Privacy Policy

1. Data controller

The controller of the personal data of users of the Trackerosa service (https://trackerosa.com/) is ROSPRO Paweł Rosa, Pątnówek 23B, 59-222 Miłkowice, Tax ID (NIP) 6912540404, Business ID (REGON) 381996702 (the “Controller”). Contact regarding personal data: contact@trackerosa.com.

2. What data we process

• Account data — email address, name (optional), password (stored only as a cryptographic hash), dates of registration, email address confirmation and acceptance of the Terms of Service.
• Data entered into the service — clients (name, email, phone, tax ID (NIP), address, description), projects, tasks, tags, rates and budgets, time entries, client report links.
• Teams — team name, team membership and role, and invitations (email address of the invited person, role, inviting person, expiry date).
• ClickUp connections — API token (stored in encrypted form), list identifier and the selected person. Tasks and comments retrieved from ClickUp are not stored in the database — they are kept only in the cache for the period selected in the connection settings (at most 60 minutes).
• Technical data — IP address, date and time, and request URL recorded in server logs.

With respect to personal data that users enter about their clients and co-workers, the user is the controller, and the Controller processes such data on the user's behalf under the terms set out in the Terms of Service (entrustment of data processing).

3. Purposes and legal bases of processing

• creating and maintaining the account and providing the services offered by the service —Art. 6(1)(b) GDPR (contract);
• sending account-related messages: activation link, password change, notifications of a password or email address change — Art. 6(1)(b) GDPR;
• sending a team invitation to the address provided by the inviting person — Art. 6(1)(f) GDPR (legitimate interest in enabling teamwork); an invitation that is not accepted expires after 7 days;
• security of the service (limiting the number of sign-in and sign-up attempts, server logs) — Art. 6(1)(f) GDPR (legitimate interest of the Controller);
• billing and invoicing for paid add-on features, once they are introduced — Art. 6(1)(c) GDPR (obligations under tax law);
• establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR.

Providing an email address and password is voluntary but necessary to create an account. We do not make decisions based solely on automated processing and we do not profile users.

4. Recipients of data

• OVHcloud — provider of the server, database and email; data is stored in data centers within the European Union.
• ClickUp — only if the user connects their own ClickUp account with an API token; the service then retrieves data from ClickUp on the user's behalf (ClickUp operates in the USA under its own terms of service and privacy policy).
• Team members — people in the same team can see your name and email address; the owner and partners of the team can also see your time entries in that team.
• Recipients of report links — people to whom the user gives a report link; the user decides which data is visible.
• public authorities — only where required by law.

Apart from the ClickUp integration enabled by the user, we do not transfer data outside the European Economic Area.

5. How long we keep data

• account data and data entered into the service — until the account is deleted; deleting the account in Settings removes them from the database immediately, together with the teams you own; your time entries in other people's teams remain in those teams without author details (“Deleted user”), as they are part of the team's billing records;
• accounts whose email address has not been confirmed with the activation link are deleted 7 days after registration;
• billing data — for the period required by tax law;
• technical logs — for as long as necessary to ensure security and diagnose errors;
• deleted data may remain in backups until they are overwritten in the regular backup cycle.

6. Your rights

You have the right to:

• access your data and receive a copy of it — in Settings → Account (“Download my data”);
• have your data rectified — in Settings and on the client, project and entry pages;
• have your data erased — in Settings → Account (“Delete account”);
• restrict processing and object to processing based on legitimate interest;
• data portability (receive your data in a portable format) — a file with your account data (JSON) and export of reports to CSV, Excel and PDF;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

For matters that cannot be handled in Settings, write to contact@trackerosa.com.

7. Security

Connections to the service are encrypted (HTTPS), passwords are stored as cryptographic hashes and ClickUp tokens in encrypted form. Each user has access only to the data of their own teams, to the extent resulting from their role (an employee sees only their own entries, without amounts); a report link gives access only to the data selected by the user and can be deleted at any time.

8. Cookies and browser storage

The service uses only mechanisms that are strictly necessary for it to work:

We do not use analytics or advertising cookies and do not load resources from external servers (fonts, icons and scripts are served from the Trackerosa server). Mechanisms strictly necessary for the service to work do not require consent; you can disable them in your browser, but signing in will then stop working.

9. Changes to this policy

We will notify you of material changes to this policy by email or in the service. The current version is always available at https://trackerosa.com/en/privacy.