Privacy policy
Last updated 10 October 2026 · Effective 10 October 2026
This policy explains what FlexDays collects, why, who else processes it, how long it is kept, and how to get it corrected or deleted. FlexDays is an HR app for leave, timesheets, time tracking and company announcements.
1. Who we are
FlexDays is built and operated by Adel Ashraf Hamouda and Ahmed Tarek, trading together as beanvoid ("we", "us"), a product studio based in Egypt (see beanvoid.com). For data protection purposes we are jointly the controllers of the personal data described in this policy, except where section 2 says otherwise.
Contact: support@beanvoid.com. Write to us there about anything in this policy, including requests about your data. We will give a postal address on request.
This policy covers our website (flexdays.app), the FlexDays web portal, and the FlexDays apps for iOS and Android (together, "FlexDays").
2. Two roles: your employer's data and ours
FlexDays is a workplace app. A company (our customer) signs up and adds its employees. That creates two different situations, and the law treats them differently:
- Employee data your employer puts into FlexDays (your profile, leave, timesheets and so on): your employer is the controller. It decides what is recorded and why. We are its processor: we handle that data only to provide FlexDays, on its instructions. Your employer's own privacy notice also applies to you.
- Everything else, such as company administrator accounts, billing contacts, website visitors and waitlist subscribers: we are the controller.
3. What we collect
| Category | What exactly | Where it comes from |
|---|---|---|
| Company account | Company name, the administrator's name and work email, company locations (name, address, city, phone number, time zone), departments, teams and settings. | The administrator, when signing up and setting up the company |
| Sign-in | Your work email and password. We store the password only as a one-way hash (bcrypt), never in readable form. Email verification and password reset codes, and records of failed sign-in attempts. | You; created by us |
| Employee profile | First and last name, work email, employee code, role, department, team, location, manager and approver set-up, hire date, work schedule, and, if your employer adds them, phone number and date of birth. | Your employer (typed in or imported from an Excel file), or you |
| Leave | Leave type, dates and times, number of days, the reason if one is given, attachments (file name and link), status, approvals and decisions, cancellations, and your leave balances and how they changed. | You, your managers and your employer |
| Time | Timesheets, time entries and tracked time, projects and notes, and the working schedule they are checked against. | You, your managers and your employer |
| Company news | Announcements and events (title, content, venue, dates) and who they were sent to. | Your employer's administrators |
| Devices | A push notification token for each device you sign in on, the platform (iOS, Android or web) and when it was last used, so we can send you notifications. | Your device |
| Security and audit | An audit trail of changes made in FlexDays: who changed what and when, with the IP address and browser or device details of the request. Sign-in sessions (stored as one-way hashes). Server logs (IP address, request time, endpoint, status, errors). | Created automatically |
| Billing | Your plan, subscription status, billing periods, currency, transaction references and refund requests. Card and payment details are handled by Paddle, not us (section 6). | The administrator; Paddle |
| Website and waitlist | Your email address if you join the waitlist or download the free leave tracker, and cookie data from the Meta Pixel on our website (section 9). | You; your browser |
| Support | Whatever you send us when you email us. | You |
What we do not collect. We do not collect your location, your contacts or your photos (a photo or file only reaches us if you choose to attach it to a leave request). The FlexDays apps and web portal contain no advertising or analytics trackers. We never see or store card numbers.
Sensitive information. Some leave records can indirectly reveal sensitive information, for example that someone took sick leave or leave for a religious occasion. We treat all leave data as confidential, and we ask employers to record only what they need. The reason field on a leave request is optional, and colleagues never see it (section 5).
4. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing FlexDays: accounts, leave, timesheets, approvals, notifications and company news | Performance of our contract with the customer. For employee data, on the employer's instructions |
| Keeping FlexDays secure: preventing abuse and fraud, sign-in protection, audit trail, diagnosing errors | Legitimate interests in a safe, working service |
| Billing, refunds and account administration | Contract; legal obligation (tax and accounting) |
| Service emails (invitations, verification, password resets, leave notifications) | Contract |
| Waitlist and product news emails | Consent, which you can withdraw at any time with the unsubscribe link |
| Measuring our website and ads (Meta Pixel) | Legitimate interests, or consent where the law requires it |
| Answering your messages | Legitimate interests |
| Meeting legal obligations | Legal obligation |
We do not sell personal data, and we do not use employee data to profile anyone or to target advertising.
5. Who can see your data inside FlexDays
FlexDays shows each person only what their role allows. In general, your managers, approvers and your company's administrators can see your profile, leave and time records. On the shared calendar, colleagues in your team, department or whole company (depending on your company's settings) can see when you are on leave and the leave type. They never see the reason you entered: only you, the people who approve your request, and your company's administrators can. Announcements and events are shown to the people they were sent to. Your company's administrators decide these roles.
