Privacy Policy

We act in two roles, depending on the type of data:

• Data about our customers and website visitors, such as the Account Admin's registration details, billing details and support correspondence: for this data, we are the controller.
• Data that a business (the employer) enters into the Service about its employees and Users: for this data, the business is the controller, and we process it solely on its behalf as a processor.

If you are an employee whose employer uses KronosTeam, your employer decides what data about you is collected and why. Please direct requests to access, correct or delete your data to your employer first. We will help your employer handle them.

Registration and account data: business name, full name, email address, phone number and password (stored as a one-way hash that we cannot read). If you sign up with Google or Apple, we receive your name, email address and profile picture from them.

Data the Customer enters about employees and Users, depending on how it uses the Service:

• Identifiers and contact details: name, email, phone, national ID number, date of birth, address and city.
• Employment details: role, department, manager, hourly rate, contracts and goals.
• Attendance: clock-in and clock-out times, shifts, absences and their reasons, and attachments such as medical certificates.
• Location: if the Customer enabled the location-based time clock, GPS coordinates and an address are stored when attendance is reported. Location is stored only at the moment of reporting. We do not track location continuously.
• Work content: tasks, boards, messages, updates and support tickets.
• Automated outputs: estimated hours and payroll calculations, and statistical indicators such as a burnout score, computed from attendance data.

Integration data: if a User chooses to connect a Google or Microsoft account, we receive access to calendar data, and read-only access to email message details. Access is limited to the scope of permissions the User explicitly approved, and is used solely to display that data in the Service.

Technical and security data: IP address, browser and device type, login attempts, audit logs, page views and usage data.

Payment data: payments are processed by Paddle. Credit card numbers never reach us and are not stored by us. From Paddle we receive only a customer ID, a subscription ID, the subscription status and invoice details.

Consent records: when you accept the Terms and this policy, we store the time of acceptance, the document version, your IP address and your browser type. This is kept as evidence of consent.

• To provide, operate and maintain the Service, including accounts, shifts and attendance.
• To verify identity, secure the Service, and prevent fraud and abuse.
• To manage subscriptions, billing and invoices, through Paddle.
• To send service messages, such as verification, password reset, notifications and material updates.
• To provide support and handle requests.
• To improve the Service through aggregated statistical analysis.
• To comply with the law, protect our rights and manage legal proceedings.
• To send marketing emails, only if you opted in. You may withdraw consent at any time.

Where the GDPR applies, our legal basis for processing is one of the following: performance of a contract, legitimate interests (security and service improvement), legal obligation, or consent (marketing).

We do not make decisions with legal or similarly significant effects on any individual based solely on automated processing. The indicators and calculations in the Service are aids for the employer. Decisions remain with a human.

KronosTeam's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use this data for advertising, we do not sell it, and we do not use it to train generalized AI models. We allow humans to read it only with the User's consent, for security purposes, or where required by law. You may revoke access at any time in your Google account settings.

We do not sell or rent personal information. We share it only in these cases:

• With service providers acting on our behalf under confidentiality and security obligations: cloud hosting and infrastructure (Vercel), managed database services, email delivery (Resend), and payment processing (Paddle).
• With the sign-in and integration providers the User chose (Google, Apple, Microsoft).
• Within the Customer's account: Account Admins can see data about the Users in their account, according to the permissions they set.
• With competent authorities, where required by law or court order.
• Where necessary to protect our rights, the safety of Users, or the Service.
• As part of a merger, acquisition or sale of the business. In that case, the acquirer will be bound by this policy.

Data may be stored and processed on servers outside Israel, including in the European Union and the United States. Transfers are made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001. They are subject to contractual commitments by the providers to protect the data, including the EU Standard Contractual Clauses where required.

We take reasonable, industry-standard security measures, in line with data security regulations. These include encryption in transit (HTTPS/TLS), encryption of sensitive fields such as phone numbers and the two-factor secret, password hashing, two-factor authentication, login rate limiting, role-based permissions and audit logs.

No system is completely secure, and we cannot guarantee absolute security. If a serious security incident occurs, we will act and report it as required by law, including to the Privacy Protection Authority and to affected customers.

• Account data and Customer Data: for as long as the Subscription is active, plus 30 days after it ends, to allow export. It is then deleted, and removed from backups within no more than 90 additional days.
• Consent records, billing data and security logs: up to 7 years, to comply with the law, keep accounting records and defend against claims.
• Login attempts and technical usage data: for as long as needed for security and analytics, generally no more than 24 months.

Subject to applicable law, you have the right:

• To access the data held about you (section 13 of the Protection of Privacy Law).
• To request correction of data that is inaccurate, incomplete, unclear or outdated, or to request its deletion (section 14 of that Law).
• To ask to be removed from direct marketing lists at any time.
• Where the GDPR applies: to request restriction of processing, object to processing, request data portability, and withdraw consent.
• To lodge a complaint with the Israeli Privacy Protection Authority, or with the supervisory authority in your country.

For privacy requests, contact aviel.nachmias@gmail.com. We will respond within 30 days. We may need to verify your identity before handling the request. Requests about data entered by an employer will be forwarded to that employer.

We use essential cookies required for sign-in, security, and saving preferences such as language. Without them, the Service cannot work.

We use other cookies, such as analytics cookies, according to your choice in the cookie notice. You can also block cookies in your browser settings, but parts of the Service may not work properly.

The Service is not intended for anyone under 18, and we do not knowingly collect data directly from them. If an employer enters data about an employee who is a minor, the employer alone is responsible for complying with the applicable law.

We may update this policy. We will give notice of material changes on the website or by email, and ask you to accept the updated policy before you continue using the Service. The date of the last update appears at the top of this page.

For any question about this policy or about how your data is handled: aviel.nachmias@gmail.com.