Privacy policy

Overview

This privacy policy explains which personal data we process when you visit this website, for what purpose and on what legal basis.

The website presents TimeIs.Ltd and offers a password-protected demo and an app that you can use with your own user account. The sections from “User accounts” onwards describe which data the app processes.

Controller

Winkler Ventures UG (haftungsbeschränkt)Plaggenmoor 3721147 HamburgGermany

Represented by the managing director Jean-Luc Winkler

Email: mail@timeis.ltd

We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, please contact us at the address above.

Hosting and server log data

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Each time you visit, Vercel automatically processes data that your browser transmits:

• IP address
• date and time of access
• requested URL
• referrer URL (the page you visited before)
• browser and operating system (user agent)

This data is needed to deliver the website and to keep it stable and secure, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably.

The log data is stored for a limited period in accordance with the hosting provider’s specifications and then deleted. The website cannot be accessed without this data; beyond that, you are not obliged to provide us with any data.

We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Further information can be found in Vercel’s privacy policy.

Transfer to the United States

Vercel is based in the United States, and data may be processed there. Vercel is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR) and, in addition, on standard contractual clauses (Art. 46(2)(c) GDPR).

Cookies

We only use strictly necessary cookies. Under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), they do not require consent because they are needed for a function you have explicitly requested. The associated processing is based on Art. 6(1)(f) GDPR.

• NEXT_LOCALE stores your chosen language so that pages without a language prefix open in that language. It is only set when you change the language using the language picker and contains nothing but the language code. Duration: 1 year.
• timeisltd-demo keeps your demo session after you have entered the correct demo password. It contains a signed session token with issue and expiry time and no information about you. Scripts cannot read it (HttpOnly). It expires after 8 hours and is deleted when you sign out. The password you enter is only checked, never stored.

• timeisltd.session_token keeps you signed in to the app; in production it carries the prefix __Secure-. It contains a signed, random session token. Scripts cannot read it (HttpOnly). It is valid for 7 days and is extended at most once a day while you use the app. It is deleted when you sign out.
• timeisltd_tz stores your browser’s time zone (for example Europe/Berlin) so that the app shows times and days correctly. It is only set inside the app and contains nothing but the time zone name. Duration: 1 year.

We do not set cookies for analytics or advertising.

Demo

The demo works exclusively with made-up sample data. Anything you enter in the demo workspace stays in your browser, is not transmitted to us and is discarded when you reload the page.

User accounts

When you create a user account and use the app, we process:

• your name and email address
• your password, only as a hash; we never store the password itself
• sessions with IP address, browser identifier (user agent) and expiry time
• content you create in the app: tasks, time entries, your identity profile (names, addresses, aliases) and settings
• counters per IP address that we use to limit repeated sign-in attempts

The purpose is to provide the app and your account. The legal basis is Art. 6(1)(b) GDPR. Limiting sign-in attempts protects accounts against misuse; for this, the legal basis is Art. 6(1)(f) GDPR.

The data is stored in a PostgreSQL database at Databricks, Inc. (Neon), region AWS eu-central-1 (Frankfurt). We have concluded a data processing agreement with Databricks, Inc. (Neon) under Art. 28 GDPR. Databricks, Inc. (Neon) is certified under the EU-U.S. Data Privacy Framework. The transfer to the United States is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Background tasks such as fetching and analysis run on a schedule at our hosting provider. Their logs contain the job type, duration, error code and a pseudonym of your account, but no content. We delete failed background tasks [Löschfrist fehlgeschlagener Jobs (DEC-02) – Angabe fehlt].

Emails about your account

To confirm your email address and to reset your password, we send you emails containing a link that is valid for one hour. We use Plus Five Five, Inc. (Resend), region AWS eu-west-1 (Irland), to send them. The provider processes your email address and the content of the message.

[Vertrag zur Auftragsverarbeitung mit dem Mailanbieter – Angabe fehlt] Transfers to countries outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

The legal basis is Art. 6(1)(b) GDPR. We do not send marketing emails.

Export, deletion and storage period

In the settings under “Data and account” you can download all data of your account as a JSON file. For security reasons, it does not contain the password hash, session tokens or access tokens.

You can also delete your account there. After you confirm with your password, we delete the account and all associated data from the database immediately. Backups at the database provider are overwritten [Aufbewahrung der Datenbank-Sicherungen (DEC-02) – Angabe fehlt].

We store your data for as long as your account exists. Statutory retention obligations remain unaffected.

Fonts

The IBM Plex Mono typeface is delivered together with the website by our hosting provider. No connection is made to Google Fonts or any other font provider.

No analytics or tracking

We do not use any analytics, tracking or advertising services, do not embed social media plugins and do not offer a newsletter or a contact form.

Contact by email

If you send us an email, we process your email address, your name if provided and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest lies in answering your request.

We delete the data once your request has been dealt with, unless statutory retention obligations, for example under commercial or tax law, require otherwise.

Storage period

We only store personal data for as long as is necessary for the respective purpose or required by statutory retention periods. After that, it is deleted.

Your rights

You have the following rights with regard to your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

To exercise your rights, simply send an email to mail@timeis.ltd.

Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

Der Hamburgische Beauftragte für Datenschutz und InformationsfreiheitLudwig-Erhard-Straße 2220459 HamburgGermany

datenschutz-hamburg.de

Automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not carry out profiling.

SSL/TLS encryption

This website is only transmitted in encrypted form via HTTPS. You can recognise this by “https://” in the address bar and the padlock icon in your browser.

Changes

We will update this privacy policy before features such as user accounts, mailbox connections (Microsoft 365, Gmail), Trello or Slack, or AI-based task recognition go live.