Privacy Policy
Draft v0.2 — last updated 18 October 2026. This is a working draft and is being reviewed; items highlighted in yellow are still to be completed or confirmed.
This policy explains how PROVIDER LEGAL NAME (“we”) handles personal data when you use the service. Our address is REGISTERED ADDRESS; contact us about privacy at PRIVACY CONTACT EMAIL.
Two roles — please read this first
- For the data your employer or company puts into the service (staff records, timesheets, payroll, health and safety records and so on) your employer or company is the controller and we are its processor. We follow its instructions as set out in the Data Processing Agreement. If you are an employee or contractor, ask your employer about how it uses your data, and exercise your rights with it.
- For account administration, billing, security and running the service we are the controller of the personal data described below.
What we collect as controller
- Account details: name, work email, role, and a securely hashed password (we cannot read it); two-factor settings if you use them.
- Billing details for the company's administrator: name, email and billing address. Card details are handled by Stripe and are never stored by us.
- Security and usage records: sign-in times, IP address where our network provides it, failed sign-in attempts, an audit trail of important actions, and technical logs needed to run and protect the service.
- Support: messages and photos you send us through the in-app Support area, and our replies.
- Email and notifications we send you (welcome, password reset, reminders, summaries) and whether they were delivered.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account; providing the service | Performance of a contract (with your company) |
| Billing and keeping financial records | Contract; legal obligation |
| Keeping the service secure, preventing misuse, fixing faults, backups | Legitimate interests (running a safe, reliable service) |
| Answering support requests | Contract; legitimate interests |
| Telling you about important changes to the service | Legitimate interests; legal obligation |
Who we share it with
Only with the service providers that help us run the service (our sub-processors), professional advisers, and authorities where the law requires. We do not sell personal data and do not use it for advertising.
Where it is stored and transferred
The service is hosted by DigitalOcean, LLC in Amsterdam, the Netherlands. This is inside the European Union. Some optional providers listed on the sub-processors page (for example AI and text-message providers) are in the United States; where personal data goes outside the European Economic Area (EEA) we rely on an approved transfer mechanism such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. Confirm the mechanism for each provider.
How long we keep it
- Account and company data: for as long as the account is active, then deleted within 30 days of the account ending (see the Data protection overview).
- Backups: nightly backups are kept for up to 14 days on the server, and copies for up to 30 days held by us, then overwritten.
- Billing records: for the period the law requires (currently 6 years for tax records in Ireland).
- Security and audit logs: state retention period, e.g. 12 months.
Security
Connections use HTTPS. Passwords are hashed. Especially sensitive details held in the service — PPS numbers, bank details and health questionnaires — are encrypted in the database. Access is by individual account with sign-in limits and optional or required two-factor authentication, and administrators can sign devices out. See the Data protection overview for more.
Cookies and similar technologies
We use a single essential session cookie to keep you signed in; it is not used for tracking and expires after a period of inactivity. The app also stores small amounts of data on your device so it can work without signal (for example punches and forms saved until you are back in coverage) and remember simple preferences. We do not use advertising or analytics cookies.
Your rights
You can ask for access to your personal data, correction, erasure, restriction, a portable copy, and you can object to processing based on legitimate interests. Contact PRIVACY CONTACT EMAIL. If we are acting as your employer's processor we will pass your request to your employer. You can complain to the Data Protection Commission (Ireland) at dataprotection.ie.
Children
The service is for businesses and is not directed at anyone under 16.
Changes
We will update this policy when our practices change and tell you about material changes in the service or by email.