Privacy Policy

DRAFT v0.1 (2026-10-23). Not legal advice. To be reviewed by a lawyer before publication. Placeholders in [BRACKETS].

Last updated: 24 October 2026

1. Who we are

TimeTracking (timetracking.tech) is a time-registration service for businesses, offered by TimeTracking, 31, 6165 BH Geleen, Chamber of Commerce (KvK) 84956526 ("TimeTracking", "we"). Contact for privacy questions: privacy@timetracking.tech. [Data protection officer: not appointed / name — DECISION OPEN.]

2. Two roles: controller and processor

TimeTracking is used by organisations (employers, staffing agencies, their clients). This matters for who is responsible for your data.

You are…	Your data is processed by TimeTracking as…	Who decides about your data
Employee or flex worker who registers hours in the app	Processor on behalf of your employer/agency	Your employer/agency (the "Customer")
Contact person at a client who approves timesheets via a link	Processor on behalf of the agency that sent the link	That agency
Account owner/admin of a Customer, for login, billing, support	Controller	TimeTracking
Visitor of timetracking.tech, newsletter subscriber, prospect	Controller	TimeTracking

If TimeTracking is the processor, the Customer's own privacy statement applies, and we process data only on their documented instructions under a data processing agreement. Requests about that data (access, correction, deletion) go to your employer or agency; if you send them to us, we forward them within 5 working days.

3. Data we process as processor (on behalf of Customers)

What the Customer chooses to store in TimeTracking, typically:

• Identity and contact: first and last name, email, phone number, employee number, language preference.
• Work relationship: placements/assignments (client, site, role title, start/end date, reference number), fixed allowances (e.g. travel allowance amounts).
• Hours: work date, start/end time, minutes worked, breaks, notes, the source of each entry (app, kiosk, email, import, office, client portal), device time (to detect clock manipulation), status history (draft, submitted, approved, exported, locked).
• Approvals by client contacts: name, role, typed signature, decision (approve/correct/reject), reason, time, IP address and browser user agent. This is a simple electronic signature under the eIDAS Regulation.
• Location (optional, only if the Customer turns it on): GPS position only at the moment of clocking in/out or when entering/leaving a geofence around a work site. No continuous tracking, no tracking outside these events. Raw coordinates are kept for 30 days by default (Customer can set 0–90 days); after that only "inside/outside geofence" is kept.
• Expenses: receipts and photos you upload, amounts and categories. [Planned module.]
• Inbound email: timesheets that clients email to the Customer's TimeTracking address (sender, subject, attachments), and the data an AI model extracts from them.
• Audit log: who changed what and when (old and new value, actor, source).

We never take screenshots, record keystrokes, track websites/apps you use, or track your location outside clock/geofence events.

4. Data we process as controller

Data	Purpose	Legal basis (GDPR art. 6)	Retention
Account data of Customer users (name, email, phone, login method, passkey public keys, session data)	Provide login and account security	Contract (6(1)(b))	Duration of account + 30 days
Billing data (company name, VAT number, billing address, invoices; card data is handled by Stripe, not by us)	Invoicing, tax	Legal obligation (6(1)(c)), art. 52 AWR	7 years
Support conversations (email, chat with Mila)	Answering questions, improving help content	Contract / legitimate interest (6(1)(f))	24 months
Website usage analytics (PostHog EU, only after cookie consent)	Improve website and product	Consent (6(1)(a))	12 months
Product usage metrics of logged-in users (aggregated, pseudonymised)	Capacity planning, fair use, abuse detection	Legitimate interest	12 months
Error and security logs (Sentry, server logs)	Security, debugging	Legitimate interest	30–90 days
B2B prospect data (business email, name, company, role)	Sales outreach to business addresses, max. once with opt-out in every message	Legitimate interest [lawyer to confirm under art. 11.7 Telecommunicatiewet]	Until opt-out or 12 months without response

5. AI features

• TimeTracking uses AI (Anthropic Claude) to read emailed timesheets, detect anomalies (e.g. impossible hours, duplicates, GPS deviations), categorise entries, translate notes and answer questions about your own data.
• AI output is a suggestion. Extractions below a confidence threshold go to human review. Approvals, exports and payroll decisions are always made by people; the AI cannot approve, send or delete anything. No decisions with legal effect are made solely by automated means (GDPR art. 22).
• Model provider: Anthropic Claude via AWS Bedrock in an EU region (Frankfurt) [planned; until live: see sub-processor list]. Customer data is not used to train AI models.
• Our support assistant Mila is an AI assistant. Mila says so at the start of every conversation (EU AI Act art. 50) and hands over to a human on request.

6. Where your data is stored

Primary database: Supabase on AWS in the EU (Ireland, eu-west-1). Web application: Vercel, with functions in an EU region where possible; static content is served through a global CDN. For the full list of sub-processors, locations and transfer safeguards see Sub-processors. Where a provider is a US company, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

7. Security

Encryption in transit (TLS 1.2+) and at rest (AES-256), strict tenant isolation in the database (row-level security), append-only audit log, point-in-time backups, two-factor authentication for admin roles, least-privilege staff access. Details: Annex 2 of the Data Processing Agreement.

8. Deleting your account vs. legal retention

You can delete your app account in the app (Settings → Delete account). What happens:

1. Your login, contact details, device tokens and preferences are deleted.
2. Your profile in each organisation is anonymised (name replaced by a pseudonym, email/phone removed).
3. Hour records, approvals and exports stay with your employer/agency, because employers must keep payroll records for 7 years (art. 52 AWR) and working-time records for at least 52 weeks (Arbeidstijdenbesluit). Your employer is the controller for these records and decides when they are deleted.
4. Location points are deleted according to the Customer's retention setting.

9. Your rights

Right of access, rectification, erasure, restriction, objection, data portability and to withdraw consent. Exports of your own hours are available in the app (CSV/PDF). For data held for a Customer, contact that Customer first. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your country.

We respond within one month.

10. Children

TimeTracking is not intended for persons under 16. Customers employing workers under 16 must ensure a lawful basis [lawyer: confirm wording for young holiday workers].

11. Changes

We announce material changes at least 30 days in advance by email to account owners and in the app.