Privacy notice
How Detego AS handles personal data in Hourfy and how to exercise your rights.
Last updated:
Draft notice: production hosting, transfer safeguards and backup/log retention still need operator verification before launch.
Who is responsible?
Detego AS operates Hourfy. Contact us at post@detego.no about this notice or your personal data. We act as controller for our service accounts, billing, support and service security. Your organisation normally acts as controller for the employee, customer, project and time-entry data it places in its workspace; we process that data on its instructions. Your organisation must explain its own purposes, legal bases and retention rules to you.
What data do we handle?
Account and contact details include names, email addresses, company details, roles, password hashes and verification/reset information. Workspace data includes project and task assignments, dates, durations, descriptions and related customer details. Billing can include subscription identifiers and billing contact details; payment card details are handled by Stripe rather than stored in Hourfy. Security and infrastructure records can include account identifiers, IP addresses, request details and timestamps. Data comes from you, your workspace administrators and colleagues, service activity and payment/email providers. Avoid entering sensitive personal information in descriptions or privacy requests.
Why do we use it?
We use service account and support information to provide Hourfy and fulfil our contract with you, where you are the contracting individual. For business contacts using an organisation's contract, our basis is our legitimate interest in delivering and administering that service. We use necessary billing records to comply with applicable accounting and tax obligations, and necessary security records for our legitimate interest in preventing misuse and protecting the service. Workspace processing follows the organisation's instructions and legal basis. Registration is not consent to unrelated marketing.
Who receives data?
Authorised workspace administrators can manage workspace data. Employees and viewers are restricted to their own time entries and reports; managers and administrators can access team time data. Authorised support staff and infrastructure providers may access data where necessary to operate, secure and support the service. When enabled, Stripe receives payment/subscription data and Resend receives recipient addresses and transactional email content. Authorities may receive information where legally required. The current hosting providers, locations and contractual safeguards must be confirmed for the production deployment; contact post@detego.no for those details and the current subprocessor information. Do not assume the hourfy.eu domain means all processing occurs in the EEA.
International transfers
Some service providers may process data outside the EEA. Before enabling such processing, Detego AS must verify an applicable transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Ask post@detego.no for the applicable locations, safeguards and a copy of the relevant safeguards. Production transfer arrangements are part of our deployment review; this notice does not assert that unverified arrangements are already in place.
How long is data kept?
Account and workspace data is retained while the workspace is maintained for the service, until deletion is requested or a documented retention requirement applies. Closing a subscription does not delete the workspace. Workspace deletion removes its records from the active application database after linked Stripe cleanup completes. Audit logs are configured for 30-day retention by default and cleaned daily; new audit records store field names rather than copies of field values. Older value snapshots remain until cleanup. Closed in-app privacy requests are deleted after 90 days; unresolved requests remain available for handling. Backups, infrastructure/support logs and legally required financial records follow separate retention schedules. These production schedules must be verified with the operator; immediate erasure of all retained copies is not promised.
Your rights and how to use them
Depending on the processing and legal basis, you can request access, correction, erasure, restriction, portability and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Erasure and other rights have lawful exceptions. You can edit your profile, download your personal workspace data and submit a tracked workspace request from Profile → Privacy & your data, including after a subscription expires. Your administrator reviews workspace requests. The download covers the data identified in the file, not every possible support, billing, log or backup record. For additional data, service/billing requests, or if you cannot sign in, email post@detego.no; you do not need an account or subscription to contact us. We may need proportionate information to verify your identity. Requests are normally free and answered within one month. Complex or numerous requests can take up to two additional months if you are informed of the reasons within the first month. You can complain to the data protection authority where you live or work, or where an alleged infringement occurred, and seek a judicial remedy.
Browser storage and automated decisions
The app uses browser storage for authentication, language/theme preferences, calendar settings and a running timer. Signing out clears the saved authentication state; your browser settings can remove other stored preferences. These pages include no advertising or analytics trackers, and fonts are served locally or supplied by your device. If optional tracking is introduced, its notice and any required consent controls must be added before activation. Hourfy does not use personal data for solely automated decisions producing legal or similarly significant effects. Account details are necessary to create an account; without them we cannot provide access.
Questions and changes
Email Detego AS at post@detego.no for privacy questions, rights requests and the current processing arrangements. We will update this notice when processing changes and provide additional information before using data for a new purpose. Your organisation may provide an additional notice for its workspace.