Privacy Policy

Diurna: Privacy Policy

Last updated: 16 October 2026

1. Data Controller and Roles

The data controller for the account data of Diurna users (login, name, email, role, billing, consent records, security logs) is:

Name: OVVIO Solutions

Address: Nieuwe Rijn 55B, Leiden, The Netherlands

Chamber of Commerce No.: 75292807

Email: privacy@diurna.eu

For questions regarding this policy, contact us at privacy@diurna.eu.

The roles for employee data (attendance, shifts, absences and data used for payroll) are as follows:

• the client company (the employer) is the data controller;

• the firm (payroll consultancy) processes the data on behalf of the employer, as the data processor;

• OVVIO Solutions, which operates Diurna, processes the data on behalf of the firm, as the sub-processor;

• if a business uses Diurna directly for its own staff, without a firm, the business is the data controller and OVVIO Solutions acts as that business's data processor.

The data processing agreement is therefore concluded between the firm (processor, acting for its own clients) and OVVIO Solutions (sub-processor) or, for businesses that use Diurna directly, between the business and OVVIO Solutions. The firm must have its own data processing agreement with each client company: Diurna does not replace it.

2. Data We Collect

Account Data (all users):

• First name, last name, email address

• Role (firm administrator, staff member, platform owner)

• Firm/organization affiliation

• Profile photo (optional)

• Login timestamps, language preference

Organization (Firm) Data (administrators):

• Company name, VAT number

• Legal representative name and contact details

• Certified email (PEC), SDI code

• Business address

Client Company Data (managed by firms):

• Company name, Tax ID, VAT number

• Legal representative name, tax ID, and date of birth

• Contact email, mobile phone

• Industry sector, payment frequency

Employee Data (managed by staff on behalf of client companies, or directly by businesses that use Diurna on their own):

• First name, last name

• Tax identification number

• Email address, phone number (optional)

• Employee ID, regulatory filing code

• Contract type, contract terms, weekly hours

• Contract start/end dates, department, role

• Employment status, termination reason

Attendance and Scheduling Data:

• Absence records (sick leave, vacation, overtime, etc.)

• On-call shift scheduling and regulatory communication codes

• Dates, times, hours, and notes

Activity and Audit Data:

• User actions on the platform (activity log)

• Email delivery logs (recipient, event type, status)

• Legal document consent records (document ID, version, timestamp, IP address)

AI Chat Data (optional module):

• Conversation messages exchanged with the HR assistant, and the previous conversation

• Names of the client's employees, needed to match an instruction (for example "Maria worked 8 hours") to the correct person

• Conversations are stored in Diurna for 2 years from the last message

• Temporary copy in the browser (localStorage) of the last 20 conversations, as temporary storage for the open conversation

3. How We Use Your Data

4. Third-Party Service Providers (Sub-processors)

We use the following services to operate Diurna:

All sub-processors are bound by data processing agreements and process data only on documented instructions from OVVIO Solutions. Mistral AI does not use chat data to train or improve its models (the option to use data for improvement is switched off for the Diurna account).

5. Data Retention and Account Deletion

Retention periods depend on the country of the firm or business (Italy or Austria) and apply automatically: a monthly routine deletes data once the period has ended, without any request being needed.

End of employment means the end date recorded for the employee. If the client company is deactivated or the firm closes its account, that date counts as the end of employment for the employees concerned.

Account deletion. Businesses that use Diurna on their own can delete their account themselves: the account administrator does so from the app settings, on mobile and on the web. Deletion is immediate: the business, its users and its employee data are deleted straight away. Only the proof of consent is kept (3 years, as stated above).

Free export. Before deletion, a free export of the data is offered, on any plan, as CSV files (employees, attendance, absences, on-call shifts, schedules, shifts). The business remains responsible, as data controller, for its own record-keeping obligations.

Firms close their account through support; from that moment their data follows the retention rules above (employee data until the end of the legal period, account data 1 year after closure).

6. Data Security

• All data transmitted via HTTPS/TLS encryption

• Database encrypted at rest (managed by Supabase)

• Row-Level Security (RLS) for strict multi-tenant data isolation

• Platform owners cannot access personal data of clients or employees (privacy wall)

• Passwords hashed with bcrypt

• JWT-based authentication with role-based access control

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access your personal data

• Rectify inaccurate data

• Erase your data ("right to be forgotten"), subject to legal retention obligations

• Restrict processing under certain circumstances

• Data portability: receive your data in a structured format

• Object to processing based on legitimate interest

• Withdraw consent at any time (where processing is based on consent)

For employee data, rights are exercised towards the data controller, that is the employer; OVVIO Solutions assists the controller and the firm in responding to requests. For account data, contact us at privacy@diurna.eu. We will respond within 30 days.

You also have the right to file a complaint with your local data protection authority.

8. International Data Transfers

Your data is processed within the European Union. If a sub-processor transfers data outside the EU/EEA, appropriate safeguards are in place (Standard Contractual Clauses or the EU-U.S. Data Privacy Framework). This applies in particular to Supabase Inc. and to other providers whose parent companies are in the United States.

9. Browser Storage and AI Chat

Diurna does not use tracking cookies, analytics cookies, or marketing cookies.

We use browser localStorage for:

• Authentication session: managed by the Supabase SDK for session persistence

• Chat history: a copy of the last 20 AI assistant conversations is kept in your device's browser as temporary storage for the open conversation. On logout the open conversation is saved in Diurna and the copy in the browser is deleted; after you log in again you see your conversations, loaded from Diurna

No data is shared with third parties via browser storage.

The AI chat assistant is an optional module, switched on separately for each client. Messages are processed by Mistral AI SAS in the European Union and are not used to train its models. The chat shows a permanent notice asking you not to enter health data or other special categories of data (Art. 9 GDPR), for example a diagnosis or the reason for a sick-leave absence: the chat is not designed for such data.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date and notify you through the platform. Continued use of Diurna after changes constitutes acceptance.