Privacy policy

1. Who we are

The controller is Aleksandr Ulanov, Gran Via de les Germanies 29, 46006 Valencia, Spain (details in the Imprint). Privacy questions: hello@clockaroo.com.

We have not appointed a data protection officer, as the law does not require one for our processing.

2. Our two roles

• Controller: for visitors of this website and the free tools, for the accounts of the people who sign in, and for billing contacts, support emails and our own logs. This policy covers that data.
• Processor: for everything a customer stores in a workspace: the team's names and time entries, expenses and the receipt images or files they upload, clients and their contacts, invoices and their files, invoices and emails received through the invoice inbox (section 16), calendar events that team members connect, and data imported from other tools. The customer (the business that owns the workspace) is the controller for this data and decides what happens to it. Our data processing agreement governs this processing. If you are a client, supplier, team member or adviser of one of our customers, please contact that business first; we pass requests on to them.

3. Principles

• We show no ads and do not sell personal data.
• We collect only what the service needs.
• Workspace data is stored on our server at netcup GmbH in Nuremberg, Germany.

4. This website and the free tools

• Server logs: our web server records the IP address, time, requested page and browser type for security and troubleshooting. They are kept for at most 14 days. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
• E-invoice creator: when you download a file, the form goes to our server only to create and validate the file. Nothing is stored. When you choose "save in a free account", the checked form (seller, client, bank and invoice data) is stored for up to 24 hours, linked to a random token that is kept only in your session cookie (our database holds only a hash of it). When you import or discard it, the form data is deleted at once; whatever is left is deleted after 24 hours. After the import the data is part of your account like any other settings, client or draft.
• E-invoice checker: a file you upload is checked and the result is shown to you. XRechnung files are checked with the official KoSIT validator, ZUGFeRD files with the open-source validators Mustang and veraPDF. All checks run on our own server. The file is processed only for that request and deleted right away; we do not keep a copy.
• Visitor statistics: on the public pages of this website (not in the app) we count visits with Umami, an open-source statistics tool that we run on our own server at Hetzner Online GmbH in Germany. It sets no cookies and stores no IP address: your IP address is used only to work out your country and an anonymous visit ID, then discarded. We record the page address without its query parameters, the page you came from, your browser and device type, screen size and country. On most public pages we also record where visitors click and how far they scroll (heatmaps), with everything typed into form fields hidden; we don't do this on the free tools, the sign-up form or the login. The data stays on our server and is not shared with anyone. We keep it for at most 24 months. Legal basis: our legitimate interest in knowing which pages help visitors (Art. 6(1)(f) GDPR).
• How you found us: we set no cookie for this. The sign-up links on our pages carry the campaign tags (UTM parameters) of the page you came from. Only if you sign up do we record where you came from, as part of the sign-up data (section 5).

Legal basis for the free tools: you ask us to create or check a file, so we process it to provide that service (Art. 6(1)(b) GDPR).

5. Accounts and the app

• Your account: name, email address, a hash of your password (never the password itself), language, time zone and when you confirmed your email address.
• Sign-in: for each signed-in device we store a session with its IP address and browser type, so you stay signed in and we can detect misuse. The sign-in cookie stays until you sign out; our server ends a session after 30 days without use. Signing out removes the session.
• Workspaces and roles: which workspaces you belong to and your role (owner, member or adviser). If a workspace owner invites you, we receive your email address from them (Art. 14 GDPR). For the invitation we store only that email address and the language of the invitation email, and use them to send the invitation.
• Adviser access: if a workspace owner invites you as their tax adviser or bookkeeper, we receive your email address from them (Art. 14 GDPR). We store when your access was granted and ended, who granted and ended it, and when you last used it (updated at most once an hour). You see that workspace's issued invoices and credit notes with their files, its expenses by month with their receipts (without who spent them; the original files as downloads), its reports by client and project, and its exports; you do not see drafts, time entries, the team or its settings. Your downloads, exports and changes to the DATEV settings are recorded in that workspace's audit log, which its owners can read. The adviser area requires two-factor authentication and asks for your password again after 12 hours. An owner can end your access at any time; this also ends your sign-in sessions, and we tell you by email.
• Calendar link: if you add the link of your own calendar (ICS) to see your meetings next to your time, our server fetches it about every 30 minutes and stores the title, start and end of each event from the last 45 days up to tomorrow. We don't store attendees, descriptions, locations or links. Events older than 45 days are deleted. We also remember the project you chose for a recurring meeting until it has gone unused for 12 months. The link is stored encrypted and never shown again. Only you see your events; the workspace owners don't. If you remove the link or leave the workspace, or an owner turns calendar import off, the stored events are deleted. Your calendar provider only sees that our server fetches the link.
• Plan and trial: your workspace's plan, trial dates and price-lock date, and the emails we send about them (for example, the trial reminders).
• Sign-up source: when you sign up, we store how you came to us (the free tool, template or page whose sign-up link you used, an invitation, an adviser invitation, or direct) together with the UTM values from the sign-up link, the host name of the referring website (not the full address) and the page where you arrived. We record these only at sign-up, as part of the sign-up data, and nothing before. We use this to see which pages and tools bring customers. When you close your account, the page, host name and UTM values are cleared; only the source category stays.
• Security records: limits on repeated sign-in and sign-up attempts, and the workspace's audit log (who changed what and when). The audit log is part of the workspace's records (section 2) and cannot be edited. The sign-up and password reset forms and, after several failed attempts, the login form use Cloudflare Turnstile, a check against automated access (section 9). For the sign-in limit we count failed attempts per email address (stored only as a hash) and per IP address for 15 minutes.

