Privacy Policy

This Privacy Policy explains how Clockspot, Inc. ("Clockspot," "we," "us") collects, uses, shares, and protects your information when you use our time tracking platform (the "Service").

Key points:

• Employers control their workspaces. We never sell personal data.
• We collect only what's needed to provide the service.
• GPS is event-based — we record location at clock-in/out, never continuously.
• You can request access to, correction of, export of, or deletion of your personal data.
• We don't use your data for advertising.

Clockspot is operated by Clockspot, Inc.. For privacy questions, contact us.

Our role: The employer decides why and how employee time and workforce data is used. For that processing, the employer is the data controller and Clockspot is the data processor. Clockspot is the data controller for information we use to manage accounts and billing, secure and improve the Service, understand product usage, and provide support.

Account data: Name, email address, company name, and billing information when you sign up.

Employee profile data: Name, email, job assignments, hire date, employer-assigned payroll identifier, and pay rate — as provided by your employer's administrator.

Time tracking data: Clock-in and clock-out times, hours worked, breaks, job assignments, notes, and work checklist answers.

Workforce records: Employee schedules, time-off requests and balances, timesheet approvals, edit requests, invitation status, compensation history, qualifications and licenses, mileage trips, shift handoff notes and their photos, and job labor budgets when your employer configures those features.

Workspace configuration and content: Jobs, Work Sites, clocking approvals, kiosk settings, report and scheduled-export settings, notification preferences, and other settings configured by the Owner.

Connected-service data: When an authorized administrator connects a third-party service, we process encrypted authorization credentials, provider company and record identifiers, selectable provider records, administrator-approved mappings, export history, and provider diagnostics needed to operate and support that connection.

QuickBooks Online data: For a QuickBooks Online connection, Clockspot retains the QuickBooks company identity and time-tracking settings; names, email addresses, statuses, and identifiers for employees and vendors; and names, statuses, and identifiers for services, customers or projects, Classes, and Locations. We use these fields to suggest mappings, check whether QuickBooks records can accept time, and transfer approved hours. QuickBooks may include additional fields in its accounting API responses; Clockspot extracts and retains only the fields listed here. The connection uses QuickBooks accounting access only. When Clockspot's optional QuickBooks Payroll pay-type matching is enabled, Clockspot also retains active employee pay-type names, identifiers, and category metadata, and that payroll request asks only for active pay-type references, never pay rates, contribution amounts, paycheck details, or tax calculations.

Location data (optional): GPS coordinates recorded at the moment of a clock event (clock-in, clock-out, break start/end). This is only collected when the employer enables GPS features AND the employee grants device-level location permission. We do not track routes, continuous movement, or off-duty location.

Clock verification data: When the related features are used, kiosk photos captured at clock events, voice recordings captured after phone clock events, caller ID and call identifiers used for phone clocking, and a persistent browser-device identifier used to recognize approved browsers.

Device and usage data: Browser type, operating system, IP address, pages visited, feature usage, and anonymous and session analytics identifiers. Collected automatically to maintain and improve the service.

Payment data: Processed by our payment provider. We do not store full credit card numbers on our servers.

Communications: Support tickets, emails, and feedback you send us.

SMS data: Phone numbers, phone verification status, SMS notification preferences, message delivery records, and opt-out or help requests when you use SMS features.

Directly from you: When you create an account, clock in/out, submit time entries, or contact support.

From your employer: When an administrator adds your profile to a workspace, configures jobs, or sets up employee records.

Automatically: When you use the Service, we collect device and usage data through cookies and similar technologies.

We use your data to:

• Provide the service: Process clock events, generate timesheets, calculate hours, and run reports
• Send notifications: Timesheet reminders, approval requests, and account alerts via email, SMS, and optional WhatsApp messages
• Process payments: Bill your account and manage subscriptions
• Provide support: Respond to your questions and resolve issues
• Provide connected services: Fulfill requests from assistants and other integrations that an authorized workspace member connects to Clockspot, limited to the permissions granted to that connection
• Improve the product: Analyze usage patterns to fix bugs and build better features
• Comply with law: Respond to legal requirements, enforce our terms, and protect rights

We do not use your data for advertising, profiling, or automated decision-making that affects your employment.

