Parsifal privacy notice

Who is responsible

Your employer decides how its employee records are used and is responsible for those records. Mirabits B.V. provides and operates Parsifal on the employer’s behalf. Contact your employer about its workplace records, or contact info@mirabits.com for Parsifal support and privacy enquiries. Include your employer’s name so the correct organisation can be identified.

Mirabits B.V. operates the personal Moments service and decides how its posting, interaction and safety functions process information. Mirabits is responsible for that processing; your employer does not administer your personal Moments account. Contact Mirabits directly about these personal features.

Business contact: Mirabits B.V., Van Noordtkade 62A, 1013 BZ Amsterdam, Netherlands. Telephone: +31 6 41543789.

If you contact Mirabits directly, your contact details and the information you send are used to handle that enquiry. Your employer’s own employee privacy information also applies to its employment administration.

Information used in Parsifal

• Employee and account details: names, identifiers, contact details, address, date of birth, emergency contacts, employment details and notes entered by you or authorised workplace staff.
• Schedules and tasks: shop and shift assignments, work times, task answers and counts, completion status, who completed the work, when it was completed and any required proof photo. For each task, the service records which version you opened and when, so changed or unopened tasks can be shown as unread.
• Chat: messages, pictures, participants, delivery-related identifiers, timestamps and read receipts. Group read information can identify which participants have read a message. Saved language choices can enable automatic translations in a conversation. The server detects the message language and keeps translated copies linked to the original message and chosen language. Participants can see the original and the enabled translations. Translations may be inaccurate.
• Moments: your display name, text and photo posts, categories, comments, likes, publishing times and comment-permission choices. All categories, including Friends and Work, are visible to other active signed-in Parsifal users across companies; category names do not create private audiences. Do not post confidential workplace information. You can edit or delete your own posts, remove your own comments, remove comments on your posts and turn new comments off. Your block choices hide content in both directions within Moments; they do not change Chat or workplace permissions. Reports disclose your identity, the selected content, an associated photo and your explanation to the designated Mirabits reviewer. The feed is chronological and does not use advertising or engagement ranking.
• Personal agenda: appointment titles, notes, places, dates, times and all-day choices are stored for your own account. They are independent of the selected employer or shop. Other users, including employer and owner accounts, cannot read your appointments through the Parsifal agenda. Deleting an appointment clears its content; a minimal technical record remains to prevent an old request from recreating it.
• Chat safety and account requests: personal block choices, report details and review notes, and account-deletion request status and times. A report shares your account identity, the selected person or message, its associated photo when present, and your explanation with the designated Mirabits support reviewer. Reporting does not notify the reported person. Narrow pre-post text screening and authorised support hiding/restoring of reported content are implemented. Hiding prevents ordinary access to the text, photo and translation while preserving the original and review evidence; it is not erasure. Blocking stops new direct messages in either direction without deleting history or changing group conversations. Account deletion requires owner review and a separate final confirmation. The request itself does not remove records or disable the account. Processing removes account-linked data according to the reviewed decisions, revokes access and verifies the required mailbox steps before completion is confirmed.
• Personnel documents and signing: uploaded files and earlier versions, including identity and tax documents, contracts and payroll forms. They may contain government identifiers such as a BSN and financial details. Signing records include the signed version, account identity, drawn signature, confirmation text and time.
• Access and security: account and session details, attempted login names, IP addresses, times and records of relevant actions.
• Notification identifiers: installation identifiers, device notification tokens, platform information and the account/conversation/task identifiers needed to route an alert.

Personal email: where an app mailbox is available, Parsifal links it to your account username. This mailbox is separate from your personal contact or account-activation email address. It processes sender and recipient addresses, subjects, message text, folder/read state and send-status records. You can access only your own mailbox through Parsifal; employer and owner screens do not provide access to another employee’s inbox. Sent mail is delivered to the recipients you select, including recipients outside Parsifal. The isolated demonstration accounts are an explicit exception: their outgoing mail is limited to the two demo addresses displayed in Mail. The server connects to the mail service to retrieve messages and send mail; mailbox credentials stay on the server. Mail provides plain-text messages, composition and folders including Inbox, Sent, Archive, Spam and Trash. Delete moves a message to Trash, where it can be moved back; mail attachments and rich HTML are not provided.

