The terms on which we hold your employees' data.

1Parties, and when this applies

This agreement is between you, the company whose employees are being tracked, and us: Aravind of Manjeri PO, Kerala, India, trading as logtop, an individual rather than a registered company.

It applies from the moment the first employee account in your company is created, and it stops applying when your data has been deleted under section 10. It sits alongside the terms of service; where the two disagree about personal data, this one wins.

2What we process, and for whom

Subject matter. Running a time and activity tracker for your staff.

Duration. For as long as you are a customer, plus the short tail in section 10.

Nature and purpose. Receiving daily activity totals from your employees' machines, storing them, and showing them back to your administrators and to the employees themselves.

Categories of data subject. Your employees and contractors who have a logtop account.

Categories of personal data. Name, work email address, password hash, role, team, timezone; hours tracked and hours active per day; time per application, per website domain and per project; clock-in and clock-out times; a keystroke count; booked leave; and, where an administrator enters one, an hourly rate and contracted weekly hours.

Special category data. None is asked for and none is needed. The product has no field for health, beliefs, union membership, or anything else in Article 9.

3Acting on your instructions

We process personal data only on your documented instructions. Using the product as it is built (an administrator opening a report, exporting a CSV, deactivating somebody) is an instruction. So is a mail from one of your administrators asking us to do something to your account.

We do not use your employees' data for our own purposes. It is not analysed to improve the product, not aggregated into benchmarks, and not used to train anything.

If a law we are subject to forces us to process data some other way, we will tell you before doing it unless that law forbids telling you.

If an instruction from you looks to us like it breaks data protection law, we will say so. We are not your lawyer and will not pretend to be, but we are not going to do something obviously unlawful quietly either.

4Confidentiality

Access to your data is limited to people who need it to run the service. Today that is one person. Everyone with that access is bound to keep it confidential, and that obligation outlives the arrangement.

Every action taken across company boundaries by a staff account is written to an audit table and kept permanently. This exists so that “we can technically see everything but we do not look” is a claim with a record behind it rather than a character reference.

5Security measures

The measures in place today:

• Everything in transit is over TLS. There is no plaintext path.
• Passwords are stored as PBKDF2-HMAC-SHA256 hashes, 16-byte random salt, 100,000 iterations, with the iteration count stored per hash so it can be raised later.
• Sensitive detail is designed out rather than protected. Window titles and raw samples never leave the employee's machine, so there is no server-side copy of them to lose.
• Every row carries a company id, and that id comes from the caller's session token, never from a parameter the browser supplies. One function decides “may this account see this person?” so that no endpoint can forget to ask.
• Sign-in, password reset and registration are rate limited per account and per source address.
• Deactivating an employee drops every session token they hold at once, so access ends on their agent's next request rather than whenever a token would have expired.
• Server-side totals older than twelve months are deleted by a weekly scheduled job; raw samples on the employee's machine are deleted after ninety days by the app itself.

What is not in place, stated plainly rather than left for you to discover: there is no SOC 2 or ISO 27001 certification, no independent penetration test, and no formal on-call rotation. If any of those is a procurement requirement, logtop does not meet it today.

6Sub-processors

You give general authorisation for the sub-processors below. There are two.

Each is bound by terms no weaker than these, and we stay responsible to you for what they do.

This list is the notice. If we add or replace one, this page changes and customers are emailed at least 30 days before the new one starts handling anything. If you object within those 30 days and we cannot find another way, you may terminate for that reason and we will refund the unused part of anything paid in advance.

7International transfers

logtop is operated from India and its sub-processors are outside the European Economic Area. Where personal data of people in the EEA, the UK or Switzerland is transferred out, that transfer is made under the European Commission's standard contractual clauses (Decision 2021/914), with the UK Addendum and the Swiss amendments where they apply. Module Two (controller to processor) governs the transfer from you to us; Module Three (processor to processor) governs onward transfers to the sub-processors above.

By agreeing to this page you and we enter into those clauses. The appendices are filled in by section 2 (categories and purposes), section 5 (technical and organisational measures) and section 6 (the list of sub-processors). Your entity is the data exporter and ours is the importer; the competent supervisory authority is the one for your establishment.

8Helping you answer your employees

If one of your employees asks us directly to see, correct, export or delete their data, we will not act on it. We will tell them to ask you, and tell you that they asked.

Most of it you can do yourself without waiting on us. Every employee can already see every figure held about them on their own dashboard, and Export produces the same rows as a CSV. An administrator can open any individual, export them, or deactivate them. For anything the product cannot do, such as a hard deletion or an unusual export, mail us and we will do it within 14 days at no charge.

9If something goes wrong

If we become aware of a breach affecting your data we will tell you without undue delay and in any case within 48 hours, by email to your administrators. You will get what we know at the time: what happened, which categories and roughly how many people are affected, what the likely consequences are, and what is being done. If the full picture is not available yet we will send the partial one rather than wait for a tidy account, and follow it up.

Notifying your supervisory authority and your employees is your call to make (you are the controller), and we will give you whatever you need to make it.

10Return and deletion

While your account is open you can export everything at any time from the dashboard, as CSV, without asking.

When you stop being a customer, you have 30 days to export what you want. After that your company's data is deleted: totals, shifts, leave, teams, categories, billing rules and every user record. Backups roll off within a further 30 days.

Two things survive, and here is why. The permanent audit trail keeps a record that an action happened, because an access log that can be erased is not an access log; it holds an actor, an action and a timestamp, not anybody's activity data. And anything we are required by law to keep, an invoice for instance, is kept for as long as the law says and used for nothing else.

Raw samples and window titles are not ours to delete or return. They are on your employees' own machines and always were. Uninstalling the app does not remove that database, deliberately: an uninstall is not a request to throw away somebody's tracked hours. Deleting the folder named in section 3 of the privacy policy does remove it.

11Audit

You may ask for the information needed to show that we are meeting this agreement, and we will answer in writing. Once a year, or after a breach affecting you, you may also ask for an audit; we will agree the scope and timing so that it does not turn into an outage for everybody else. You cover your own costs.

We have no certification to send you instead, and we are not going to answer a 300-line security questionnaire with invented maturity ratings. Ask specific questions and you will get specific answers. We will send you the database schema on request, so that what we say is stored can be checked against the only thing that decides it.

12What is on your side of the line

You are the controller, which means some things are yours and not ours:

• Having a lawful basis for monitoring your staff at all, and being able to show it.
• Telling your employees what is being tracked, before it starts. In several countries this is a hard legal requirement rather than good manners: in Germany a works council can block deployment outright, and several US states require written notice.
• Your own data protection impact assessment, where one is needed. Systematic monitoring of employees usually needs one.
• Deciding who in your company gets an administrator role, and taking it away when they leave.
• Not putting personal data somewhere it does not belong. Project names and team names are free text that every administrator can read; they are not the place for a note about somebody.

13Changes

If this agreement changes materially, customers are emailed at least 30 days before it takes effect, and the version and date at the top change. If you do not accept the new version you may terminate before it starts and be refunded for the unused period.