Legal bases: performance of our contract with you or the business you work for (Art. 6(1)(b) GDPR) for the account, sign-in, workspaces, adviser access and plan emails; our legitimate interest in a secure service and in understanding where our customers come from (Art. 6(1)(f) GDPR) for security records and the signup source. You need an account to use the app; without the account data we cannot provide it.

6. Payments through Paddle

Paid plans are sold by our reseller Paddle (Paddle.com Market Ltd, United Kingdom; for buyers in the USA, Paddle.com Inc.), which acts as merchant of record. Paddle collects payment details, billing name and address, VAT ID and purchase history, issues the invoices and handles taxes and refunds. Paddle is an independent controller for this data under its own privacy notice. We never see your full card details. Paddle tells us which plan and how many people you pay for, the billing period, the subscription status and Paddle's customer and subscription numbers, so we can apply your plan. We keep Paddle's notifications about your subscription as our accounting records. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

7. Emails

We send account emails (email confirmation, password reset, invitations, trial and plan notices) and, on our customers' instructions, their invoice emails with the PDF and XML files attached. These emails are delivered by Resend (Resend, Inc., USA). Resend sends from its EU region in Ireland but stores email data in the USA (section 9). We send no newsletters. If we start one, we will only send it with your consent, and every issue will have an unsubscribe link.

8. Founder alerts and our admin area

• Founder alerts: when someone signs up, sends the first invoice from their workspace, clicks through to checkout, becomes a paying customer, starts a Harvest import or accepts an invitation as an adviser, the founder receives an email with the person's name, email address and its domain, the signup source with UTM values and the workspace name (for the first invoice sent, also its invoice number). This lets us know who signs up and answer personally. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). The emails are kept in the founder's inbox and deleted after 12 months.
• Admin area: only the founder has access to our internal admin area, which is protected by a password and a second factor. It shows account counts by signup source, country and language, how many accounts reached each step (first time entry, first invoice issued and sent, paid plan), and the recent signups with their email addresses and signup source. Every admin sign-in, failed attempt, lockout and change to the second factor is written to a log that cannot be edited, with the admin's email address and IP address. Kept for 2 years.

9. Recipients and processors

We use these service providers. Those that process data for us as our processors do so under a data processing agreement. Google provides the mailbox our support addresses forward to under its own terms.

