Privacy Policy
How Timecone collects, uses, discloses and protects your information when you use the Timecone time tracking and project management portal.
1. Introduction
Timecone ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our employee time tracking and project management portal (the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the Service.
2. Information We Collect
2.1 Personal Information
We collect the following personal information:
- Profile Information: Name, email address, title, role, employee type, department, supervisor information, profile image, and approver designations
- Authentication Data: Passwords (stored using bcrypt hashing), Azure AD OAuth tokens, and session information
- HR Information: Financial data (hourly cost), time off settings, payroll ID, exempt status, and work calendar
- Activity Data: Last active timestamps, login history, and user activity logs
2.2 Timesheet and Project Data
We collect and store:
- Time entries with project and deliverable assignments
- Comments and notes associated with time entries
- Document attachments and expense receipts
- Timesheet submission and approval history
- Project and task assignments
2.3 Integration Data
When integrated with third-party systems, we may collect:
- NetSuite ERP data (clients, projects, resources, personnel)
- QuickBooks mapping information
- External HR system data (when configured)
3. How We Use Your Information
We use the collected information for the following purposes:
- To provide and maintain the Service
- To authenticate users and manage access to the Service
- To process timesheet entries and manage project assignments
- To generate reports and analytics for your organization
- To send notifications, reminders, and updates related to the Service
- To sync data with integrated third-party systems (NetSuite, QuickBooks, etc.)
- To improve and optimize the Service
- To comply with legal obligations and enforce our terms
4. Third-Party Services
We use the following third-party services that may access your information:
4.1 Authentication Services
- Azure AD (Microsoft): For single sign-on authentication. Microsoft's privacy policy applies to data processed through Azure AD.
4.2 Business Integration Services
- NetSuite: ERP integration for syncing projects, resources, and personnel data
- Azure Blob Storage: Secure document and file storage
4.3 Communication Services
- SendGrid: Email delivery service for notifications and reminders
4.4 Analytics and Monitoring Services
- Sentry: Error tracking and performance monitoring
- Datadog RUM: Real user monitoring and application performance monitoring
- Google Analytics: Page view and usage analytics
These third-party services have their own privacy policies governing the collection and use of your information. We encourage you to review their privacy policies.
6. Data Storage and Security
6.1 Data Storage
Your data is stored in:
- MongoDB: Primary database for user profiles, timesheets, projects, and related data
- Azure Blob Storage: Secure cloud storage for documents, attachments, and files
6.2 Multi-Tenant Architecture
The Service uses a multi-tenant architecture where each organization's data is isolated in separate databases. Your organization's administrators have access to data within your organization's tenant only.
6.3 Security Measures
We implement security measures including:
- Password encryption using bcrypt hashing
- Secure HTTPS connections for all data transmission
- Multi-tenant data isolation
- Regular security audits and updates
- Access controls and authentication requirements
7. Data Sharing and Disclosure
We may share your information:
- With Your Organization: Your employer or organization administrators have access to your timesheet data, profile information, and activity within your organization's tenant
- With Third-Party Services: As described in Section 4, we share data with third-party services necessary to provide the Service
- For Legal Compliance: When required by law, court order, or government regulation
- To Protect Rights: To protect our rights, privacy, safety, or property, or that of our users
We do not sell your personal information to third parties for marketing purposes.
8. Data Retention
We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. When you request account deletion, we use a soft delete mechanism that marks records as deleted while retaining them for a period to comply with legal obligations and for data recovery purposes.
Timesheet and project data may be retained for historical reporting and compliance purposes even after account deactivation, as determined by your organization's policies.
9. Your Rights and Choices
You have the right to:
- Access: Request access to your personal information
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your account and personal information (subject to legal and organizational requirements)
- Objection: Object to certain processing of your information
- Portability: Request a copy of your data in a portable format
To exercise these rights, please contact your organization's administrator or use the contact information provided in Section 11.
Note: Some rights may be limited by your organization's policies or legal requirements. Your organization's administrators may have access to and control over your data within the Service.
10. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights regarding your personal information, please contact:
Privacy Inquiries
Timecone
Email: privacy@timecone.io
(Please contact your organization's administrator for organization-specific privacy inquiries)
See also our Terms of Use.