Privacy Policy

This policy explains what personal data the Abejora time-tracking service ("the Service") collects, why, and your rights over it. We act as data controller for account data, and as processor for the content you record in your workspace. The processing terms that go with that role are in the Data processing section of the Terms of Service.

Who is responsible

• Abejit BV, a company incorporated in Belgium, trading as Abejora.
• Registered office: Boeimeerstraat 19, 2820 Bonheiden, Belgium.
• Enterprise and VAT number: BE 0704.662.834, RPR Antwerpen, afdeling Mechelen.
• Email: [email protected]
• Contact form: www.abejora.com/contact

What we collect

• Account data: your email address, authentication data, and your acceptance of these terms (time and version).
• Workspace content: the clients, projects, tasks, time entries and rates you enter.
• Billing data: subscription status and identifiers held by our payment provider (we do not store card numbers).
• Technical data: logs and IP addresses needed to operate and secure the Service.
• Usage: counts of visits, and, only if you allow it, recordings of how you move through the pages, with what you type and the text shown in the application hidden. The Cookie Policy says what can still appear in a recording, and how long recordings are kept.
• Enquiries: the email address and message you send us through the contact form. These reach us as an email and are not stored in the Service.

Why we use it, and on what legal basis

• Providing the Service: your account, signing you in, and the workspace you use. Necessary to perform our contract with you (Article 6(1)(b) GDPR).
• Subscriptions and billing: taking payment through Stripe and telling you about your subscription. Necessary to perform the contract; keeping the billing records afterwards is a legal obligation (Article 6(1)(c)).
• Security: logs and IP addresses used to keep the Service running and to stop abuse. Our legitimate interest in a secure Service (Article 6(1)(f)).
• Counting visits: how many people open which pages, counted without cookies and without following you elsewhere. Our legitimate interest in knowing how the site and the Service are used (Article 6(1)(f)).
• Session recording: only if you allow it. Your consent (Article 6(1)(a)), which you can withdraw at any time from the Cookie Policy.
• Enquiries: answering what you send through the contact form. Steps you ask for before a contract (Article 6(1)(b)), or our legitimate interest in answering (Article 6(1)(f)).
• Workspace content: the clients, projects, hours and rates you record. We process these for you, as your processor under the Data processing section of the Terms; you decide their legal basis.

Where we rely on our legitimate interest, you can object to it. We do not sell your personal data, and we do not use it to train models.

Cookies

What the Service stores on your device, and why, is listed in the Cookie Policy.

Sub-processors

We rely on a small number of providers to run the Service:

• Hetzner: hosting and infrastructure, in the EU.
• Cloudflare: DNS, and the tunnel through which the Service is reached.
• Scaleway: transactional email, and object storage for the database backups, in the EU.
• Stripe: payments, acting as merchant of record for subscriptions.

We announce an addition or a replacement by email before it takes effect, so that a customer who objects can terminate before that date.

Where data is stored

Account and workspace data are stored on servers in the EU. Where a provider processes data elsewhere, we rely on appropriate safeguards.

Retention

We keep workspace data while your account is active. When we carry out a request to delete it, we remove your data, except records we must keep to meet legal and accounting obligations: Belgian accounting and VAT law require us to retain accounting records, including records of what was billed to you, for ten years.

A deletion takes the data out of the live Service. A deleted workspace also survives in the database backups until they age out of the backup retention window, which is currently 30 days, after which it is gone from those too. We do not read a backup to serve anyone, only to restore the service.

Your rights

You can request access to or export of your data from the Account section of your workspace Settings, where a workspace admin can also request its deletion; anyone can ask for any of these by email. We action requests manually and reply within 30 days.

• Access and export your data.
• Correct or delete your data, including your account and workspace.
• Object to or restrict certain processing, and lodge a complaint with your supervisory authority.

Our lead supervisory authority is the Belgian Data Protection Authority. You may also complain to the authority of the EU country where you live.

Contact

Privacy questions or requests: [email protected].