Privacy policy

Last updated 17 October 2026

This policy explains what personal data CLOCK IN handles, why, and your rights. CLOCK IN is run by Nathan Lee trading as CLOCK IN. Contact us about privacy at support@clockinsite.com.

Two kinds of data, two roles

• Your team's working data. When a firm uses CLOCK IN, the firm is the controller of its staff's data (hours, locations, photos, documents and so on) and decides how it's used. We are the firm's processor: we store and process it only to provide the service to that firm, following its instructions. If you are a worker, your employer is responsible for telling you about this and answering your requests; we'll help them do that.
• Account and billing data. For firm owners' and admins' account details, billing and our own records, we are the controller.

What we collect

• Account details: name, email address, password (stored scrambled, we can't read it), the firm you belong to and your permissions.
• Clocking in and out: the date and time, and the phone's location (GPS position and a rough address) only at the moment someone clocks in or out. CLOCK IN does not track location at any other time, in the background, or after clocking out.
• Work records: hours, edits to hours and their reasons, timesheets, approvals and payments marked as paid, holiday requests, jobs and addresses.
• Things you add: photos taken or uploaded (for example at clock-out or on snags), notes, snag lists, documents and who has read or signed them, and stock records.
• Firm details: company name, logo, colours and settings.
• Billing: handled by Stripe. We receive the plan, payment status and a customer reference; we never see full card numbers.
• Technical data: basic logs our hosting providers keep for security and to fix faults (such as IP address and browser type).

Why we use it, and our lawful basis

• To provide the service a firm has signed up for (contract, and on the firm's instructions as processor).
• To take payments, keep accounts and meet tax and legal duties (contract and legal obligation).
• To keep the service secure, prevent misuse and fix problems (legitimate interests).
• To send essential emails such as password resets and billing notices. We don't send marketing without asking first.

Firms using CLOCK IN must have their own lawful basis for recording their staff's hours and clock-in location (usually legitimate interests or the employment contract) and must tell their staff about it.

Who we share it with

We don't sell personal data or use it for advertising. We only use these service providers to run CLOCK IN:

• Supabase: database, file storage and sign-in. Data is stored in London, UK.
• Vercel: hosts the website and app.
• Stripe: card payments and billing.
• Resend: sends emails such as password resets.

Some of these companies are based in, or use servers in, the United States. Where data leaves the UK it is protected by the UK's approved safeguards (the UK–US data bridge or the UK international data transfer agreement / addendum). Inside a firm, people only see what their role allows: workers see their own hours, and admins see their team's.

How long we keep it

• While a firm's account is active, its data is kept until the firm deletes it.
• When a plan ends, the account is paused and deleted 90 days later, unless the firm restarts.
• A firm owner can delete the whole firm, or a person can delete their own login, at any time from More → Delete account. Hours a worker logged may be kept by their employer as part of its pay records.
• Billing records are kept by Stripe and us for as long as tax law requires (normally 6 years).

Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to object to or restrict its use, and to have it moved to another service. If you're a worker, contact your employer first; otherwise email support@clockinsite.com. We'll reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Cookies and storage

CLOCK IN only uses storage that's needed to make it work, such as keeping you signed in. There are no advertising or tracking cookies, so there's no cookie banner.

Security

Data is sent over encrypted connections, and each firm's data is walled off from every other firm in the database itself. Passwords are stored scrambled. Only you and the people you approve can see your firm's data.

Children

CLOCK IN is for working people and businesses and isn't meant for anyone under 16.

Changes

If we change this policy in a way that matters, we'll tell account owners by email before it applies.