Privacy Policy

This Privacy Policy explains how timesheet-tech ("we", "us", "our") handles personal information when you visit our website, contact us, or use the timesheet-tech timesheet application (together, the "Service"). By using the Service you agree to this policy.

1. Information we collect

We collect the following categories of information:

• Account information. Your name, email address, password (stored only as a cryptographic hash), and the business you belong to. If you enable two-factor authentication or register a passkey, we store the credentials needed to verify you.
• Timesheet and business data. The hours, dates, projects, notes, approvals and invoices that you or your employer enter into the Service. Where your employer holds the account, this data belongs to them and we process it on their instructions.
• Enquiries. When you submit our contact form we record your name, email address, phone number, business name, approximate employee count and message.
• Technical and usage information. IP address, browser user agent, language preference, session identifier, the pages you view and how long you spend on them.
• Marketing attribution. The referring website and the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content) present when you first arrive, so we can tell which campaigns bring people to the site.
• Payment information. If you subscribe to a paid plan, billing is handled by a third-party payment processor. We receive confirmation of payment and limited details such as the last four digits of the card; we do not store full card numbers.

2. How we use information

• To provide, operate, secure and support the Service.
• To create and administer accounts, and to authenticate you when you sign in.
• To respond to enquiries and provide customer support.
• To take payment and issue invoices and receipts.
• To send service messages such as approval reminders, security alerts and changes to these terms.
• To detect, investigate and prevent fraud, spam and abuse.
• To understand how the Service is used so that we can improve it.
• To comply with our legal obligations.

We send marketing email only where you have asked for it or where the law otherwise permits it, and every marketing message carries an unsubscribe link. Unsubscribing does not stop essential service messages about your account.

3. Legal bases for processing

Where data protection law requires us to identify a legal basis, we rely on: performance of our contract with you; our legitimate interests in operating, securing and improving the Service; your consent, where we ask for it (for example for non-essential cookies); and compliance with legal obligations. You may withdraw consent at any time without affecting processing already carried out.

4. Cookies and analytics

We use cookies that are strictly necessary to run the Service, including a session cookie that keeps you signed in and a token that protects forms against cross-site request forgery. These cannot be turned off without breaking the Service.

We also use analytics cookies to measure traffic and understand which pages are useful. Analytics are provided by a third party that may set its own cookies and receive your IP address and page views. You can block or delete cookies in your browser settings.

5. Who we share information with

We do not sell personal information. We share it only with:

• Your employer or account administrator. If you use the Service through a business account, the administrators of that account can see the timesheets, approvals and profile details associated with your user.
• Service providers. Hosting, database, email delivery, error monitoring, analytics, file storage and payment providers who process data on our behalf under contract and may not use it for their own purposes.
• Legal and safety recipients. Regulators, courts or law enforcement where we are legally required to disclose information, or where disclosure is necessary to protect our rights, the Service or the safety of others.
• A successor. If we are involved in a merger, acquisition or sale of assets, information may transfer to the acquiring party under the terms of this policy.

6. International transfers

Our providers may store or process information in countries other than your own. Where we transfer personal information out of a jurisdiction that restricts such transfers, we rely on an appropriate safeguard such as standard contractual clauses or an adequacy decision.

7. How long we keep information

We keep account and timesheet data for as long as the account is active, and for a reasonable period afterwards so records can be restored or produced if a dispute or audit requires it. Contact enquiries are retained while we deal with them and for a limited period afterwards. Where a longer period is required by tax, employment or accounting law, we keep the data for that period and then delete or anonymise it.

8. Security

We protect information with encryption in transit, hashed passwords, role-based access controls, optional two-factor authentication and passkeys, and access logging. No system is completely secure, so we cannot guarantee absolute security, but we will notify you and any relevant regulator of a breach affecting your personal information where the law requires it.

9. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, withdraw consent, and complain to your data protection authority. To exercise a right, email hello@example.com. We will respond within the time the law allows and may need to verify your identity first.

If your employer holds the account, we act on their instructions. We will pass your request to them and support them in answering it.

10. Children

The Service is intended for use by businesses and their workers. It is not directed at children, and we do not knowingly collect personal information from anyone below the age at which they can lawfully work and consent in their country. If you believe a child has provided us with information, contact us and we will delete it.

11. Third-party links

Our website and blog may link to sites we do not control. This policy does not apply to them, and we are not responsible for their content or privacy practices.

12. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page always reflects the current version, and we will give notice of material changes by email or an in-app notice before they take effect.

13. Contact us

Questions about this policy or how we handle your information can be sent to hello@example.com or through our contact form.