplinary action, pay or dismissal. If you believe a restriction or a record is incorrect, you can request review by your organization and support. Where a decision has the effects covered by legislation on solely automated decisions, the corresponding safeguards must apply, including human intervention where appropriate; calling it coordination is not enough to exclude them.

7. Cleaning and consumables studies

Our two objectives are to improve estimates of how long an accommodation takes to clean and anticipate when a consumable will need restocking. We combine observations from different companies to develop and validate shared models; these are not studies for scoring individual workers.

We may retain and use individual de-identified observations that remain personal data. We do not describe them as anonymous merely because identifiers have been removed. This processing for Checkmate's own purposes requires the informed, voluntary permission in section 5, recorded separately from policy acknowledgement. It does not begin merely because this policy is acknowledged or an organization signs an agreement. An observation is not included without that permission; this does not prevent use of the app's remaining functions. The task lead may record that an external helper received the information and freely authorized the studies; adding the helper to the team or certifying adulthood alone does not establish that declaration.

For cleaning, we retain relevant accommodation characteristics and equipment, city and capacity, length of stay, cleaning date, number of participants and their type and role, prior cleaning experience recorded within the same organization where known, cleaning duration, and measurement quality and source. The observation represents the complete team, including external helpers, up to the limit of 10 participants; unknown experience is not represented as zero. We do not create individual experience profiles across companies.

For consumables, we retain relevant accommodation characteristics, city and capacity, product type and unit, exact restocked quantity, restocking and stockout dates, cycle duration and days per unit, and counts of reservations, occupied nights and cleanings during the cycle. Guest identities and text are not included.

Study spreadsheets and snapshots exclude account, organization, property, task, reservation, collaboration, cycle and metadata-version identifiers, as well as names, contact details, precise addresses, photos, key instructions and free text. Products and units are distinguished by categories or catalog codes, not references to people. Dates are limited to the corresponding local calendar day, without exporting the hours, minutes or seconds of their start and end timestamps. Durations are calculated before that timestamp precision is removed, and the exact quantities and durations needed for training are retained. We distinguish observed measurements from automatic closures, reviewed declarations and calculated values; removing identifiers does not turn an estimate into an observed measurement.

These characteristics may allow an observation to be linked to operational data we retain. We treat the data as personal while reasonable identifiability remains, even without a direct key. Minimal records to check lawfulness, handle exclusions and erasure, and enforce deadlines are kept separately from training spreadsheets, with restricted access; they are not training variables or a cross-company employment profile.

Identifiable preparation lasts no more than 30 days from the first extraction of each batch. Before expiry, the data is deleted, validly anonymized, or expressly admitted as de-identified personal observations for the authorized study. Renaming or copying a batch is not sufficient. Admitted personal observations and their restricted linkage records are retained for no more than 24 months from completion of the source cleaning or consumable cycle, not from export. Copies, re-extractions and retraining do not restart that period. Necessity is reviewed at least annually, and records are removed earlier if they cease to be necessary or lawful.

You may request exclusion of future personal contributions and erasure of contributions that remain identifiable, including in spreadsheets, snapshots and other copies under our control. There is no penalty or separate app version. If several people are involved, the whole observation is discarded where the requesting person's contribution cannot be safely excluded; its duration is not retained as though an artificially smaller team performed the work. The periods, legal exceptions and rights in sections 10 to 12 apply; a retention exception does not permit continued training with legally blocked data.

An observation lawfully admitted before a pilot or organization closes may be retained for this separate purpose within those limits and while a valid legal basis remains. New observations are not prepared from a closed archive, and this does not extend retention of the original operational data.

A dataset is treated as effectively anonymous only after an assessment considering reasonably available auxiliary data. It may be retained while useful, with annual risk review and no attempts at reidentification. This does not automatically apply to de-identified observations or models: we assess whether parameters or outputs allow extraction of personal data or identification of participants. Models that remain personal are subject to the rights and periods of the personal study data used, without restarting them. Where required, they must be updated, replaced or withdrawn; deleting a row does not, by itself, establish its removal from a model.