Provider	Purpose	Location	Transfer safeguard
netcup GmbH, Karlsruhe, Germany	Server, database and stored files for the website and the app	Nuremberg, Germany	None needed (EU)
Hetzner Online GmbH, Gunzenhausen, Germany	Server for our visitor statistics (Umami, section 4)	Germany	None needed (EU)
Cloudflare, Inc.	DNS, content delivery, encryption of connections and protection against attacks; sees requests in transit; receives the emails sent to invoice inboxes and passes them to our server (section 16); the Turnstile security check on the sign-up and password reset forms and, after several failed attempts, the login form, which processes your IP address and technical information about your browser and device to tell people from automated programs	USA, global network	EU-US Data Privacy Framework; EU standard contractual clauses 2021/914 (section 10)
Resend, Inc.	Delivery of account and invoice emails	Sends from Ireland, stores data in the USA	EU standard contractual clauses 2021/914 (section 10); EU-US Data Privacy Framework
Cloudflare, Inc. (R2 storage)	Encrypted backups, always stored off-site, away from the main server; a temporary buffer for invoice inbox emails while our server cannot be reached, for at most 7 days	EU (storage restricted to the EU)	Stored in the EU; for Cloudflare, Inc. see above
Google LLC (Gmail)	The mailbox our support and privacy addresses forward to (through Cloudflare Email Routing, which does not store the content of emails); it receives the emails you send us	USA	EU-US Data Privacy Framework
European Commission (VIES, independent controller)	Checks the VAT ID of an EU business client in another EU country for reverse-charge invoices; receives that VAT ID and, as the requester, your own VAT ID, and forwards the query to the tax authority of the client's country	EU	None needed (EU)
Paddle (independent controller, section 6)	Sale, payment, invoices, taxes and refunds for paid plans	United Kingdom; USA for US buyers	UK: EU adequacy decision; USA: EU standard contractual clauses 2021/914, controller to controller (Paddle's data sharing addendum)

We do not use an error tracking service at present. The sub-processors for workspace data are listed in the data processing agreement.

10. International transfers

Cloudflare, Resend and Google are US companies. Transfers to them rely on the EU-US Data Privacy Framework, for which the European Commission found an adequate level of protection for participating companies. For Cloudflare and Resend they also rely on the Commission's standard contractual clauses for transfers to third countries (Implementing Decision (EU) 2021/914): Module 2 (controller to processor) for the data we are responsible for, and Module 3 (processor to sub-processor) for workspace data we process for our customers (see the data processing agreement). Transfers to the United Kingdom rely on the Commission's adequacy decision for the UK; data we share with Paddle is covered by the standard contractual clauses (controller to controller) in Paddle's data sharing addendum. You can ask us for a copy of the safeguards.

11. Data we store about your clients and team

If you use Clockaroo for your business, you are the controller for the data in your workspace (section 2). You decide what to store and how long to keep it; you can export it at any time. Our data processing agreement applies.

12. How long we keep data

Data	Kept for
Account data	As long as the account exists; when it is closed, it is anonymised or deleted (section 13)
Sign-in sessions	Until you sign out or close the account; ended by our server after 30 days without use
Adviser access (when granted and ended, last use)	As long as the workspace exists, as part of its records
Sign-up source	As long as the account exists; on closure only the source category stays
Creator form saved for a free account	Until imported or discarded, at most 24 hours
Files uploaded to the checker	Deleted right after the check
Workspace exports (ZIP files)	Deleted 7 days after they are created
Harvest access token	Only while the import runs (section 14)
Calendar events from a calendar link	45 days (section 5)
Calendar link	Until you remove it, leave the workspace or close your account
Invoices received in the invoice inbox, with their files, email details and check report	10 years after the end of the year they were received (section 16)
Inbox messages without invoice files, dismissed invoices, original emails	30 days (section 16)
Server logs	14 days
Founder alert emails	12 months
Admin sign-in log	2 years
Support emails	2 years after the last message
Backups (encrypted, stored off-site)	30 days
Invoices and booking records in a workspace	See below

Legal retention. Tax and commercial law requires businesses to keep invoices and booking records for 8 to 10 years (for example § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB); 7 years in Austria, 6 in the UK and Ireland). GDPR Art. 17(3)(b) allows keeping data needed to meet such a legal obligation. So, unless the workspace owner chooses to have everything deleted (section 13), we keep the following for 10 years after the end of the year an invoice was issued, even after an account or workspace is closed:

• the frozen invoice data and the issued files (PDF and XML), including the seller and buyer data printed on them;
• the records of sent invoices, including the recipient address;
• the history of changes to the seller settings (address, VAT ID, bank details);
• time entries with their notes, invoiced or not, as the workspace's business records;
• expenses and their receipts, as the workspace's accounting records (deleted expenses go after 30 days);
• the seller details of a closed workspace.

The workspace owner, not us, decides about the workspace's own records within these rules. We delete a closed workspace with all its data once none of its invoices, quotes, expenses and received invoices is still within its retention period, but no earlier than 30 days after it was closed.

13. Closing your account

You can close your account at any time. If you own a workspace, you choose what happens to it when you end your account:

• Export, then delete everything: you download the full export and we delete the workspace with all its data. We carry out deletion requests within 30 days; deleted data disappears from the backups within 30 days.
• Keep the archive: the workspace stays as a read-only archive for your legal retention period (section 12); you can still view and export everything.

