Privacy Policy

Effective Date: September 1, 2025

Last Updated: October 7, 2026

1. Introduction

KlockinTeam ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile apps, web app, and related services (together, the "Service").

2. Information We Collect

2.1 Personal Information

• Company information (name, address, contact details)
• User account information (user ID, name, role, email address)
• Work schedule and timesheet data
• Team messages and related attachments you send in the Service
• Time-off requests and approvals
• Payroll and reporting information

2.2 Location Information

When you grant location permission, we collect a location snapshot only at the moment someone takes one of these actions — not continuously, not in the background, and not when the app is closed:

• GPS coordinates and, when available, a resolved address at clock-in
• GPS coordinates and, when available, a resolved address at clock-out
• GPS coordinates and, when available, a resolved address when a team message is sent (location is attached to the message automatically)

We do not record a movement trail between those points. If location permission is denied, the related clock or message location fields may be empty or unavailable, and location-verification features will not work.

2.3 Payment and Billing Information

• Billing name and email address
• Payment method details (processed securely by Stripe)
• Transaction history and invoice records
• Subscription plan and billing cycle
• Payment card brand and last 4 digits (for display purposes)

Note: We do not store complete credit card numbers. All payment processing is handled securely by Stripe, our PCI-DSS compliant payment processor. Credit card data is never stored on our servers.

2.4 Device and Technical Information

• Device type and operating system version
• Technical or diagnostic information the client sends as needed to operate, sync, or troubleshoot the Service (for example connectivity or error information)

3. How We Use Your Information

• Provide timesheet and time tracking services
• Process payments and manage subscriptions
• Generate payroll reports and analytics
• Verify work locations using the clock-in, clock-out, and message location snapshots described in Section 2.2
• Manage employee schedules and time-off requests
• Send billing notifications and invoices
• Communicate with users about their accounts and subscriptions
• Send product onboarding guidance, feature updates, and related communications
• Detect and prevent payment fraud
• Improve our services and user experience
• Ensure compliance with labor and tax regulations

4. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• With your explicit consent
• With Stripe: Payment information is shared with Stripe for processing payments and managing subscriptions
• With Intuit QuickBooks Online: When an admin connects QuickBooks, we exchange employee and time data with Intuit as described in Section 4.2
• With email service providers: Your email address may be shared to deliver communications described in Section 10
• With infrastructure providers: We use third-party hosting, storage, and networking providers to run the Service; they process data only as needed to provide those services
• To comply with legal obligations, court orders, or regulatory requirements
• To protect our rights and prevent fraud or unauthorized access
• With service providers who assist in app operations (under strict confidentiality agreements)

4.1 Third-Party Payment Processor

We use Stripe as our payment processor. When you make a payment, your payment information is sent directly to Stripe and processed according to Stripe's Privacy Policy. We receive only limited information such as payment success/failure status and masked card details (last 4 digits).

Stripe Privacy Policy: https://stripe.com/privacy

4.2 Intuit QuickBooks Online

If an organization owner or admin chooses to connect KlockinTeam to Intuit QuickBooks Online, we use Intuit’s OAuth 2.0 authorization so we never receive or store QuickBooks account passwords.

When connected, we may access and process the following QuickBooks data on behalf of that organization, solely to provide the integration features you enable:

• Company identifying information needed to confirm the connected QuickBooks company (for example company name and company/realm id)
• Employee roster fields used to match or import workers (such as names and work emails present in QuickBooks)
• Time activity / hours data you choose to send from KlockinTeam clock-in, clock-out, and total hours into QuickBooks

OAuth access and refresh tokens are stored on our servers, encrypted at rest, and used only to call Intuit APIs for that organization. Tokens are not exposed to the mobile or web client. You can disconnect QuickBooks at any time from KlockinTeam Admin → QuickBooks, or from within QuickBooks Online; disconnecting revokes or clears the connection and removes stored tokens for that organization.

Intuit’s handling of data is described in Intuit’s privacy materials, including: https://www.intuit.com/privacy/

5. Data Security

We implement reasonable technical and organizational measures intended to protect your information, including:

• Use of HTTPS/TLS for data transmitted between the apps and our servers
• PCI-DSS compliant payment processing through Stripe (card numbers are handled by Stripe, not stored on our servers)
• Authentication and access controls for accounts
• Encryption of Intuit QuickBooks OAuth tokens at rest, with keys held separately from application source code
• Security updates as part of our ongoing development and operations

Payment Security: We never store complete credit card numbers. All payment card data is handled exclusively by Stripe, which is PCI-DSS Level 1 certified (the highest level of security certification in the payments industry).

6. Data Retention

We retain information for as long as needed to operate the Service and to meet legal, tax, accounting, and dispute-resolution obligations. Retention periods vary by data category and applicable law (for example, payroll-related and billing records are often subject to longer minimums). Location fields stored with time entries follow the same retention approach as the underlying timesheet records they support. Location fields stored with team messages follow the same retention approach as the messages they are attached to.

QuickBooks connection tokens are retained only while the organization remains connected. When you disconnect QuickBooks (in KlockinTeam or in QuickBooks Online), we delete those tokens. Employee-link and time-sync records created through the integration follow the same retention approach as other organization payroll/timesheet data unless you request deletion.

After cancellation or closure of an account, we retain company data for a limited period where appropriate to allow reactivation or export, then delete or anonymize it in the ordinary course except where a longer period is required by law or payment-processor rules. Contact support@klockinteam.com to discuss deletion or export requests.

7. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data (subject to legal requirements)
• Opt-out of certain data processing activities
• Opt out of promotional emails described in Section 10
• Request export or portability of your data where supported by the features available on your plan

Account deletion: You can request deletion of your account and associated data by following the steps on our Delete Account & Data page.

8. Location Services

Our apps use the device’s foreground location permission, when you grant it, to record the snapshots listed in Section 2.2. We do not request or use background location to follow a person through the day. You can disable location services in your device settings; clock-in and clock-out can still be recorded without a location, but location verification and message map pins will not be available.

9. Children's Privacy

Our services are not intended for individuals under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Communications

When you register an account, your email address is added to our email communications. You will receive product onboarding guidance, feature updates, and occasional information about new products and services from Greg Martins Oji MD Inc. You can unsubscribe from these emails at any time using the unsubscribe link in each email.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes through the app or via email. Continued use of our services after changes constitutes acceptance of the updated policy.

This Privacy Policy was last updated on October 7, 2026.