Storage display: Settings shows the storage attributed to your own mailbox and uploaded chat, task and Moments photos. Email usage comes from your mailbox provider and includes email attachments. Photo usage counts stored uploads once per stored copy, including older photo copies still needed for a report. It does not count your phone gallery, internet traffic, company documents or hosting backups. Figures can be temporarily unavailable; an incomplete total is identified as incomplete. This display does not introduce charges.

Spam choices: tapping Spam moves that message, saves a block for its sender in your own mailbox and checks your existing Inbox for other messages from that exact sender to move to Spam. A separate option blocks every address at the exact selected domain and checks the existing Inbox for messages from that domain. This check includes older messages that are not loaded on screen and may continue in the background. It does not sweep other folders or retroactively run older saved block choices. You can remove these choices in Blocked senders. Parsifal stores the selected sender or domain, the rule status and limited operation identifiers to check results without repeating an uncertain action. When you choose Spam, Parsifal also checks the message for an authenticated one-click mailing-list unsubscribe method. Where supported, it sends that list provider the unsubscribe request, including the subscription identifier supplied in the message. It does not send your mailbox password or message body, follow arbitrary links in the message, or send unsubscribe requests from the restricted demonstration mailboxes. An unsubscribe attempt does not guarantee that the sender will stop sending.

Spam retention: messages are eligible for permanent removal after 30 days in Spam. Existing messages receive a full 30-day grace period when this cleanup first observes them; their original delivery date does not shorten that period. Move a message out of Spam before that period ends if you want to keep it. The background cleanup may run later if the mailbox or service is unavailable. This rule applies to Spam, not Inbox, Archive or Trash. Account deletion or disconnection also removes Parsifal’s saved Spam rules, pending Inbox checks and pending unsubscribe work for that account.

Before an app-created mailbox closes, the account holder can request a ZIP export in Settings and separately confirm that it has been saved, or explicitly decline the export. Opening a download does not count as confirmation that it was saved, and the owner cannot waive the export on the account holder’s behalf. An independently existing mailbox is disconnected from Parsifal only: its mailbox and password are not deleted or reset. Parsifal’s stored access credential is removed as part of that disconnection. Submitting the deletion request does not itself close or delete the mailbox.

Why this information is used

Mirabits processes the personal content and interaction choices you submit to provide the Moments functions you request. Reports, block choices and limited operation records support safety and reliable actions. Moments has no advertising profile or paid promotion in its feed. Posting is optional.

• Information necessary to carry out your employment agreement is used to administer employment, organise agreed work and provide relevant employment documents.
• Identity, payroll and related records required by Dutch law are used to meet the employer’s legal obligations.
• Routine workplace communication, task coordination, relevant read/completion records and service security support the legitimate interests of running and securing the workplace service. Those uses must be necessary and balanced against employees’ rights; they do not permit unrelated monitoring.
• Mirabits uses information you send directly for its legitimate interest in answering support and privacy enquiries. Optional features can be declined where they are not needed for your work. If a separate use relies on consent, that consent can be withdrawn.

Required account information is needed to sign in. A workplace task may require a photo or answer before completion. Your employer should explain which employment information is mandatory and the consequences of not supplying it.

Photos, files and notifications

When you submit a selected photo or file, it is uploaded to Parsifal. Files are not automatically stripped of embedded metadata, so a submitted photo may include its capture time or location. A workplace/shop assignment is a work record, not phone GPS tracking. Current app features do not request the device address book, calendar or background GPS.

Optional dictation uses the microphone only after you choose to dictate. On-device dictation processes speech on the phone where supported. A server dictation alternative is enabled for eligible active employees: after you accept the explanation and choose the microphone, a recording is sent to the existing Parsifal server at TransIP in the Netherlands. Its self-hosted speech engine returns editable text. No voice message is sent and no external transcription API receives the recording. You review the text and decide whether to send it as a chat message.

Server-dictation recordings are temporary and removed after processing; interrupted-job cleanup checks every five minutes for files older than fifteen minutes. Request/account identifiers and times used for limits and duplicate prevention are kept for seven days, without audio or transcript.

Automatic message translation runs on the existing Parsifal server. Message text is not sent to an external translation API. Translation is optional; the original message stays visible if translation is unavailable or a short message cannot be identified confidently.

