Version 1.2 · 1 November 2026
Calcutab records working time for the organisation that gave you your seat. That organisation is the controller of your data; we, the operator, process it on their behalf. Questions about why your time is recorded, or requests to see or delete it, go to them first, and we will help them answer.
What we hold about you: your name, email address and profile picture from the account you sign in with; a photo, only if you add one yourself (re-encoded, so it carries no location or camera details, and deleted when you remove it); the time you log, by day and product; the days you mark as away, with the reason if you give one (vacation, out of office, public holiday or other; we never ask about illness); the job role, team and rate your organisation assigns you; if your organisation connected Jira, the keys and titles of issues you touched (never the comments); if they connected Slack, your Slack user id. And a record of changes made to your timesheet by a manager.
If you have no login: your organisation may record your time without giving you access. It then holds only your name, the time a manager logs for you, the role, team and rate it assigns you, and a record of those changes; no email address, photo, Jira or Slack data. Ask your organisation for a copy or for deletion; a manager can do either from your profile.
If you report a problem from inside Calcutab, what you write, the address of the page you were on (never its contents), your browser, and a screenshot only if you add one come to us, the operator, so we can fix it. Your organisation does not see it. It is deleted 180 days after we answer it, or at once when your data is erased.
What we do not do: read your email, files or calendar (sign-in asks only for your name and address); post to Jira or Slack on your behalf; sell or share your data; use it to train anything.
Where it is: in the EU. The application runs on Google Cloud in Belgium (europe-west1); the database is on Neon in Frankfurt, Germany.
If you are in Canada: your data is processed in the EU, which for you is a transfer out of Canada. PIPEDA allows that where the organisation collecting it stays accountable and secures comparable protection by contract; the Data Processing Agreement is that contract, and the GDPR protections it carries are at least as strong as PIPEDA's own. If you are in Quebec, Law 25 asks your organisation to assess the transfer before making it; the agreement names every sub-processor and every safeguard so that assessment can be done from the document rather than from a questionnaire. The rights above (access, correction, deletion and portability) are yours under PIPEDA and Law 25 as well as the GDPR, on the same timelines. A breach is notified to your organisation within 72 hours, which is inside what the Privacy Commissioner of Canada and the Commission d'accès à l'information expect.
How long: while your organisation is a customer, then deleted 30 days after they leave; backups expire within a further 30 days.
Cookies: only the ones that keep you signed in and remember your theme. No advertising or analytics cookies.
Your rights under the GDPR (access, rectification, erasure, restriction, portability, objection) are exercised through your organisation, or directly with us at support@calcutab.com. You can delete your own personal data yourself, under Settings › You; an owner of your workspace can do the same for you once you have left. Either way the days you logged stay, with nobody's name on them, so your organisation's past reports do not change. We answer within the month the GDPR allows.
You also have the right to complain to a supervisory authority in the EU member state where you live or work.
Who to write to: support@calcutab.com reaches us for anything on this page: a question, a request, or a complaint.