01What this is, and who it is between
This agreement is between LoudOwls ("we") and the company that owns a DeskTick workspace ("you"). It applies to personal data we handle for you in that workspace, and forms part of the terms and conditions. Where the two disagree about personal data, this agreement decides.
You are the controller of that data: you decide what is collected about your people and why. We are your processor: we handle it only to provide the service to you.
It does not cover a developer's own account and profile. Those are theirs, we are the controller for them, and the privacy policy applies. In particular, a person's record of an engagement with you — its dates, hours and counts — is theirs as well as yours.
02What is processed, about whom, and for how long
- Whose data: the members of your workspace — employees, contractors and anyone else you invite — and people you consider for work through the hiring features.
- What data: names, email addresses and roles; time records, sessions and activity counts; the content your people create, such as projects, tasks, notes, boards and reports; hiring messages, interview records, offer letters and signatures; and, for people you have hired, the payroll details they release to you.
- Why: to provide the workspace — tracking and reporting work, running projects, and hiring.
- For how long: for as long as the workspace exists, and as set out under “When it ends” afterwards.
03Your instructions
We process this data only on your documented instructions. Using the service as it is designed, and these terms, are your instructions; you can give others in writing, and we will follow them where they are within what the service does.
If we believe an instruction breaks data protection law, we will tell you. If a law requires us to process the data in some other way, we will tell you first unless that law forbids it.
You are responsible for having the right to collect this data about your people, and for telling them about it.
04The people who handle it
Access is limited to those of our staff who need it to run and support the service. They are bound to keep it confidential.
05Security
We keep appropriate technical and organisational measures in place, including:
- Encryption of data in transit.
- Encryption at rest of identity documents, bank details and authenticator secrets; passwords stored only as hashes.
- Separation of each workspace's data from every other's, enforced on every request.
- Roles and permissions inside a workspace, so a member sees what their role allows.
- Two-step sign-in available to every account, and alerts for sign-ins that look unusual.
- Records of sign-ins and of changes that matter, kept for investigation.
06Other companies we use
You agree to our using these sub-processors, each bound by terms that protect the data to the standard of this agreement. We remain responsible to you for what they do.
- Hosting and databases: Amazon Web Services, Fly.io, Neon and Vercel.
- File storage: Cloudflare R2.
- Email: Resend.
- Payments: Stripe.
- AI features: Anthropic.
If we add or replace one, we will update this page and give workspace owners notice by email beforehand. If you object on reasonable data-protection grounds and we cannot resolve it, you may end your subscription and we will refund any period paid for and not used.
07Requests from your people
If one of your people asks us to see, correct or erase data that you control, we will pass the request to you and not answer it ourselves, unless the law requires us to. We will give you reasonable help in answering it, and with impact assessments or dealings with a regulator that concern this processing.
08If something goes wrong
If we become aware of a breach of security that affects your data, we will tell the workspace owner without undue delay, with what we know about what happened, what data is involved and what we are doing about it, and will keep you informed as we learn more.
09Where the data goes
We are based in India and our sub-processors run servers in other countries, including the United States. Where the law that applies to you restricts sending personal data abroad, we will put in place with you the safeguard that law provides for it, such as standard contractual clauses, on request.
10Checking on us
We will give you the information reasonably needed to show that we keep to this agreement, and answer a written security questionnaire once a year. An on-site audit can be arranged where the law gives you the right to one, at your cost, with reasonable notice and without access to other customers' data.
11When it ends
When you delete a workspace, or ask us to after your subscription ends, we delete the personal data we hold for you in it, apart from what the law requires us to keep, such as billing records. Before that, on request, we will make your data available to you.
A developer's own record of an engagement with you is not yours alone and is not deleted with the workspace: it stays with the developer, who controls whether it is shown.
12The rest
Liability under this agreement is subject to the limits in the terms and conditions, and it is governed by the same law. To ask for a countersigned copy, or anything else about it, write to [email protected].