Notifications are optional. After you enable them and sign in, Parsifal links the installation’s notification token to your account. Expo, Apple Push Notification service and Google Firebase Cloud Messaging provide delivery. Android’s notification infrastructure also uses Firebase installation identifiers; its technical identifiers are separate from permission to display alerts.

Alerts use general text rather than chat messages, task titles, names or photos. They include routing identifiers, and access is checked when opened. You can change notification permission in phone settings. A completed sign-out detaches the installation’s current Parsifal notification registration. This does not erase workplace records.

The phone version stores a randomly generated installation identifier and your last-opened menu on that installation, separately for each account. After you sign in with your password, a protected login cookie can remember that phone for up to 30 days. The identifier alone cannot sign you in. Logging out cancels that remembered login; an inactive or deleted account cannot use it to sign in again. Passwords are not stored in browser local storage. Exporting a document creates a temporary private copy for sharing; the app attempts to clear it at the next export or fresh launch. Copies you save or send through another app are controlled by that destination.

Who can receive information

Access to workplace records within Parsifal depends on workplace permissions and conversation membership. Authorised people can see the records needed for their roles. Your personal agenda is separate from those workplace permissions. Reported content and your report identity are shared with the designated support reviewer as explained before submission. Messages and files are processed by the Parsifal server; chat is not end-to-end encrypted.

Mirabits uses TransIP in the Netherlands for hosting and outgoing email. Notification delivery uses Expo, Apple and Google. If you export a file to another app or person, that destination receives it.

Notification providers can process information outside the European Economic Area, including the United States. Expo and Google describe participation in the EU–US Data Privacy Framework; Apple describes Standard Contractual Clauses for its European transfers. Their published information explains those safeguards and contact routes: Expo privacy, Apple privacy and Firebase privacy. Netherlands hosting does not mean every onward transfer stays in the Netherlands. Contact info@mirabits.com to ask about the safeguards relevant to Parsifal or obtain information about them.

How long records are kept

AP guidance explains purpose-based retention. Personnel-file guidance distinguishes the relevant record categories.

There is no single lawful maximum for all records. The employer must distinguish records required by law from ordinary work information and keep each category only for its justified purpose. Our retention policy requires a monthly employer review of completed work records and a Mirabits review of support and security records. Information whose justified purpose has ended is selected for removal or de-identification. Monthly purpose reviews remain a human responsibility. In the account-deletion workflow, records default to removal. An authorised owner may retain only specific eligible records, recording the relevant employer, legal basis, purpose, next review date and end date. Those copies are kept separately under restricted access. A due review does not automatically extend retention; expired retained copies are removed by the service. Necessary business references are de-identified rather than removing unrelated records belonging to other people. Minimal deletion and retention receipts remain to record what was done and help prevent restored data from undoing a completed deletion. Ending employment or disabling access alone does not start this deletion workflow.

Your rights and how to ask

You can request access to your information and correction of inaccurate information. Where the legal conditions apply, you can request erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without changing the lawfulness of earlier processing. A statutory retention duty or a necessary legal claim can limit erasure; it does not justify keeping unrelated records indefinitely.

To ask for deletion of your account, open Settings → Delete account. Settings shows the request and acknowledgement status, and you can withdraw a pending request before processing starts. Hans van Wegen checks reports and privacy requests each working day. Mirabits acknowledges requests within two working days and aims to complete account deletion within one calendar month. Hans coordinates any specifically required employer records and explains what must remain and why. After the owner reviews the saved decisions and confirms the exact account, processing revokes access and removes the account-linked data. Completion is confirmed only after the required removal and mailbox checks have succeeded. No second email, phone call or support conversation is required to initiate the in-app request.

Send other privacy requests to your employer or info@mirabits.com, identifying the employer and account. Do not send your password or identity documents with the initial request. Identity checks should use only the additional information reasonably needed.

The responsible organisation must respond without undue delay and normally within one month. Where complexity or the number of requests makes it necessary, it may take up to two additional months, but must explain the extension within the first month. If it refuses all or part of a request, it must explain why and the available complaint/remedy options. European Commission guidance on privacy requests.

You may complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority, or another competent supervisory authority. You also have the right to seek a judicial remedy.

Keeping information secure

The app connects over HTTPS. The service checks sign-in and permissions for protected actions. Personnel documents are accessed through authenticated requests rather than public file links. No system can guarantee absolute security. For help with the app, see Parsifal support.