If you are in the European Economic Area, we process your data under these legal bases:

• Contract performance: Processing time entries, generating reports, and providing the service you signed up for
• Legitimate interest: Product improvement, security, and fraud prevention
• Legal obligation: Tax record-keeping, responding to lawful requests
• Consent: Optional features like GPS tracking and marketing communications (you can withdraw consent at any time)

Clockspot may send transactional SMS messages when you verify a phone number or turn on SMS notifications for selected events, such as timesheet approvals, edit requests, time off requests, and account or workspace alerts.

SMS notifications are optional. You opt in by verifying your phone number and enabling SMS in Notification Preferences. Message frequency varies. Message and data rates may apply. You can reply STOP to cancel SMS messages or HELP for help.

We use SMS service providers only to deliver Clockspot messages, process delivery status, and handle opt-out or help requests. We do not sell, rent, or share mobile opt-in data or SMS consent with third parties or affiliates for their marketing or promotional purposes.

When you use Assistant, we process and retain your questions, replies, the workspace records needed to answer, activity records, and proposed changes and their outcomes. AI service providers process requests and relevant workspace context to produce responses, limited by your current Clockspot permissions.

Any member can connect a WhatsApp account for supported notifications. Notification permission and Assistant reply permission are separate. Notification Preferences controls which supported events are delivered on WhatsApp. Assistant replies are available only to eligible members and never expand their Clockspot permissions.

Connecting WhatsApp is optional and requires sender verification and confirmation while signed in to Clockspot. We process your WhatsApp sender identifier, connection and consent records, message content, and delivery information. Meta processes messages, including workspace information contained in replies, and related account and delivery information under its own terms and privacy policies. Proposed changes require review and approval while signed in to Clockspot. Replying in WhatsApp does not approve them.

You can disconnect WhatsApp in My Profile. Sending STOP to the connected Clockspot number turns off WhatsApp notifications and keeps the connection. Disconnecting stops future messaging. It does not erase saved conversations, consent and delivery records, or copies already held by WhatsApp or recipients. Clockspot's records follow the retention and deletion rules below. To request deletion, follow the Your Rights section. Do not send sensitive personal information that is unnecessary for your request.

We share data with the following categories of third parties, solely to provide the Service:

• Cloud infrastructure: Hosting and database services
• Email, SMS, and WhatsApp: For notifications and communications
• Payment processing: For subscription billing
• Analytics: To understand usage patterns and improve the product
• Error tracking: To detect and fix bugs
• User-authorized connected services: When an authorized workspace member connects Clockspot to an assistant or another integration, we provide that service with the Clockspot data needed to fulfill the member's requests, limited to the permissions granted to the connection. The connected service processes that data under its own privacy policy. Connection access can be revoked.
• Intuit QuickBooks Online: When a workspace administrator enables the connection, Clockspot sends the approved work date, duration, description, employee or vendor, service, billable and taxable settings, and any selected customer or project, Class, or Location. When Clockspot's optional QuickBooks Payroll pay-type matching is enabled, the record also carries the matched employee pay-type reference. It does not create paychecks or send pay rates, contribution amounts, or tax calculations. Intuit processes the exported data under its own privacy terms.

We do not:

• Sell personal data to anyone
• Share data with advertisers
• Share mobile opt-in data or SMS consent with third parties or affiliates for marketing or promotional purposes
• Use employee time data for any purpose other than providing the service to their employer

We may disclose data when required by law, court order, or government request. We may also share data in connection with a merger, acquisition, or sale of assets — in which case we will notify you in advance.

Clockspot offers optional GPS verification. Here is exactly what we do and don't do:

What we collect:

• GPS coordinates at the moment of a clock event (clock-in, clock-out, break start, break end)
• Approximate accuracy of the GPS reading
• Timestamp of the reading

What we don't collect:

• Continuous location or movement tracking
• Routes or travel paths between locations
• Off-duty location data
• Location when the app is in the background

Two setup steps:

1. The employer must enable GPS features for their workspace (it is off by default)
2. The employee must grant device-level location permission when clocking in

Employees can revoke device location permission at any time through their device settings. Without permission, Clockspot records the event without GPS data unless the employer has chosen to block unverified clock-ins and none of the applicable web clocking approvals matches. In that case, Clockspot refuses the clock-in. Clock-out remains available.

