Propivio privacy notice

1. Scope and controller

This notice applies to the current versions of the Propivio mobile app for iOS and Android until replaced by a newer notice. SECURITY INSIGHTS S.R.L. provides the app and is the controller for the processing described here. Website visits and support email are covered by the website notice and the contact section below.

2. Local-first operation

Propivio requires no Zappapps account and has no Zappapps cloud sync. Property records, units, areas, meters and readings, contacts, documents, contracts, occupancies, tasks, repairs, costs, valuations, inspections, custom fields, payment details and settings are stored in an app database and app files on your device.

We do not receive this content merely because you use the app. Device security, operating-system backups and access to your unlocked device remain important.

3. Photos, files and device permissions

Camera, photo-library and file access occurs only when you initiate an import or capture and grant the relevant system permission. Imported files, generated thumbnails and technical metadata stay in Propivio’s local app storage. Permissions can be changed in system settings, although the related function may then be unavailable.

4. Reminders and notifications

If you allow notifications, Propivio schedules reminders locally through the operating system. Notification permission is optional and can be withdrawn in system settings. No Zappapps push-notification server is used.

5. Device authentication and clipboard

When protection of sensitive payment information is enabled, Propivio requests device authentication using the biometric or passcode mechanism supplied by the operating system. The app receives the authentication result, not biometric templates. A copied sensitive value is cleared from the clipboard after about 45 seconds if it is still unchanged.

6. Purchases

The optional Propivio Plus annual subscription is handled through Apple App Store or Google Play. The app receives product, purchase and entitlement status needed to unlock features and stores a limited local entitlement cache. Apple or Google processes store account, payment, receipt and transaction data under its own terms. No Zappapps receipt-validation server is present in the current app.

7. Backups, exports and sharing

A standard local backup is an unencrypted archive and deliberately excludes payment accounts. An optional Plus encrypted backup can include payment data and is protected with a password-derived key and authenticated encryption. The password is not recoverable by Zappapps.

Exports, reports, backups, transfer packages and diagnostic summaries leave the app only when you initiate sharing or choose a destination. From that point, the selected file, cloud, messaging or email provider processes the data. “Encrypted backup” describes the file format; it is not a claim of end-to-end encryption by every later service.

8. Diagnostics and tracking

Propivio contains no advertising and does not use cross-app tracking. Google Firebase Analytics and Firebase Crashlytics are disabled by default. They are activated only if you explicitly consent to diagnostics and analytics under “About Propivio” in the app.

If enabled, Firebase Analytics may process app-instance and device or vendor identifiers, approximate location derived from technical network information, platform, operating-system, device and app version, build and language information, sessions and app-lifecycle data, and fixed feature and purchase interaction events. Firebase Crashlytics may process crash stack traces, technical app, device and operating-system state, fixed failure codes and controlled diagnostic keys. We use this information to understand app usage and improve reliability.

Property records, contacts, contracts, documents, payment information and other locally stored Propivio content are not intentionally included in Analytics events or Crashlytics reports. The diagnostic summary described under “Backups, exports and sharing” is separate and leaves the app only when you initiate sharing.

You can withdraw consent in the same app setting. Turning it off immediately prevents new app-defined Analytics events and controlled error reports and disables Analytics collection. Crashlytics collection is fully disabled no later than the next app launch, and unsent reports are deleted. Withdrawal affects future collection; it cannot recall data already transmitted.

9. Preferences and retention

On-device preferences include onboarding completion, theme, currency, measurement system, subscription cache and its verification time, the payment-data protection setting, and your diagnostics and analytics consent choice. App content remains until you edit or delete it, reset the app or remove the app, subject to operating-system backups. Files already exported or shared must be deleted at their destination separately.

Optional data already sent to Firebase is retained under the configured service settings and applicable deletion periods. Changing the in-app consent choice does not delete data already received by Firebase.

10. Support and recipients

Support uses your email application or operating-system share sheet. If you contact us, we and the involved email providers process the information you send. Other recipients arise only from your choices, such as app stores, backup locations or sharing destinations, or where disclosure is legally required.

When you consent to diagnostics and analytics, Google, as the provider of Firebase, processes the optional Analytics and Crashlytics data as a service provider or processor. Processing may take place outside the European Economic Area. Where required, international transfers are protected by an adequacy decision, standard contractual clauses or another lawful safeguard.

11. Legal bases and rights

Local processing is performed to provide functions you request. Store and support processing may be necessary for a contract, pre-contract steps, compliance with law or legitimate interests in support and security. Optional Firebase Analytics and Crashlytics processing is based on your consent, which you may withdraw for the future at any time. Where system permission is required, you control it through the device.

Where we hold personal data about you, the applicable data-protection rights described in the website privacy notice apply. Contact our privacy address or complain to ANSPDCP or your local authority. Zappapps cannot access or fulfil a request against data that exists only on your device.

12. Changes

We will revise this notice if app architecture, external services or legal requirements change. The current version date is shown above.