Spreadsheets and snapshots are internal, with access restricted to authorized operators and technical processing by the providers in section 8. They may contain the de-identified but still personal data described here; they are not a dashboard for customer owners or administrators or open data. Their preparation does not mean predictive models are already operating in production. A different purpose, particularly one involving evaluation of people, requires a new assessment and information before it begins.

8. Who has access and which providers are involved

Within the application, access depends on the organization, permissions, assignments and operation. Not everyone in an organization sees the same information. Owner, administrator, lead and collaborator roles are not equivalent.

Daniel and Miguel may access data when necessary for authorized purposes, through controlled access. Equal responsibility does not mean indiscriminate access. External helpers do not receive access merely because they appear in a record.

We use the following categories of services:

Contracting entities, subprocessors and applicable safeguards are documented before processing is authorized. You can request that information at our privacy email address. Some providers also process technical or account data for their own purposes under their notices; this does not authorize Checkmate to disclose any information indiscriminately.

We do not send personal data from customers' operations to generative AI tools to develop or debug the application. For those tasks, we use synthetic data or anonymous information. If you contact another service yourself, its privacy information also applies.

We may disclose data to authorities where there is a valid obligation or demand, or to professionals bound by confidentiality where strictly necessary for a claim. We do not grant general access to data belonging to other organizations.

9. Countries and international transfers

The operators work from Spain and Colombia. The database and backend infrastructure examined is located in the United States—San Francisco and the Washington, D.C. region, respectively—and R2 storage is configured in eastern North America. This does not describe every network, copy, auxiliary service or Google location.

We do not promise exclusive European Union data residency. Access from Colombia is considered in addition to server locations.

Before a transfer subject to the GDPR, we require an applicable safeguard: an adequacy decision that actually covers the recipient and processing, or the relevant standard contractual clauses, accompanied by the necessary assessment and supplementary measures. We do not assume a provider is covered merely because it is well known, has European servers or appears in an international framework.

You may request information or a copy of the safeguards at our privacy email address, with necessary redactions to protect secrets and other people's data. If a valid safeguard is missing, that flow is suspended; accepting this policy does not remedy its absence.

10. How long we retain data

The following are ordinary limits, not authorizations to retain information that is no longer necessary. A valid request or deletion instruction may shorten them. Mandatory legal periods and specific exceptions are explained after the table.

Copies and providers. Our recovery copies subject to this policy rotate within a maximum of 31 days after data is deleted from the active system. During that interval, they are not used for ordinary operations and, if restored, deletions are reapplied before the service reopens. Specific documented provider residual periods are disclosed separately: Google describes up to 180 days after a deletion request for Firebase Cloud Messaging identifiers and App Distribution tester data, including active and backup systems. We do not equate that request with merely deleting a token from our database. Firebase information.

Obligations and claims. Where legal blocking applies, we will segregate the necessary information and prevent its ordinary use for the applicable limitation period. A specific claim or order may require evidence to be retained until resolution and for the associated legal period; the reason, scope and review are recorded. We do not use this exception to retain all data indefinitely or continue studies. Data blocking under the LOPDGDD, Article 32.

11. What happens when you leave or request deletion

Logging out, uninstalling the app, leaving an organization and deleting your account are different actions. Leaving an organization does not delete an account that may be used in others, or require erasure of information that organization must legitimately retain.

You can initiate an account-deletion request from the app or the website's privacy page without reinstalling the app; you can also write to thebestcheckmate.support@gmail.com. You do not need to retain account access to ask for help.

We verify identity proportionately. We do not routinely request identity documents or ask for passwords by email. A compromised account may require additional checks.