Each company's data is kept separate from every other company's at the database level, so one customer can never see another customer's data.
6. Who else processes it
We keep the list of service providers short. Each processes data only on our instructions and only for the purpose shown:
| Provider | What for |
|---|---|
| Railway | Hosting the FlexDays service and its database. |
| Cloudflare | DNS, TLS, and the security layer in front of our website, web portal and service. |
| Brevo | Sending emails: invitations, verification and password reset codes, notifications, and waitlist emails. It receives the recipient's name and email address and the email content. |
| Google Firebase Cloud Messaging (with Apple Push Notification service on iOS) | Delivering push notifications to your devices. It receives your device token and the notification text, which can include a name and leave details. |
| Paddle | Our reseller and Merchant of Record. Paddle sells the FlexDays subscription, takes payment, handles tax and invoices, and processes refunds. Paddle's own privacy policy covers the payment details you give it. |
| Google Calendar API and Nager.Date | Public holiday lists. We send them only a country, never personal data. |
| Meta | The Meta Pixel on our website only (not in the apps or portal), to measure visits and ads (section 9). |
| Google Fonts | Loading the fonts on our website. Your browser requests them from Google. |
We may disclose personal data where the law requires it, for example in response to a valid court order, and only what is required. If FlexDays or beanvoid is ever sold or merged, data may pass to the new owner, who would have to keep to this policy, and we would tell customers before it happened.
7. Where it is stored
We are based in Egypt. FlexDays and its database are hosted by Railway in the United States, and our other providers process data in their own locations, so your data is processed outside your own country. Where a transfer is subject to EU or UK data protection law, it relies on the safeguards our providers offer, such as the European Commission's standard contractual clauses.
8. How long we keep it
- Company and employee data: for as long as the company's FlexDays account exists, so leave history and balances stay correct.
- Offboarded employees: when an employer offboards someone, the person loses access straight away, but their records stay in the company's history (so past leave and timesheets still add up) until the employer asks us to delete them or the company account is closed.
- Closed company accounts: when a customer closes its account and asks us to, we delete or anonymise its data within 90 days, unless the law requires us to keep part of it (for example billing records for tax).
- Sign-in sessions: access tokens expire after 15 minutes, and sessions after at most 30 days. Signing out ends a session immediately.
- Verification and password reset codes: minutes to an hour, then they stop working and are cleaned up.
- Audit trail: for as long as the company account exists, because it is part of the record of who changed what.
- Billing records: as long as tax and accounting law requires.
- Waitlist emails: until you unsubscribe or ask us to delete them.
- Backups: kept by our hosting provider for a limited rolling period and then deleted automatically. Deleted data can remain in a backup until that period passes.
9. Cookies
Website (flexdays.app). We use the Meta Pixel, a small piece of code from Meta that uses cookies, to count visits and waitlist sign-ups that come from our ads, so we can improve them. Meta may combine this with information it holds about you under Meta's Privacy Policy. You can block or delete cookies in your browser settings, or change your Meta ad preferences.
Web portal and apps. We use only what is needed to keep you signed in and the service working. There are no advertising or analytics cookies in the portal or the apps.
10. Your rights
You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how it is used, or receive it in a portable format. You can withdraw consent at any time where we rely on it.
For employee data, we act on your employer's instructions (section 2), so we may pass your request to your employer, and we will help them answer it. For data we control, email support@beanvoid.com. We respond within 30 days, free of charge. We may need to confirm your identity first, so that nobody can access or delete someone else's data.
These rights come from Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, if you are in the EU or the UK, from the GDPR. You can also complain to your local data protection authority.
11. Security
All traffic uses TLS (HTTPS), the service sits behind Cloudflare, each company's data is isolated at the database level, passwords are stored as bcrypt hashes, and repeated failed sign-ins lock an account. Our Security page explains the details.
No system is perfectly secure. If a breach ever affects your data, we will tell the affected customers, and the relevant authority, as the law requires.
12. Children
FlexDays is a workplace tool and is not intended for anyone under 16. We do not knowingly collect children's data; if we learn that we have, we delete it.
13. Changes and contact
If this policy changes materially, we will update the date at the top and tell company administrators by email or in the app. Questions, requests, or anything that looks wrong: support@beanvoid.com.
This policy is governed by the laws of the Arab Republic of Egypt, without affecting any rights you have under the data protection law of the country you live in. See also our Terms of Service, Refund policy and Security page.