Privacy Policy | Tick Tack Timetrack

DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as [LEGAL ENTITY NAME], is a placeholder that still has to be filled in.

This Privacy Policy explains how [LEGAL ENTITY NAME] (“we”, “us”) handles personal information in connection with Tick Tack Timetrack (the “Service”) and our marketing website.

1. Two different roles

How we handle your information depends on whose information it is.

Information about workers, held for an employer. When a business (our “Customer”) uses the Service, it decides which of its workers are added, which features are switched on, and how the records are used. For that information the Customer is the controller (under California law, the “business”) and we are its processor (or “service provider”). We use it only to run the Service for that Customer, under our Terms of Service and Data Processing Addendum. If you are a worker, your employer’s own privacy notice governs how it uses your records, and requests about them should go to your employer first (see section 9).
Information we handle for ourselves. We are the controller of a smaller set of information: the contact details of the people who sign their company up, communications with us, records of who accepted our Terms, information we need to secure and bill the Service, and information about visitors to our website.

The Service is intended for businesses with workers in the United States and is hosted in the United States.

2. Information in the Service

The Customer decides which features to enable, so not every item below applies to every worker.

Category	What it includes	Where it comes from
Account and profile	Name, work email, phone number, employee code, role, department, position, locations, hire and termination dates, date of birth, postal address, profile photo, preferences such as time zone, language and theme	The Customer’s administrators, or the worker
Sign-in and security	Password (stored only as a one-way hash), two-factor authentication settings, recovery codes (hashed), passkeys, active sessions, remembered devices	The worker
Kiosk PIN	A short number used to punch on a shared kiosk device, stored hashed; a copy is kept encrypted so that the worker can view their own PIN once	The Customer or the worker
Time records	Punch in and out times, breaks, time cards, approvals, notes, jobs and projects, schedules, shift swaps, time-off requests and balances	The worker, managers, kiosks, or the Customer’s API integrations
Location at punch time	Latitude, longitude, and accuracy reported by the worker’s device when they punch, and whether the punch fell inside a geofence	The worker’s device, if the Customer enables location
Real-time location	Location points sampled periodically while the worker is punched in (by default about every 5 minutes or 200 metres, as the Customer configures), the accuracy of each reading, and geofence entry and exit events	The worker’s device, only if the Customer enables real-time GPS for that worker; it is not collected while the worker is punched out
Punch photos	A photo taken when the worker punches	The worker’s device camera, if the Customer requires photos. We store the image only. We do not perform face recognition and do not create face geometry or any other biometric template.
Device and network data	IP address and browser user agent recorded with punches, sign-ins and changes; device labels for kiosks and approved devices	Automatically, from the worker’s browser
Pay data	Pay rates, overtime rules, hours and estimated gross pay, payroll runs and pay statements	The Customer. The Service does not calculate tax withholding or net pay and does not move money.
Audit log	A record of each change: what changed, before and after values, who made it, when, and from which IP address and browser	Automatically
Notifications	Emails we send for the Customer, such as invitations, approvals, reminders and security alerts	Generated by the Service
Single sign-on (if enabled)	A verified email address and an account identifier from Google, Microsoft, or Apple	The sign-in provider, only when the Customer enables that sign-in option and the worker uses it

3. Information we handle for ourselves

Sign-up and account contacts: the name, email address, and company details of the person who signs up, and of administrators we contact about the account.
Acceptance records: which version of the Terms an administrator accepted, when, the user who accepted, their IP address and browser, and the addresses of the documents shown.
Support and correspondence: what you send us and our replies.
Service operation and security: server logs (including IP addresses, request routes, status codes, and timing), error reports, and rate-limit counters.
Billing (after the beta): plan, invoices, and billing contacts. [ATTORNEY/OWNER: update once a payment processor is chosen; no payment card data is collected during the beta.]
Website visitors: our marketing website does not use analytics, advertising, or tracking cookies. Our hosting provider records standard server logs (such as IP address, page requested, and browser) for security and operations.

4. How we use information

For information we process for a Customer, we use it only to:

provide the Service as the Customer configures it, including calculating hours, overtime, and gross pay, showing locations on maps, checking geofences, and sending notifications;
keep the Service secure, detect and prevent fraud and abuse (for example, blocking repeated wrong PINs), and investigate incidents;
provide support the Customer or its users ask for;
fix errors and maintain the Service;
comply with the law.

For information we control, we also use it to manage our relationship with the Customer, to keep evidence of contract acceptance, to send service and legal notices, and, if you agree, to tell you about product news. You can unsubscribe from product news at any time; service and security messages are not optional while you have an account.

We do not sell personal information, share it for cross-context behavioural advertising, or use worker information to build advertising profiles. We do not use Customer Data to train machine-learning models. [ATTORNEY: confirm this commitment is wanted.]

