1. Introduction
This Privacy Policy explains how Internal Tools (“we,” “us,” “our”) collects, uses, and protects information when your organization uses our workforce-management platform (the “Service”). This policy applies to personal data we process as a data processor on behalf of our customer organizations and, where applicable, as a data controller of our own end-user account records.
2. Information we collect
The Service collects information you or your employer provide when you use it:
- Account information — name, work email, role, avatar, and organization membership.
- Time-tracking data — start and stop timestamps, project + task associations, manual entries and their approvals.
- Activity signals — keyboard and mouse activity counts (aggregated, never the actual keystrokes), application and window titles you have open while the tracker is running, and periodic screenshots when your organization has that feature enabled.
- Device information — operating system, browser or desktop-tracker version, IP address and coarse geolocation inferred from it, and diagnostic logs the desktop app uploads to help us fix crashes.
- Billing information — company name, address, and the last four digits of the payment card. Card numbers themselves are never stored on our servers; they are handled by our payment processor.
3. How we use information
- To operate the Service and the features your organization has enabled.
- To authenticate you, keep your session active, and detect abuse.
- To generate the reports and dashboards your organization uses for staffing, payroll, and project management decisions.
- To send transactional email (invites, verification, receipts).
- To improve the product — aggregate, de-identified telemetry only. We do not sell personal data.
4. Sharing
We share your data with your organization’s administrators (the ones who set up the account) and with the sub-processors below to run the Service:
- Cloud hosting and object storage providers.
- Transactional email delivery.
- Payment processing (Stripe).
- Optional integrations you explicitly enable (e.g. Slack).
We do not sell personal data. We do not share it with advertisers. We disclose it only when required by law or to protect the rights, property, or safety of Internal Tools, our customers, or others.
5. Security
We encrypt data in transit (TLS) and at rest. Access to production systems is limited to a small number of authorized engineers and is logged. Screenshots and other captured media are stored in a private, non-public bucket and served only via short-lived signed URLs to authenticated members of your organization.
6. Retention
Time entries and reports are retained for as long as your organization uses the Service. Screenshots are retained for the period your organization’s plan permits (7 to 365 days, configurable by admins). Account records are retained for the life of the account and are deleted within 90 days of your organization terminating the subscription, except where longer retention is required by law.
7. Your rights
Depending on your jurisdiction (GDPR, CCPA, and similar laws), you may have rights to access, correct, delete, or export your personal data, and to object to certain processing. For employee accounts, please direct these requests to your organization’s administrator, who is your data controller. For questions we can address directly, contact us at privacy@example.com.
8. International transfers
We may transfer and process personal data outside your country. When we do, we rely on standard contractual clauses or another lawful transfer mechanism required by applicable law.
9. Changes to this policy
We will update this policy from time to time. Material changes will be announced in-app and by email to organization admins at least 30 days before they take effect. Continued use of the Service after the effective date means you accept the updated policy.
10. Contact
Questions about this policy or a request regarding your data: privacy@example.com.