1. Introduction
TimeFlov AB ("We") is the data controller for the personal data we process when you use our service. This privacy policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR).
2. Data We Collect
Account Data
First and last name, email address, role, company affiliation, profile picture (via OAuth provider).
Business Data
Time entries, expense reports, invoices, projects, clients, vendors, approval workflows, and accounting records you create in the Service.
Technical Data
IP address, browser type, device information, session data, and usage analytics to provide and improve the Service.
3. Purpose & Legal Basis
| Purpose | Legal Basis |
|---|---|
| Providing the Service | Contract (Art. 6.1.b) |
| Account management & authentication | Contract (Art. 6.1.b) |
| Billing & payment processing | Contract (Art. 6.1.b) |
| Improving the Service | Legitimate interest (Art. 6.1.f) |
| Legal obligations (accounting) | Legal obligation (Art. 6.1.c) |
4. Data Retention
We retain your personal data for as long as your account is active or as needed to fulfill the purpose of processing. Upon account deletion, your data is removed within 30 days, except for data we are legally required to retain (e.g., accounting records for 7 years).
5. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of Access — request a copy of your personal data.
- Right to Rectification — correct inaccurate or incomplete data.
- Right to Erasure — request deletion of your personal data.
- Right to Portability — receive your data in a machine-readable format.
- Right to Object — object to processing based on legitimate interest.
- Right to Restriction — restrict processing under certain circumstances.
To exercise your rights, contact us at privacy@timeflov.com.
6. Data Protection Officer
Our Data Protection Officer can be contacted at:
7. Cookies & Local Storage
We use session cookies for authentication (Supabase Auth) and localStorage for language preferences (i18nextLng) and UI preferences (theme, sidebar). We do not use third-party cookies for advertising or tracking.
8. Data Sharing & Transfers
We share your data with the following sub-processors: Supabase (database hosting, EU), Cloudflare (CDN/hosting), Stripe (payment processing), Resend (email delivery), Sentry (error reports, EU) and Anthropic (AI features, US). We do not transfer your data outside the EU/EEA without appropriate safeguards.
9. Google User Data
This section covers the data TimeFlov receives from Google when you sign in with Google or connect your Google Calendar. Both are your choice.
Sign in with Google
Google shares your name, email address and profile picture with us. We use your name and email address to create your account and sign you in, and your name to show your colleagues who recorded what. We do not use your profile picture.
Google Calendar
If you connect your Google Calendar in Settings, TimeFlov reads your own events for the week you have open on the Time page: the title, the start and end time, your reply to the invitation, and the recurring series an event belongs to. They are shown next to your timesheet, and you can add a meeting to it with one tap. We never change anything in your calendar.
We read your calendar each time you open a week and keep no copy of it. We store the email address of the connected Google account and an encrypted token that lets us read the calendar on your behalf. For each meeting you add or hide, we store its event id, the recurring series it belongs to, its day and your choice, so TimeFlov remembers it. For a meeting you add, we also store what it put in your timesheet: the project, hours and billable choice, and its title as the task or the comment of the time entry, or no title, as you choose in Settings. From then on it is part of your time records.
You can disconnect in Settings at any time. This deletes the stored token and withdraws TimeFlov's access at Google. An Outlook calendar connected through Microsoft is read and stored in the same way.
AI features
Some features use an AI model from Anthropic through Anthropic's commercial API. Your calendar is never sent to it. A meeting title you have added to a time entry is part of your time records and can be included when someone in your company uses an AI feature on those records: the AI review of non-billable time in the Billing Leakage report, or Suggest descriptions on a customer invoice. Anthropic's commercial terms do not allow it to train its models on this data. Your company's administrator can switch the AI features off.
We do not sell Google user data or use it for advertising. Neither we nor anyone we share it with uses it to create, train or improve AI or machine learning models.
TimeFlov's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, such as Google Calendar, will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.
10. Security
We employ technical and organizational measures to protect your data, including: encryption in transit (TLS) and at rest, row-level security (RLS) for data isolation, regular security audits, and multi-factor authentication via OAuth providers.
11. Complaints
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.
Contact
Questions about this privacy policy may be directed to:
TimeFlov AB
privacy@timeflov.com