Privacy policy

Last updated: 19 October 2026

How your data is used in CheckTau Web, the mobile apps and attendance and management services.

Who this policy covers

CheckTau helps manage participants, families, groups, activities and attendance. This policy covers the public website at https://checktau.com, the staff area at https://app.checktau.com, the iPhone, iPad and Android apps and their services. It applies to participants, including children, family members, authorised staff and people contacting support. Your organisation’s registration information supplements this policy.

Who controls your data

Parroquia Nuestra Señora del Rosario is the controller of its participant, family and staff records and determines their purposes and who may access them. Development and technical maintenance are carried out on behalf of the parish and follow its instructions concerning those records. If another organisation supplied your account or pass, that organisation decides how its records are used and who may access them, and must give you its privacy information.

Data and its sources

Data is supplied by the participant, their family or the organisation and supplemented through staff operations. It is not obtained from public social media profiles. Depending on the information supplied and features used, the following categories are processed:

Participants: Name, identifier, date of birth, school grade, phone number, group, active or archived state, registration and payment status and QR credential. Some fields are optional. Payment status is an administrative entry: CheckTau does not collect payments or card or bank account details.
Families and contacts: Name, email, phone number if supplied, relationships with participants and notification preference for each relationship. A family member can be linked to several participants.
Staff and access: Name, username, email, role, group, account state, authentication data and sessions. The server stores a protected representation of the password, not its original text. Account creation or recovery emails can contain a temporary password that must be replaced.
Activities and attendance: Event date and time, expected participants, check-in, state, time and the person recording it. Absence notices also include the recipient, attempts and sending result. Reports display counts, percentages and names associated with these records.
Technical data: IP address, browser or device, requests, errors, account and operation identifiers and operational data. Diagnostics may include the login username and group names. Providers and the Android SDK also process the technical data described below.
Enquiries: Reply address, message and diagnostic information you supply for enquiries, rights requests or incidents. Do not send passwords, passcodes, QR credentials or unnecessary data about other people.

How data is used

To manage registrations and groups, maintain contacts, issue passes, record and correct attendance, notify families according to their preferences, handle enquiries and protect accounts and the service. Staff consult birthdays, pending tasks and attendance, registration and organisation reports to carry out their work. Reports use existing records; they do not measure continuous presence or serve as an advertising system.

Public website and staff area

The temporary link and passcode are sent to the server to obtain the pass. After successful verification, the name, QR and, where available, date of birth and school grade are displayed. The pass and Wallet links stay in memory; the PNG is saved on your device if you download it. Leaving, reloading or changing language may cause you to lose the displayed pass.

The staff area lets staff manage records according to their permissions, consult reports, change their password and close sessions. A cookie contains an opaque identifier; API credentials are stored encrypted on the Web server. Private responses instruct caches not to store them. Filters and identifiers may remain in the browser address or history: avoid sharing private links and use a trusted device.

Mobile apps and camera

The iOS and Android apps are for authorised staff. They request camera permission to read QR codes; images are processed on the device without being recorded or sent to the CheckTau server. The scanned credential is sent to the API to look up the participant; check-in is recorded after staff confirmation. You can withdraw permission in system settings. This flow does not request location, microphone, contacts or photo library access.

The Android scanner uses Google ML Kit. According to Google, the SDK sends device and app information, per-installation identifiers and performance, configuration and error data for diagnostics and usage analysis. This is separate from choosing to save a pass to Google Wallet. No advertising or advertising tracking of our own has been incorporated.

Data stored on the device

iOS keeps credentials in Keychain, accessible while the device is unlocked and without iCloud synchronisation. Android encrypts them through Android Keystore and excludes that storage from app backups. It also stores encrypted recovery information for certain operations, such as identifiers and stages, without passwords or form content. Appearance preferences are saved locally and language is managed through the system. Signing out does not erase server records or shared or downloaded files. The operating system and browser may retain network data and history under their own settings.

PNG and digital wallets

Saving a pass is optional. The PNG contains the name and QR. Where enabled, Wallet options include the name, QR and, where available, school grade, without date of birth. Apple downloads a signed file from CheckTau to open on a compatible device. The Google option sends pass data to Google through its save link and may require an account. The provider and operating system apply their own terms to the saved pass.

