Privacy Policy

This Privacy Policy explains how Clockspot, Inc. ("Clockspot," "we," "us") collects, uses, shares, and protects your information when you use our time tracking platform (the "Service").

Key points:

• Employers control their workspaces. We never sell personal data.
• We collect only what's needed to provide the service.
• GPS is event-based — we record location at clock-in/out, never continuously.
• You can request access to, correction of, export of, or deletion of your personal data.
• We don't use your data for advertising.

Clockspot is operated by Clockspot, Inc.. For privacy questions, contact us.

Our role: The employer decides why and how employee time and workforce data is used. For that processing, the employer is the data controller and Clockspot is the data processor. Clockspot is the data controller for information we use to manage accounts and billing, secure and improve the Service, understand product usage, and provide support.

Account data: Name, email address, company name, and billing information when you sign up.

Employee profile data: Name, email, role, department, and pay rate — as provided by your employer's administrator.

Time tracking data: Clock-in and clock-out times, hours worked, breaks, job assignments, notes, and custom field entries.

Workforce records: Employee schedules, time-off requests and balances, timesheet approvals, edit requests, invitation status, and compensation history when your employer configures those features.

Workspace configuration and content: Jobs, clock locations and validation rules, kiosk settings, report and scheduled-export settings, notification preferences, and other settings configured by the workspace owner.

Location data (optional): GPS coordinates recorded at the moment of a clock event (clock-in, clock-out, break start/end). This is only collected when the employer enables GPS features AND the employee grants device-level location permission. We do not track routes, continuous movement, or off-duty location.

Clock verification data: When the related features are used, kiosk photos captured at clock events, voice recordings captured after phone clock events, caller ID and call identifiers used for phone clocking, and a persistent browser-device identifier used to recognize approved browsers.

Device and usage data: Browser type, operating system, IP address, pages visited, feature usage, and anonymous and session analytics identifiers. Collected automatically to maintain and improve the service.

Payment data: Processed by our payment provider. We do not store full credit card numbers on our servers.

Communications: Support tickets, emails, and feedback you send us.

SMS data: Phone numbers, phone verification status, SMS notification preferences, message delivery records, and opt-out or help requests when you use SMS features.

Directly from you: When you create an account, clock in/out, submit time entries, or contact support.

From your employer: When an administrator adds your profile to a workspace, configures jobs, or sets up employee records.

Automatically: When you use the Service, we collect device and usage data through cookies and similar technologies.

We use your data to:

• Provide the service: Process clock events, generate timesheets, calculate hours, and run reports
• Send notifications: Timesheet reminders, approval requests, and account alerts via email and SMS
• Process payments: Bill your account and manage subscriptions
• Provide support: Respond to your questions and resolve issues
• Provide connected services: Fulfill requests from assistants and other integrations that an authorized workspace member connects to Clockspot, limited to the permissions granted to that connection
• Improve the product: Analyze usage patterns to fix bugs and build better features
• Comply with law: Respond to legal requirements, enforce our terms, and protect rights

We do not use your data for advertising, profiling, or automated decision-making that affects your employment.

If you are in the European Economic Area, we process your data under these legal bases:

• Contract performance: Processing time entries, generating reports, and providing the service you signed up for
• Legitimate interest: Product improvement, security, and fraud prevention
• Legal obligation: Tax record-keeping, responding to lawful requests
• Consent: Optional features like GPS tracking and marketing communications (you can withdraw consent at any time)

Clockspot may send transactional SMS messages when you verify a phone number or turn on SMS notifications for selected events, such as timesheet approvals, edit requests, time off requests, and account or workspace alerts.

SMS notifications are optional. You opt in by verifying your phone number and enabling SMS in Notification Preferences. Message frequency varies. Message and data rates may apply. You can reply STOP to cancel SMS messages or HELP for help.

We use SMS service providers only to deliver Clockspot messages, process delivery status, and handle opt-out or help requests. We do not sell, rent, or share mobile opt-in data or SMS consent with third parties or affiliates for their marketing or promotional purposes.

We share data with the following categories of third parties, solely to provide the Service:

• Cloud infrastructure: Hosting and database services
• Payment processing: For subscription billing
• Email and SMS: For notifications and communications
• Analytics: To understand usage patterns and improve the product
• Error tracking: To detect and fix bugs
• User-authorized connected services: When an authorized workspace member connects Clockspot to an assistant or another integration, we provide that service with the Clockspot data needed to fulfill the member's requests, limited to the permissions granted to the connection. The connected service processes that data under its own privacy policy. Connection access can be revoked.