When carrying out closure, we revoke the account's access and notification associations. We coordinate removal or authorized transfer of operational responsibilities; a pending task or key does not make the request impossible or authorize unlimited retention. We retain separately only records with another valid justification, explaining which records and for how long.

The target for erasure from active systems is 28 calendar days from a verifiable request, without exceeding applicable legal deadlines or unjustifiably delaying execution. If essential information is missing, we will request it without delay; deadlines are not arbitrarily restarted. Copies and provider residual data follow the limits in section 10.

When an organization is closed, new iCal imports, work generation and operational notifications for that scope stop; removing human access alone does not constitute that closure. The 180-day archive is solely for a possible agreed reactivation, not for continuing data collection. This policy does not automatically renew the pilot or convert it into a paid subscription.

A notification sent to a provider before closure may subsequently reach the device. We cannot retract messages already received, screenshots or files an authorized person retains outside our systems. We communicate corrections, erasures or restrictions to recipients where applicable; the organization must also address copies under its responsibility.

Closure does not automatically make previously admitted study observations anonymous. Their separate retention continues only under section 7, without new contributions from the closed archive or bypassing a valid request for erasure, restriction or exclusion.

12. Your rights

You may request access, rectification, erasure or restriction; object where applicable; request portability where its conditions are met; and withdraw consent without affecting the lawfulness of earlier processing. You may report errors in data attributing an action or duration to you.

Contact the shared email address, explaining your request and providing the minimum information needed to locate your account or participation. We will handle our part and coordinate the organization's part without requiring you to first determine the entire internal allocation of responsibilities.

Exercising rights is generally free. Under the GDPR, we respond within one month of receipt; an extension due to complexity or the number of requests must be communicated during that first month and cannot exceed two additional months. A refusal must give reasons and explain complaint routes. Rights information from the AEPD.

Where Colombia's Law 1581 of 2012 applies, inquiries are answered within 10 working days, with a reasoned extension of up to 5; complaints within 15 working days from the day after receipt, with a reasoned extension of up to 8, complying with the rules for correcting incomplete submissions and forwarding requests. You may request evidence of authorization and information about the use of your data. An internal rule does not extend deadlines under applicable law. Law 1581, Articles 8 and 14–16.

You may complain to the Spanish Data Protection Agency or the competent authority for your place of residence, work or the alleged infringement. In cases subject to Colombian rules, you may contact the Superintendence of Industry and Commerce, completing the applicable prior procedure. We do not require you to waive those routes or submit exclusively to a forum chosen by Checkmate.

13. Security, website and communications

We apply credential protection, scope-based access controls, encrypted connections, restricted secret management and recovery measures. Administrative access uses individual accounts and strengthened authentication. We do not claim end-to-end encryption or that no system can experience an incident.

If you suspect data exposure, write to the privacy channel. Operational property incidents are distinct from a personal-data breach; that distinction does not relieve Checkmate of responsibility for addressing breaches for which it is responsible.

Checkmate's website is informational and also provides the policy and privacy-request facilities. We do not include behavioral advertising or optional commercial tracking in this version. Requests to the website's hosting service generate technical data; we do not describe the site as involving no processing merely because it is informational. Fonts are served without requiring the user to contact an external font service.

Security and operational messages are not advertising subscriptions. We do not add individual pixels to measure authentication-email opens. Your email provider may apply its own loading or filtering mechanisms.

14. Changes

We will publish this policy's version and effective date and notify you of relevant changes before applying them, unless legally necessary immediate action is required. A new purpose requires the corresponding justification and information; this policy does not give advance permission for any future model or processing.

If the service passes to a company, we will disclose its identity and the change in responsibility before transferring data where required. This text does not create a company or replace commercial terms or each customer's processing agreement.

The expanded studies in version 1.1 do not retrospectively legitimize processing or extend batches whose period already expired under the previous version. Before applying the new scope to historical data, prior information, lawfulness and, where relevant, compatibility and required authorizations are checked, respecting exclusions and erasure already recorded.