5. Location data and photos in more detail

Location is collected only through the browser’s location permission, which the worker’s device asks for. If the worker declines, location-based features do not work and the Customer’s settings decide whether a punch without location is allowed or flagged.
Real-time tracking runs only while the worker is punched in and only for workers whose employer turned it on. A Customer cannot change a worker’s tracking setting while that worker is punched in.
The Customer chooses how long location points and punch photos are kept (section 7).
Map tiles shown in the app, and address searches made by administrators, are provided by our mapping subprocessor (see the Subprocessor list). When a map is shown, the browser requests map images for the area displayed directly from that provider, which receives the viewer’s IP address and the map area but no worker names.

6. Who receives information

Within the Customer’s organisation: administrators and managers see workers’ records according to the roles and permissions the Customer sets.
Our subprocessors: companies that host and operate parts of the Service for us, listed on our Subprocessor list. They may use the information only to provide their services to us.
Destinations the Customer chooses: when a Customer connects an API integration, sets up a webhook, or downloads an export, the information goes where the Customer sends it. Those recipients are the Customer’s responsibility.
Legal and safety reasons: when we believe in good faith that the law requires it, or to protect the rights, property, or safety of people, the Customer, or us. Where allowed, we will tell the Customer first and route requests for Customer Data to the Customer.
Business transfers: to a successor if we are involved in a merger, acquisition, or sale of assets, subject to this Policy.

7. How long we keep information

Time records, punches, breaks, time cards, schedules, time-off requests: kept for the Customer’s retention period (3 years as standard, or 6 years with the extended retention option, which every beta company has). Data older than that is hidden immediately and deleted after a further grace period that the Customer sets between 30 and 365 days (90 by default).
Real-time location points: kept for the number of days the Customer sets, between 30 and 2,190 days (365 by default).
Punch photos: kept for as long as the punch they belong to, unless the Customer sets a shorter period between 30 and 2,190 days.
Payroll records, pay rates, time-off balances and employee records: not deleted by the automatic retention process, because employers usually must keep them; the Customer can delete records it no longer needs.
Deleted workers: a worker the Customer deletes is removed permanently 30 days later, unless they appear in payroll records, in which case they must be deactivated instead.
Audit log: kept for the life of the Customer’s account and never edited, because it is the record that shows who changed what. [ATTORNEY: confirm indefinite retention is acceptable.]
Cancelled accounts: kept for [CANCELLED RETENTION DAYS, currently planned: 90] days after the account’s last active period so the Customer can export or reactivate, then deleted. [OWNER: still an open decision.]
Backups: copies remain in encrypted backups for up to [BACKUP RETENTION PERIOD] before being overwritten.
Acceptance records and our own correspondence: for as long as we need them to show what was agreed and to resolve disputes, normally [OWN RECORDS RETENTION PERIOD] after the account closes.
Notification delivery records: 90 days. In-app announcements: 30 days.
Webhook delivery records (including the data sent): [WEBHOOK LOG RETENTION PERIOD].
Server logs and error reports: [LOG RETENTION PERIOD].

Administrators can download an export of their company’s records as CSV files at any time, including after cancellation during the period above. The export covers workers, punches (including the location and IP address recorded with each), time entries, time off, pay rates, payroll results, and the audit log. It does not currently include real-time location points or photo files.

8. Security

We protect information with measures described on our Security page, including encryption in transit, encryption of stored files, hashed passwords and PINs, two-factor authentication, role-based access, tenant isolation, and an audit log. No system is perfectly secure, so we cannot guarantee absolute security. If a security incident affects Customer Data, we will notify the affected Customer as described in the DPA so that it can meet its own obligations.

9. Your choices and rights

Workers. Your employer controls your records in the Service. To see, correct, export, or delete them, contact your employer. If you contact us, we will pass your request to your employer and help them respond. You can see your own punches, time cards, and time-off history in the app, and you can change your own password, two-factor settings, and preferences.

Customer contacts and website visitors. Depending on where you live, you may have rights to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of certain uses. Residents of California and some other US states should also read our US State Privacy Notice. To make a request, email [DPO/PRIVACY CONTACT]. We will verify your identity by asking you to confirm control of the email address on the account, and we will not treat you differently for using your rights. You may use an authorised agent, who must show us your written permission.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information or use tracking cookies, there is nothing for those signals to switch off; we treat them as an opt-out request anyway.

10. Children

The Service is for businesses and is not directed to children under 13. Customers may employ minors where the law allows; their records are handled as described above on the employer’s instructions. We do not knowingly collect information directly from children under 13 for our own purposes. [ATTORNEY: confirm the right threshold, given that employers may enrol workers under 16 or 18.]

11. Outside the United States

The Service is hosted in the United States. If you use it from another country, your information will be transferred to and processed in the United States, where data protection law may differ from your own. We do not currently market the Service to businesses in the European Economic Area, the United Kingdom, or Switzerland. [ATTORNEY: confirm whether an EU/UK section and transfer mechanism are needed.]

12. Changes to this Policy

We publish each version of this Policy at its own address under /legal/privacy/<version>/ and never change a published version. The current version is always at /legal/privacy. We will tell Customers’ administrators about material changes before they take effect.

13. Contact

[LEGAL ENTITY NAME], [ADDRESS]. Privacy questions and requests: [DPO/PRIVACY CONTACT]. General questions: [CONTACT EMAIL].