# Calcutab: Privacy Policy

*Version 1.2 · 1 November 2026*

Calcutab records working time for the organisation that gave you your seat. **That
organisation is the controller of your data**; we, the operator, process it on their
behalf. Questions about why your time is recorded, or requests to see or delete it,
go to them first, and we will help them answer.

**What we hold about you:** your name, email address and profile picture from the
account you sign in with; a photo, only if you add one yourself (re-encoded, so it carries
no location or camera details, and deleted when you remove it); the time you log, by day and product; the days you mark as away, with the reason if you give
one (vacation, out of office, public holiday or other; we never ask about illness); the job role, team and
rate your organisation assigns you; if your organisation connected Jira, the keys and
titles of issues you touched (never the comments); if they connected Slack, your Slack
user id. And a record of changes made to your timesheet by a manager.

**If you have no login:** your organisation may record your time without giving
you access. It then holds only your name, the time a manager logs for you, the
role, team and rate it assigns you, and a record of those changes; no email
address, photo, Jira or Slack data. Ask your organisation for a copy or for
deletion; a manager can do either from your profile.

**If you report a problem** from inside Calcutab, what you write, the address of the
page you were on (never its contents), your browser, and a screenshot only if you add
one come to us, the operator, so we can fix it. Your organisation does not see it. It
is deleted 180 days after we answer it, or at once when your data is erased.

**What we do not do:** read your email, files or calendar (sign-in asks only for your
name and address); post to Jira or Slack on your behalf; sell or share your data; use
it to train anything.

**Where it is:** in the EU. The application runs on Google Cloud in Belgium
(`europe-west1`); the database is on Neon in Frankfurt, Germany.

**If you are in Canada:** your data is processed in the EU, which for you is a
transfer out of Canada. PIPEDA allows that where the organisation collecting it
stays accountable and secures comparable protection by contract; the Data
Processing Agreement is that contract, and the GDPR protections it carries are at
least as strong as PIPEDA's own. If you are in Quebec, Law 25 asks your organisation
to assess the transfer before making it; the agreement names every sub-processor
and every safeguard so that assessment can be done from the document rather than
from a questionnaire. The rights above (access, correction, deletion and
portability) are yours under PIPEDA and Law 25 as well as the GDPR, on the same
timelines. A breach is notified to your organisation within 72 hours, which is
inside what the Privacy Commissioner of Canada and the Commission d'accès à
l'information expect.

**How long:** while your organisation is a customer, then deleted 30 days after they
leave; backups expire within a further 30 days.

**Cookies:** only the ones that keep you signed in and remember your theme. No
advertising or analytics cookies.

**Your rights** under the GDPR (access, rectification, erasure, restriction,
portability, objection) are exercised through your organisation, or directly with us at
**support@calcutab.com**. You can delete your own personal data yourself, under
Settings › You; an owner of your workspace can do the same for you once you have left.
Either way the days you logged stay, with nobody's name on them, so your
organisation's past reports do not change. We answer within
the month the GDPR allows.

You also have the right to complain to a supervisory authority in the EU member state
where you live or work.

**Who to write to:** support@calcutab.com reaches us for anything on this page:
a question, a request, or a complaint.