Retention: Location data is retained as long as your account is active and for a reasonable period after, aligned with applicable record-keeping requirements.

For employers (workspace administrators):

• You are the data controller for your employees' data. Clockspot processes it on your behalf.
• You decide what data to collect by choosing which Clockspot features to enable and configure.
• You are responsible for having a legal basis to collect data from your employees and for complying with applicable privacy and labor laws.

For employees:

• Your employer has engaged Clockspot to track time on their behalf.
• Your employer controls what data is collected and how it is used.
• You can view your own time data through the Service.
• For data access, correction, or deletion requests, contact your employer first. If your employer is unresponsive, contact us.

We retain data for as long as your account is active and for a reasonable period after, based on the type of data and applicable legal requirements:

• Time records: Retained to meet federal and state record-keeping requirements (e.g., FLSA, IRS)
• GPS/location data: Retained to support applicable wage dispute and compliance timelines
• Account and profile data: Duration of your account. You can export your personal data by making a request as described below.
• Payment records: As required by tax law and our payment processor
• Usage and analytics data: Retained for product improvement, periodically purged
• Support communications: Retained for quality and reference
• Connected services: Authorization credentials are removed when the connection is disconnected. For QuickBooks Online, Clockspot also ends its authorization with Intuit and clears its cached QuickBooks employee, vendor, accounting, and pay-type catalog. Company-specific mappings and export audit records may be retained with the workspace so administrators can reconcile prior exports and safely restore setup after reconnecting. A workspace administrator may request their deletion, subject to applicable legal record-keeping requirements.

You may request deletion of your data by contacting us. Deletion requests are subject to applicable legal record-keeping requirements. Aggregated, de-identified data may be retained indefinitely.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate data
• Deletion: Request that we delete your personal data
• Export: Request your data in a portable, machine-readable format
• Restriction: Request that we limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, withdraw it at any time

CCPA/CPRA rights (California residents): You have the right to know what data we collect, request deletion, request correction, and opt out of the sale of personal data. We do not sell personal data.

To exercise any of these rights, contact us. We will respond within the time required by applicable law. For employees, please contact your employer first, as they are the data controller.

Clockspot's servers and data are located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S.

We protect your data with:

• Encryption in transit (TLS) and at rest (AES-256)
• Access-level and permission controls
• Regular security assessments and code reviews
• Logging and monitoring for suspicious activity
• Incident response procedures

No system is 100% secure. If we discover a data breach that affects your personal data, we will notify you and applicable authorities as required by law.

We use the following types of cookies:

• Strictly necessary: Session and authentication cookies required for the Service to function. These cannot be disabled.
• Functional: Preference cookies that remember your settings (e.g., sidebar state, theme).
• Analytics: Usage tracking to understand how the Service is used and where to improve.

We do not use marketing or advertising cookies.

EU visitors: Non-essential cookies require your consent before activation.

Global Privacy Control: We honor GPC signals from your browser. If your browser sends a GPC signal, we treat it as an opt-out of non-essential cookies.

Clockspot is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Categories of personal information collected in the last 12 months:

• Identifiers (name, email, employer-assigned payroll identifier, IP address, caller ID, and browser-device identifiers)
• Professional information (employer, role, department, and hire date)
• Geolocation data (GPS coordinates at clock events, if enabled)
• Internet activity (usage data, feature interactions)
• Commercial information (subscription and billing data)
• Audio, electronic, and visual information (kiosk photos and phone voice recordings, when used)

Categories of personal information sold: None. We do not sell personal information.

Categories of personal information shared for cross-context behavioral advertising: None.

You have the right to request access, deletion, and correction of your data, and to opt out of the sale of personal information (which we do not engage in). To make a request, contact us. We will not discriminate against you for exercising your rights.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If applicable law requires additional notice, we will provide it.