Privacy in the Acko app
Our clients use the Acko app to run their website, orders and bookings. Here is what we know about you as its user and what it uses on your phone.
Effective from 15 October 2026. This English text is a translation for your convenience. If the two versions ever differ, the Czech version is the binding one.
Who the app is for
The Acko app is used by the businesses whose websites we run: owners, their colleagues and staff. We create the account under our contract with the business. You cannot sign up or buy anything in the app.
Who processes the data
The controller of your account data is Feedmetoo s.r.o., company ID (IČO) 06309798, registered office at Pražská 6, Rakovník II, 269 01 Rakovník, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 394114. We go by the name acko.studio. Write to tony@acko.studio.
For the data you enter about your own customers (orders, bookings, inquiries, client cards), the controller is your business and we process it only on its instructions. How it is handled is described on the privacy page of that business’s website.
What we process about you as a user
- Account: your name, e-mail, role (owner, editor, staff) and which websites you can open. We do not know your password; only its hash is stored.
- Sign-in: when and from which device you are signed in, so that you need not sign in again each time and so that we can end a session. A session you do not use for 30 days ends by itself.
- Phone for notifications: a device identifier, the address notifications are delivered to (push token), the phone’s system and your notification settings. Without it we cannot tell you about a new order or booking.
- Record of changes: who changed what in the website’s content or settings, and when. It is used to trace a mistake and to keep the account safe.
- App errors: a technical description of the error (phone model, system and app version, place in the code). It holds neither your e-mail, nor what was on the screen, nor anything you typed.
- Password reset: when you ask for one, we e-mail you a one-time code. Only its hash is stored and it is valid for 10 minutes.
The legal basis is the contract with your business and our legitimate interest in running the service safely. We use none of it for advertising or profiling and we sell it to nobody.
What the app asks to access on your phone
It asks for each access only when you first use the feature. Refusing limits nothing else.
| Access | What for | What leaves the phone |
|---|---|---|
| Notifications | a new order, booking or inquiry | nothing; a notification holds no customer’s name or phone |
| Camera and photos | a photo for the website, reading a code | only the photo you choose and upload |
| Contacts | picking a client’s number for a booking | only the one number and name you pick |
| Calendar | writing your bookings into the phone’s calendar | nothing; the app writes on the phone. Your phone may then back the calendar up to iCloud or Google by itself |
| Clipboard | pasting a number you copied | only when you tap to paste |
| Face ID or fingerprint | unlocking the app | nothing; the phone checks it and tells the app only “yes” or “no” |
| Microphone | dictating a note | only what you dictate and save |
| Files | uploading a price list or a menu from a file | only the file you choose |
The app sends no SMS by itself. It prepares the text and hands it to the Messages app on your phone; sending is up to you.
The app keeps its sign-in credential in the phone’s secure storage (Keychain, Android Keystore). Unfinished edits and the app’s settings stay on the phone until you sign out.
How long we keep the data
- The account and the record of changes for as long as we run the service for your business. After it ends we delete the account within 30 days.
- The phone for notifications until you sign out. Signing out deletes its record.
- App errors for 90 days.
- Backups expire after 6 weeks at the latest.
Who receives the data
The providers that run the service for us technically: hosting and database, delivery of notifications and app updates to the phone (Expo, Apple, Google), sending e-mails and catching errors. The full list is on the Sub-processors page. Some are based in the USA; data goes to them only under the EU–US Data Privacy Framework or standard contractual clauses.
Deleting your account
We delete your account on a request sent by the owner of the business or by you to tony@acko.studio, within 30 days. We delete the account, the sessions and the phones’ records. The website’s content and the customers’ data belong to the business and stay with it. The record of changes stays without your name.
Your rights
You have the right of access, rectification, erasure, restriction, portability and the right to object to processing based on legitimate interest. Write to tony@acko.studio; we reply within one month. You may lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
Changes to this text
When what the app processes or asks to access changes, we update this page and the date above. We announce substantial changes by e-mail.