ServiceLeaf mobile
ServiceLeaf mobile privacy notice
Last updated: 12 October 2026
This notice explains how personal data is handled when you use the ServiceLeaf mobile app for accounts, assets, tickets, and work orders. It supplements the full ServiceLeaf Privacy Policy, which covers the wider service and its published retention policies.
Who handles your data
ITone Informatika Kft. operates ServiceLeaf and is the controller for personal data used to administer accounts, secure the service, and handle communications. Contact us at hello@serviceleaf.app for privacy questions and requests.
For business data in an organization's ServiceLeaf workspace, the organization generally determines the purposes of processing and acts as the controller. ITone processes that data on its behalf to provide ServiceLeaf. Your organization determines your access and permissions and may have its own privacy notice.
What the mobile app processes
| Category | Examples and purpose |
|---|---|
| Account and sign-in information | Your name, email address, user identifiers, organization or workspace, role, and optional profile phone number. Sign-in credentials, authentication challenges, and session information are processed to identify you and provide account access. |
| Business records and searches | Asset and location records; tickets, messages, work orders, tasks, statuses, time entries, and related contact information. The app sends the searches and changes you request so you can find and manage records within your permissions. |
| Files and signatures you choose to provide | Selected photos, documents and other attachments, their names and contents, and drawn signature images used in your work. The app does not obtain access to all files on your device merely because you attach a selected file. |
| Content and user reports | The reason and explanation you submit, the identified record or involved user, limited excerpts or timestamps, and your reporter and workspace identifiers. ITone uses these details to investigate concerns and handle abuse. |
| Preferences and local session data | Language and display preferences, remembered login details if you choose that option, and session tokens needed to keep you signed in. Passwords are not saved by the app. |
| Technical and security information | Network requests, IP addresses, authentication and security events, and the Google reCAPTCHA security signals described below, used to operate and protect the service. |
Data can be supplied by you, your organization, or other authorized users of the workspace. Business records and attachments may contain personal data about customers, colleagues, or other people; only provide information that you are authorized to use for your work.
Why data is used
We use data to provide sign-in and the features you request, manage permissions, synchronize work records, provide support, and protect accounts against fraud and abuse. The applicable legal bases include performance of a service contract, legitimate interests in operating and securing the service, and compliance with legal obligations. Where processing requires consent, it can be withdrawn without affecting processing that was lawful before withdrawal. Your organization's legal basis also applies to business records for which it is the controller.
Google reCAPTCHA and other recipients
The Android app uses Google reCAPTCHA Enterprise to protect authentication against fraud and automated abuse. Its security checks can collect IP addresses, device identifiers, information about some installed apps, app interactions, device-integrity signals, the app's package and SDK information, and the action being checked, such as login. These signals are sent to Google to provide and maintain the security service.
Google processes this reCAPTCHA Customer Data as a service provider under the Google Cloud Terms and Cloud Data Processing Addendum. Google's Android SDK data disclosure explains the security signals collected. The mobile app has no advertising SDK and the mobile app does not use advertising identifiers for ad targeting.
Organization records are accessible to users authorized by the workspace's permissions. Service providers supporting hosting, file storage, communications, and security process relevant data to deliver the service. If you choose your organization's single sign-on option, its identity provider also processes sign-in information under its own privacy terms. Data may be disclosed where legally required or necessary to establish, exercise, or defend legal claims.
Some service-provider processing, including Google's security processing, may take place outside your country or the European Economic Area. Applicable contractual safeguards, including the Google Cloud data-processing terms and transfer mechanisms, apply to that processing. The full ServiceLeaf Privacy Policy provides further information about service providers and international transfers.
Reporting shared content and users
When you submit an in-app report, ServiceLeaf stores the report privately and attempts to notify ITone at hello@serviceleaf.app. The information includes your reporter identity so ITone can investigate and follow up. Only include information needed to explain the concern.
Reports are not ordinary workspace tickets and are not automatically sent to the workspace administrator. ITone may coordinate with the organization when needed to investigate a concern or handle inappropriate content or users. A receipt confirms that the report was stored; it does not confirm email delivery or that moderation has already happened.
Report information can remain after the original record or reporter account is deleted where needed for investigation, security, or lawful retention. Requests to delete or anonymize associated personal data are reviewed through the account-deletion process below.
Data on your device and security
The app uses encrypted HTTPS connections to communicate with ServiceLeaf. Access is controlled through authenticated accounts and workspace permissions. Session tokens are stored using the device's secure storage. Signing out clears the app's stored session tokens; display preferences or remembered non-secret login details may remain.
ServiceLeaf does not receive fingerprint or facial-recognition templates. If you use device biometrics, your operating system handles them locally. Drawn signatures that you choose to submit are different: their images become part of the relevant business record.
Files that you download or share outside the app remain under your control and the controls of the destination you choose. Removing the app does not automatically remove copies you exported or data held in the organization's workspace.
Retention and account deletion
Data is kept for the purposes for which it is needed, under the applicable service and organization retention policies and legal requirements. Account administration, communications, security records, and organization business records can have different retention periods. The full ServiceLeaf Privacy Policy describes the published retention categories and periods.
You can request deletion of your ServiceLeaf account and associated personal data by emailing hello@serviceleaf.app, without signing in or keeping the app installed. Requests are reviewed and verified. We coordinate with the organization for data it controls, and delete or anonymize applicable personal data subject to lawful exceptions. Some business, security, or legal records may need to be retained. We explain relevant retained data, reasons, and retention periods when fulfilling your request. A request does not instantly erase all organization records.
Your rights and contact
Depending on applicable law and your circumstances, you can request access, correction, deletion, restriction, or portability of your personal data, object to processing, and withdraw consent where it is the basis for processing. Contact hello@serviceleaf.app. We may need information to verify your identity and locate the right workspace. Do not send passwords or authentication codes.
If your organization controls the relevant business records, we coordinate the request with it. You may also contact your organization directly. You can complain to the data-protection authority where you live or work, including Hungary's NAIH.
Business use, external links, and updates
ServiceLeaf is intended for business use and is not directed at children. Contact us if you believe a child has supplied personal data through the service.
Links opened in your browser, external sign-in providers, and destinations you choose when sharing files have their own privacy practices. We update this notice when the app's data practices change and revise the date shown above. For broader service information, read the full ServiceLeaf Privacy Policy.