Privacy Policy

Effective date: 1 July 2026

Common privacy policy for 24gate mobile applications and related web services.

Scope

This Privacy Policy is the common policy of 24gate s.r.o. for our mobile applications distributed through Google Play and the Apple App Store, including 24gate ERP, ERP mobile, mobile24gate, and related web services.

The applications are business tools used by authorized users and customer organizations.

Controller

24gate s.r.o.
Jindřicha Plachty 596/8, 150 00 Prague 5, Czech Republic
Company ID: 03905390
Contact: info@24gate.com

Hosting and Data Location

All customer data is stored and processed exclusively in the European Union. Customer data is not transferred outside the European Economic Area.

We do not use public cloud platforms such as AWS, Google Cloud, or Microsoft Azure for storing customer data. The infrastructure is operated on our own servers or servers operated in data centers located in the EU.

Data We Process

Depending on enabled modules, application type, and user actions, we may process the following categories of data:

account and contact data, such as name, email address, company, role, and login identifiers;
business and ERP data entered or uploaded by users, such as warehouse records, tasks, notes, and customer or supplier records;
documents uploaded by users, accounting documents, contracts, invoices, orders, and other business documentation;
files, photos, scans, and attachments that users choose to upload through the application;
OCR outputs, document metadata, and structured data extracted from documents;
data created by AI features, such as suggested field values, classification results, search results, or workflow automation outputs;
technical data needed to operate and secure the service, such as device type, app version, IP address, timestamps, session identifiers, system logs, security logs, and audit records;
cookie identifiers, consent preferences, analytics identifiers, and web service usage events where enabled;
push notification tokens or device identifiers if notifications are enabled in the application.

Authentication and accounts24gate

Our applications use accounts24gate as our own shared system for sign-in, identity management, sessions, workspaces, and access control. During sign-in or account management, users may therefore see the accounts.24gate.com domain.

In accounts24gate we process user identifiers, email address, account status, assigned roles, workspace memberships, session tokens, and security or audit records needed to operate and protect the applications. accounts24gate is an internal part of 24gate services, not a separate external advertising or tracking service.

OCR and Document Processing

Users may upload documents for OCR and further processing within the service. Documents may be analyzed automatically and the system may extract structured data from them.

OCR results and extracted data are used only for features provided to the customer, such as search, validation, field pre-filling, or document workflow automation.

Artificial Intelligence

Some features may use artificial intelligence models for document processing, OCR, search, automatic classification, suggested field values, user assistance, and workflow automation.

Customer data is not used to train public AI models and is not provided to third parties for AI training. AI processing takes place within infrastructure operated by 24gate.

How We Use Data

We use personal data to provide the applications, authenticate users, deliver ERP and mobile workflows, synchronize content, process documents, provide OCR and AI features, secure accounts, prevent misuse, provide support, fix errors, measure service usage, run product analytics, maintain audit logs, and comply with legal obligations.

Cookies and Web Technologies

24gate web applications may use essential cookies, authentication cookies, security cookies, and preference cookies. They are used mainly for sign-in, account security, remembering settings, and correct operation of web applications.

For diagnostics, monitoring, and product analytics, specific services may use tools such as Sentry or Sentry-compatible error tracking and PostHog. If optional analytics or marketing tools such as Google, Microsoft, or Meta/Facebook Pixel are enabled in the future, they will be used only where enabled for a specific service and, where required by law, after user consent.

We currently do not use marketing cookies or advertising systems for targeted advertising, and we do not provide customer data to third parties for marketing or advertising purposes.

Push Notifications

Mobile applications may use push notifications. We store only device identifiers or tokens needed to deliver notifications.

Push notifications are used exclusively for features provided by the service, such as workflow alerts, processing status, tasks, or important operational events.

Audit Logs

The system may record sign-ins, sign-outs, password changes, permission changes, administrative operations, document changes, important system operations, and security events.

Audit logs are used to secure the system, resolve incidents, comply with legal obligations, and protect customers.

Legal Basis

We process data primarily to perform contracts with customers, provide requested services to authorized users, comply with applicable law, and based on our legitimate interests in operating, securing, and improving the services. Optional analytics or marketing cookies and similar technologies are used on the basis of user consent where required by law.

Sharing

We do not sell personal data. Data may be shared with:

the customer organization that manages the relevant workspace or account;
data center, infrastructure, connectivity, email, SMS, push notification, monitoring, logging, backup, and technical support providers acting as processors;
diagnostics, error tracking, and product analytics providers where enabled for a service;
app store providers where required for distribution, diagnostics, billing, or compliance;
public authorities when required by law.

Retention and Retention Periods

The system may retain contracts, accounting documents, invoices, orders, and other business documentation for the period requested by the customer, required by legal obligations, or necessary to provide the service.

Specific retention periods are governed by customer contracts, internal retention rules, and legal obligations. In general: user accounts are retained for the lifetime of the account or related service; documents according to customer settings and legal obligations; audit logs and security logs according to internal retention rules, security needs, and legal obligations; backups according to backup rotation schedules; push tokens for as long as needed to deliver notifications or until they become invalid.

Security

We use technical and organizational safeguards designed to protect data against unauthorized access, loss, misuse, and alteration. These include HTTPS/TLS, encrypted communication, user authentication, access control, audit logging, regular backups, and protection against unauthorized access.

Access to customer workspaces is limited to authorized users and service operators with a legitimate operational need.

User Choices and Requests

Users can request access, correction, deletion, restriction, portability, or object to processing where applicable. Because most workspaces are managed by a customer organization, some requests may need to be handled together with that organization. Contact us at info@24gate.com.

Children

The applications are intended for business use and are not directed to children.

Changes

We may update this Privacy Policy when our services or legal requirements change. The current version is published at https://24gate.com/cs/privacy/ and https://24gate.com/en/privacy/.