Privacy policy
Version 2026-11-06. This policy says what personal data Timesheets keeps, why, and what you can do about it. Scale Up Solutions ("we", "us") runs Timesheets. Contact: joe@scaleupsolutions.asia.
Who is responsible for what
For the data that a business puts into Timesheets about its own staff, customers and work (time entries, projects, leave, rates), the business is in charge of that data and we process it for them. For the account data that we need to run the service (sign-in, billing, support), we are in charge.
What we keep
- Account: name, email address, and a hash of your password (we never keep the password itself).
- Your organisation's data: people, roles, rates and cost rates, customers, projects, tasks, time entries and notes, leave requests and balances, teams, reports you saved, invoices, and the audit log (who changed what and when).
- Telegram: if you link Telegram, your Telegram user number and chat number, and the messages the bot sends you. We do not read your other Telegram chats.
- Technical data: a sign-in cookie, and your network address for a short time, only to limit sign-in and sign-up attempts and to protect the service.
- Messages we send: reminders, approvals, reports, trial and billing notices, by email and Telegram.
Why we use it
- To run the service for you: sign you in, record and approve time, make reports and invoices, send reminders.
- To keep the service safe: stop abuse, find faults, keep the audit log.
- To bill you and to follow the law.
We do not sell personal data. We do not show advertising. We do not use your data to train AI models. The service loads no analytics or advertising scripts.
Who else handles it
- DigitalOcean hosts the servers and the database.
- Amazon Web Services (SES) sends our emails.
- Telegram carries the bot messages, if you use the bot.
- If your organisation uses the Scale Up Ledger, the two services share the data needed for invoices and people.
- We give data to a public authority only when the law forces us to.
Some of these companies are in other countries, so your data can be processed outside your country.
How long we keep it
- While the organisation has access, we keep its data.
- After access ends we keep the data for 30 days (read-only), then delete it. We email the admins 7 days and 1 day before.
- Nightly backups are kept for 14 days. Backups made before an update are kept for 90 days. Deleted data can stay in a backup until that backup is deleted.
- Sign-up requests that are not confirmed by email are kept for 24 hours and are deleted in the next daily clean-up.
How we protect it
Each organisation's data is separated from the others in the database. Connections are encrypted. Passwords are stored as hashes. Sign-in and sign-up attempts are limited. Every change is written in the audit log. No system is perfectly safe. If we find a breach that affects you, we tell the organisation's admins without delay.
Your choices and rights
- You can ask to see, correct, download or delete your personal data. Write to joe@scaleupsolutions.asia. If your data is in an organisation's account, we may send your request to the organisation's admins, because they are in charge of that data.
- You can disconnect Telegram at any time, and turn the email digest on or off on the Notifications page.
- An organisation's admin can delete a person's login. Time entries stay in the organisation's records, because they are needed for billing and pay, but the login is removed.
- You can complain to the data protection authority of your country.
Cookies
We use one cookie, to keep you signed in. It is needed for the service to work. We use no tracking cookies.
Children
Timesheets is for businesses and is not meant for people under 18.
Changes
If we change this policy in a way that matters, we email the organisation's admins before the change starts. The version number at the top shows which text applies. See also the terms of service.