Where records stay (an archive you keep, or workspaces of others you worked in), we anonymise you instead of deleting them:

• your name is replaced with "Former member" and your email address with a random address, also on invitations sent to you;
• your password and all sessions are removed, so nobody can sign in to the account;
• a workspace you keep as an archive becomes read-only; if it still carried your name (the default at sign-up), it is renamed "Archived workspace", while the seller's legal name stays on the invoices;
• you leave every other workspace; its owner keeps the records you created there;
• if you are an adviser, your access to every workspace ends;
• if you are the last owner of a workspace, the access of its advisers ends and we tell them by email.

Entries in the audit log keep the name they were written with, because that log cannot be edited. An account that was never confirmed and holds no records is deleted completely.

14. Imports from Harvest

A workspace owner can import their own Harvest account with a Harvest access token. We store the token encrypted only while the import runs and delete it when the import ends. You can revoke the token in Harvest afterwards. The imported data (people's names and email addresses, their time entries and rates, clients and their contacts, invoices and payments) is processed on the owner's behalf, as for all workspace data (section 2). Imported people get no login and no email from us until the owner sends them an invitation.

15. API tokens and AI assistants

You can create personal access tokens for your own scripts and connect AI assistants (for example Claude or Cursor) to your account. We store only a fingerprint (hash) of each token, never the token itself, and record when and from which IP address it was last used. A script or an assistant you connect is a recipient you choose: it receives the workspace data your role and the token allow, and for what it does with that data, its provider's own terms apply. We send AI assistants no email addresses, postal addresses, tax IDs, bank details or rates. Workspace owners can see and revoke every token in their workspace, and can turn the API and AI assistants off. Tokens expire after at most a year and end when you reset your password, leave the workspace or close your account.

16. Invoice inbox

A workspace can receive invoices from its suppliers at its own email address, and invoice files can be uploaded to it. We process these invoices and emails for the business that owns the workspace, as its processor (section 2). If you are a supplier or a supplier's contact person, please contact the business you sent the invoice to.

• Who receives the mail: Cloudflare receives emails sent to an inbox address (Email Routing and an Email Worker) and passes them to our server in Nuremberg. If our server cannot be reached, Cloudflare keeps the email in a buffer in the EU (R2) for at most 7 days until our server collects it. The workspace's owners get a notice through Resend with the number of new invoices and a link, without supplier details.
• What we store: each invoice file exactly as received, with a fingerprint (SHA-256); the data read from it, such as the supplier's name, address, VAT and tax numbers, bank details and the amounts; the check report; and from the email the sender, subject, time of arrival and message text. The checks run on our own server. Only the workspace's owners, and members an owner gives access, see the inbox.
• How long: received invoices with their files, the email details and the check report are kept for 10 years after the end of the year they were received, also after the workspace is closed, unless the owner has the workspace deleted (section 13). Messages without invoice files are deleted after 30 days, dismissed invoices 30 days after they were dismissed. The original email file is deleted after 30 days, unless it carries a digital signature; then it is kept with the invoice.
• We never read received invoices or emails for our own purposes.

17. Cookies

We set only strictly necessary cookies, which the service needs to work. They need no consent (Art. 5(3) ePrivacy Directive, Art. 22.2 LSSI, § 25(2) TDDDG). We set no analytics, advertising, attribution or tracking cookies.

Cookie	Purpose	Duration
Session cookie	Protects forms against forgery and, when you choose "save in a free account" in the creator, holds the reference to the saved form	Until you close the browser
Sign-in cookie (session_id)	Keeps you signed in on this device	Until you sign out; our server ends the session after 30 days without use
Admin cookie (admin_session_id)	Keeps our own administrators signed in to the admin area	Until the admin session ends

Browser storage: the hours counter on our urencriterium page keeps the hours and notes you type in your browser's local storage on your device only. They are never sent to us. You can delete them in the counter itself or by clearing your browser data.

Because we do not track you across websites, we treat every visitor the same whether or not the browser sends a "Do Not Track" signal.

18. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Where we rely on your consent, you can withdraw it at any time without affecting earlier processing. Write to hello@clockaroo.com; we answer within one month.

You can complain to a data protection authority. Our lead authority is the Spanish Agencia Española de Protección de Datos (AEPD), www.aepd.es. You can also complain to the authority in the country where you live or work.

We make no decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

19. Changes

We will publish changes to this policy on this page and tell account holders about material changes by email before they take effect.