Privacy Policy

1. Information We Collect

We collect the following categories of information, most of which you or your organization provide directly.

Account and identity information

• Your name, email address, and password. Passwords are stored only in hashed form using industry-standard algorithms; we never store your plaintext password.
• An optional profile image.
• If you sign in with Google, we receive your basic Google profile information (name, email, profile image) and OAuth tokens used to authenticate you.

Optional profile details

• Phone number.
• Date of birth.
• Mailing address (street, city, state or province, postal code, and country).

Organization and workspace data

• Organization name, identifier, business address, and logo.
• Your role and membership within an organization.
• Settings and preferences such as timezone, reminder and display preferences, default views, and sort order.

Time and work data

• Time entries, including dates, durations, start and end times, descriptions of work performed, and whether the time is billable.
• Projects and tasks, including names, descriptions, budgets, status, and color labels.
• Project membership and the pay and charge rates associated with your work on a project.

Client and contact data

Organization users may enter information about their clients and client contacts, including names, email addresses, company names, phone numbers, job titles, addresses, and billing rates. If you provide such information, you are responsible for having the right to do so.

Invoicing and financial data

• Contractor and client invoices, including hours, amounts, rates, status, and approval or payment timestamps.
• Invoice line items, including work summaries that may be generated automatically (see “Automated Work Summaries” below).

Technical and usage data

• Session information, including IP address, browser user agent, session tokens, and related timestamps.
• Cookies used to keep you signed in and to remember interface preferences (see “Cookies” below).
• Operational logs generated when scheduled system jobs run.

Communications

• Feedback you submit through the Service, including your name, email address, your message, and the page you were on.
• Records of transactional emails we send to you and related delivery metadata.

We do not use third-party advertising networks or analytics trackers, and we do not collect special categories of data for advertising purposes.

2. How We Use Your Information

We use personal information to:

• Provide, operate, and maintain the Service, including time tracking, project and client management, and invoicing.
• Create and authenticate your account, keep you signed in, and secure the Service against fraud and abuse.
• Send transactional emails such as verification codes, password reset codes, organization invites, time submission reminders, and invoice notifications.
• Generate work summaries for invoices and exports using automated tools (see “Automated Work Summaries” below).
• Send reminders and notifications according to your settings.
• Respond to your feedback, support requests, and inquiries.
• Monitor, debug, and improve the Service.
• Comply with legal obligations and enforce our Terms of Service.

3. Automated Work Summaries

When you generate an invoice or export, the Service can produce a written summary of work performed. To do this, time entry descriptions, along with project or contractor names, are sent to Google’s Generative AI (Gemini) service, which returns a summary.

This processing occurs only when a summary is requested. We do not use these summaries or your underlying data to train our own models, and the data is processed under Google’s applicable terms for its generative AI services. You should review any generated summary before sharing it.

4. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Performance of a contract: to provide the Service you or your organization have signed up for.
• Legitimate interests: to secure, maintain, and improve the Service, and to communicate with you, provided these interests are not overridden by your rights.
• Consent: where you provide optional information or where consent is otherwise required; you may withdraw consent at any time.
• Legal obligation: where we must process information to comply with applicable law.

5. How We Share Your Information

We do not sell your personal information. We share information only as described below.

Within your organization

Information you enter is visible to authorized members of your organization according to their role. For example, organization administrators can view time entries, projects, invoices, and member rates relevant to the organization.

Service providers (subprocessors)

• Google Cloud / Firebase App Hosting: hosting of the application and database, located in the United States.
• Google (Sign in with Google): authentication, when you choose to sign in with Google.
• Google Generative AI (Gemini): generation of invoice and export work summaries, as described above.
• Resend: delivery of transactional emails.
• Linear: routing and tracking of feedback you submit through the Service.

Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of DataThink, our users, or others.

Business transfers

If DataThink is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

6. Cookies and Similar Technologies

We use a small number of cookies and similar browser storage technologies, all of which are necessary for the Service to function or to remember your preferences:

• Essential authentication cookies set when you sign in, which keep you logged in across keephours.com and your organization’s subdomain. These are HttpOnly cookies.
• Functional preferences, such as the open or collapsed state of the sidebar and your selected theme.

We do not use cookies for advertising or cross-site tracking. Because our cookies are strictly necessary or functional, the Service may not work properly if you block them.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service.

When you delete your account, we deactivate it, anonymize your email address, and remove your sign-in credentials and active sessions. Certain records, such as time entries and invoices, may be retained in anonymized or pseudonymized form where necessary for legitimate business, accounting, tax, audit, or legal purposes, including for the organizations you worked with. Session records expire automatically over time.

8. Data Security

We take reasonable measures to protect your information, including encryption of data in transit, hashing of passwords, HttpOnly session cookies, role-based access controls, and organization-scoped data access. We host the Service on Google Cloud infrastructure.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

9. Your Privacy Rights

You can access and update much of your information directly through your profile and settings, and you can delete your account from the settings page. You may also contact us to exercise your rights.

EEA and UK (GDPR)

If you are in the EEA or UK, you have the right to access, correct, delete, restrict, or object to the processing of your personal information, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, the right to request deletion or correction of your personal information, and the right not to be discriminated against for exercising your rights. We do not sell your personal information and we do not share it for cross-context behavioral advertising. You may use an authorized agent to submit a request on your behalf.

To exercise any of these rights, contact us using the details below. We will verify your request and respond within the timeframes required by applicable law. Note that for information entered by an organization, we may direct your request to that organization as the controller of that data.

10. International Data Transfers

We are based in the United States and process and store information there. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for international transfers.

11. Children’s Privacy

The Service is intended for use by businesses and adults. It is not directed to children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If we make material changes, we will provide additional notice as required by law. Your continued use of the Service after an update means you accept the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

glenne@datathink.dev
DataThink LLC