We do not:

• Sell personal data to anyone
• Share data with advertisers
• Share mobile opt-in data or SMS consent with third parties or affiliates for marketing or promotional purposes
• Use employee time data for any purpose other than providing the service to their employer

We may disclose data when required by law, court order, or government request. We may also share data in connection with a merger, acquisition, or sale of assets — in which case we will notify you in advance.

Clockspot offers optional GPS verification. Here is exactly what we do and don't do:

What we collect:

• GPS coordinates at the moment of a clock event (clock-in, clock-out, break start, break end)
• Approximate accuracy of the GPS reading
• Timestamp of the reading

What we don't collect:

• Continuous location or movement tracking
• Routes or travel paths between locations
• Off-duty location data
• Location when the app is in the background

Two setup steps:

1. The employer must enable GPS features for their workspace (it is off by default)
2. The employee must grant device-level location permission when clocking in

Employees can revoke device location permission at any time through their device settings. Without permission, Clockspot records the event without GPS data unless the employer has chosen to block unrecognized clock-ins and an applicable location rule cannot recognize the clock-in. In that case, Clockspot refuses the clock-in. Clock-out remains available.

Retention: Location data is retained as long as your account is active and for a reasonable period after, aligned with applicable record-keeping requirements.

For employers (workspace administrators):

• You are the data controller for your employees' data. Clockspot processes it on your behalf.
• You decide what data to collect (which features to enable, which custom fields to create).
• You are responsible for having a legal basis to collect data from your employees and for complying with applicable privacy and labor laws.

For employees:

• Your employer has engaged Clockspot to track time on their behalf.
• Your employer controls what data is collected and how it is used.
• You can view your own time data through the Service.
• For data access, correction, or deletion requests, contact your employer first. If your employer is unresponsive, contact us.

We retain data for as long as your account is active and for a reasonable period after, based on the type of data and applicable legal requirements:

• Time records: Retained to meet federal and state record-keeping requirements (e.g., FLSA, IRS)
• GPS/location data: Retained to support applicable wage dispute and compliance timelines
• Account and profile data: Duration of your account. You can export your personal data by making a request as described below.
• Payment records: As required by tax law and our payment processor
• Usage and analytics data: Retained for product improvement, periodically purged
• Support communications: Retained for quality and reference

You may request deletion of your data by contacting us. Deletion requests are subject to applicable legal record-keeping requirements. Aggregated, de-identified data may be retained indefinitely.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate data
• Deletion: Request that we delete your personal data
• Export: Request your data in a portable, machine-readable format
• Restriction: Request that we limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw it at any time

CCPA/CPRA rights (California residents): You have the right to know what data we collect, request deletion, request correction, and opt out of the sale of personal data. We do not sell personal data.

To exercise any of these rights, contact us. We will respond within the time required by applicable law. For employees, please contact your employer first, as they are the data controller.

Clockspot's servers and data are located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S.

We protect your data with:

• Encryption in transit (TLS) and at rest (AES-256)
• Role-based access controls
• Regular security assessments and code reviews
• Logging and monitoring for suspicious activity
• Incident response procedures

No system is 100% secure. If we discover a data breach that affects your personal data, we will notify you and applicable authorities as required by law.

We use the following types of cookies:

• Strictly necessary: Session and authentication cookies required for the Service to function. These cannot be disabled.
• Functional: Preference cookies that remember your settings (e.g., sidebar state, theme).
• Analytics: Usage tracking to understand how the Service is used and where to improve.

We do not use marketing or advertising cookies.

EU visitors: Non-essential cookies require your consent before activation.

Global Privacy Control: We honor GPC signals from your browser. If your browser sends a GPC signal, we treat it as an opt-out of non-essential cookies.

Clockspot is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Categories of personal information collected in the last 12 months:

• Identifiers (name, email, IP address, caller ID, and browser-device identifiers)
• Professional information (employer, role, department)
• Geolocation data (GPS coordinates at clock events, if enabled)
• Internet activity (usage data, feature interactions)
• Commercial information (subscription and billing data)
• Audio, electronic, and visual information (kiosk photos and phone voice recordings, when used)

Categories of personal information sold: None. We do not sell personal information.

Categories of personal information shared for cross-context behavioral advertising: None.

You have the right to request access, deletion, and correction of your data, and to opt out of the sale of personal information (which we do not engage in). To make a request, contact us. We will not discriminate against you for exercising your rights.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If applicable law requires additional notice, we will provide it.