Link expiry does not delete the PNG or a saved pass. Wallet passes are static: CheckTau does not update or remove them remotely. If the organisation replaces the QR credential, the old code no longer identifies the participant; request a new pass.

Staff can share a temporary link, its passcode and the name using device sharing options. The selected app and person receive the content and may retain or forward it under their terms. Use only authorised destinations. Anyone obtaining a pass or valid Wallet link could copy it; do not publish it or send it to support.

Lawful basis

The parish provides privacy information and collects the applicable authorisations through paper registration. That documentation specifies the purposes and lawful bases for processing participation and attendance data; this policy supplements it and does not replace authorisations or extend their purposes. You can ask the privacy contact for a copy or clarification. Account, security and enquiry data is used to provide and protect the service and handle requests received. Browsing, scanning or receiving a pass does not amount to general consent.

Children and families

If you are a child: your pass lets the team record your arrival. Do not publish your name, link, passcode or QR. If something is wrong or worries you, speak to your family or the team. The organisation must provide understandable information and obtain the necessary authorisations.

Access and providers

Authorised staff access their organisation’s records according to their permissions. Hosting and the database use OVH in France, according to information from the provider; diagnostics are managed in its observability infrastructure. Cloudflare delivers and protects traffic. Resend handles access and absence emails: it receives the recipient and necessary content, such as a temporary password or the participant’s name and event date. Acceptance for sending does not guarantee delivery or reading.

Google is involved in Android scanner diagnostics and, if you choose it, Wallet. Apple and the apps you choose for saving or sharing carry out processing for their services. When you contact us by email, your provider and the destination mailbox provider process the message.

Processing outside the EEA

Primary hosting is in France; Cloudflare uses international infrastructure and Resend states that its main operations are in the United States. The service uses the data processing agreements accepted with these providers and their standard contractual clauses where a transfer requires those safeguards. You can consult their terms on their official websites or ask the privacy contact for information about the applicable agreements and measures. Google, Apple and the services you choose for saving or sharing may process data in other countries under their terms; their involvement is explained in the relevant sections.

Retention and deletion

Data is retained while activities are managed and for any additional time necessary and proportionate for follow-up, compliance with legal obligations and handling claims. The controller must review that need and arrange erasure when there is no longer a valid purpose or justification. Archiving a profile preserves data and historical relationships: it is not erasure and does not justify indefinite retention. The service does not automatically perform general erasure when participation ends.

Historical relationships may prevent direct deletion; an erasure request requires the controller’s assessment and action. Deleting a family contact does not necessarily erase their email from earlier notices. Support messages are retained while needed to handle the request and are then deleted, unless a legal obligation or claim justifies retention. Sessions and temporary links have their own expiry periods; technical records and backups have separate rotation rules. Session expiry, link expiry and deletion of a PNG or Wallet pass do not erase activity records.

Your rights

You can request access, correction, erasure, restriction or objection and, in the cases provided by law, portability. You can withdraw consent without affecting earlier lawful processing. For parish records, you can contact [email protected] or [email protected] about privacy; both addresses handle these requests. For another organisation, use its privacy contact. Explain your relationship and request without sending passwords or QR credentials. Proportionate identification will only be requested when needed.

The general deadline for responding to rights requests is one month. In cases provided by law, this may be extended by another two months, with notice during the first month. You can complain to the competent authority, including the AEPD in Spain, and use applicable legal remedies. Changing a notification preference is not a request to erase all your data.

Automatic attendance processing and reports

The system prepares the expected participants for an event and, when it ends, may generate notices to linked family members with notifications enabled if no check-in is recorded. Reports calculate states, counts and percentages. A pending or absent record does not prove someone’s whereabouts. These features do not independently decide admissions, sanctions or other legal effects; ask the team to review a missing check-in or incorrect notice.

Identity and contact details

Controller of parish personal data: Parroquia Nuestra Señora del Rosario
Address: Plaza Franciscanos 3, 28011, Madrid, España
Tax identification number: R7800537H
Privacy and exercising your rights: [email protected] [email protected]
Security incidents: [email protected]

You can consult the GDPR and AEPD guidance on their official websites. Privacy and data processing information from Cloudflare, Resend, Apple and Google, including Google ML Kit documentation, is available on each provider’s official website.