Privacy Policy

This Privacy Policy explains how timeghost Solutions GmbH ("we", "us", "our") processes personal data in connection with our project management application timeghost Project Board (the "Service"), embedded in Microsoft Teams, and this website.

timeghost Solutions GmbH
Reichenaustr. 11a, 78467 Konstanz, Germany
Email: info@timeghost.io | Phone: +49 7531 9783000
(Registered: Amtsgericht Freiburg, HRB 729216)

In accordance with Art. 37 GDPR and Sec. 38 BDSG we have appointed a Data Protection Officer: Sven Weiser – c/o timeghost Solutions GmbH, Reichenaustr. 11a, 78467 Konstanz, Germany. Email: info@timeghost.io

• Data you and your colleagues store in a workspace (projects, tasks, comments, uploaded files = "Customer Data") is controlled by your organisation. We process it as a processor under a Data Processing Agreement (Art. 28 GDPR). A DPA is available on request.
• For account, billing, website and security data we act as controller. This Policy mainly describes that controller processing.

• Account & profile data: name, business email, profile photo, language, Microsoft 365 user ID, workspace roles.
• Authentication data: single sign-on with Microsoft Entra ID (we never receive your Microsoft password).
• Project and task data, including comments and uploaded files ("Customer Data").
• Log & usage data: server log files (browser type/version, OS, referrer URL, hostname, request time, IP address) and error reports.
• Billing data (paid plans): billing name, address, VAT number; payment data is handled by our payment provider (see Section 9).
• Support communications (via Freshdesk, see Section 9).

The Service integrates with Microsoft 365 via Microsoft Graph. We request permissions only for sign-in, the basic profile and the integration with Microsoft Teams, and use them for these purposes only. You can withdraw these permissions at any time via Microsoft 365 or your administrator.

If your organisation enables optional AI features, the content required for them is transmitted to the AI provider selected by your organisation (e.g. OpenAI). Your organisation is responsible for the related agreements with that provider.

This website is hosted by Vercel (Vercel Inc., USA). When you visit it, Vercel processes the server log files listed above to deliver and secure the website.

For audience measurement we use Plausible Analytics (Plausible Insights OÜ, Estonia). Plausible sets no cookies and creates no user profiles; only aggregated statistics such as pages viewed, referrer, country and device type are evaluated.

The legal basis in each case is our legitimate interest in a secure website that meets visitors' needs (Art. 6(1)(f) GDPR).

• Providing/operating the Service and the Microsoft 365 integration — Art. 6(1)(b).
• Processing Customer Data on behalf of your organisation — Art. 28 GDPR.
• Security, abuse prevention, logging, error tracking, monitoring — Art. 6(1)(f).
• Billing, accounting, tax — Art. 6(1)(b) and (c).
• Service notifications (Microsoft Teams / email) — Art. 6(1)(b)/(f).
• Providing this website and cookieless audience measurement — Art. 6(1)(f).
• Support — Art. 6(1)(b)/(f).

We use the following service providers under data processing agreements (unless stated otherwise):

• Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corporation, USA): Microsoft Azure hosting in the Germany West Central region (Frankfurt), storage of uploaded files in Azure Blob Storage, sign-in via Microsoft Entra ID, Microsoft Graph and Microsoft Teams. Essential. Transfers to the USA are based on EU Standard Contractual Clauses.
• Paddle (Paddle.com Market Limited, 18-29 Mora Street, Judd House, London EC1V 8BT, UK): payment processing / reseller (Merchant of Record) for paid plans. We have no access to your full payment data. Transfer to the UK is based on the EU adequacy decision.
• Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany): transactional and notification emails; data stored on servers in Germany.
• Sentry: error tracking. Per our setup this runs self-hosted within our own infrastructure; data is not shared with a third party.
• Freshdesk (Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA): handling of support requests. This involves contact details, the content of the request and usage data (e.g. last login, browser, operating system). Data is stored in the Freshworks data center in the EU (Frankfurt). Where Freshworks or its sub-processors process data outside the EU, this is based on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.
• Inngest (Inngest Inc., San Francisco, USA): orchestration of the Service's background processes. Processing takes place in the USA; the transfer is based on EU Standard Contractual Clauses.
• Vercel (Vercel Inc., USA): hosting of this website (see Section 7).
• Plausible (Plausible Insights OÜ, Estonia): cookieless audience measurement on this website (see Section 7).
• AI providers: only when optional AI features are used, selected and contracted by your organisation (see Section 6).

This list names the main recipients and is not exhaustive; a current list of our sub-processors is available on request.

We may also disclose data to authorities where legally required, and to advisers/auditors or in a corporate transaction, subject to confidentiality.

Some recipients (e.g. Microsoft, Vercel and Inngest) process data outside the EEA. Such transfers are safeguarded by an adequacy decision (e.g. UK for Paddle) and/or EU Standard Contractual Clauses with supplementary measures. We note that third countries such as the USA may not offer a level of data protection equivalent to the EU.

We retain personal data only as long as necessary for the stated purposes or as legally required. When you delete your account, your personal data is deleted; backups may retain data for up to 14 days before permanent deletion. Accounting-relevant data is retained for the statutory period. Customer Data is retained per your organisation's instructions and deleted upon termination.

Subject to legal conditions, you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany — https://www.baden-wuerttemberg.datenschutz.de

To exercise your rights, contact info@timeghost.io.

A Microsoft 365 account and certain account data are required to use the Service.

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects (Art. 22 GDPR).

The application uses strictly necessary cookies (e.g. session/login) on the basis of Art. 6(1)(f). This website sets no cookies for analytics or marketing purposes; audience measurement with Plausible works without cookies.

We maintain appropriate technical and organisational measures, including TLS/SSL encryption of all communication and backups at least twice a day on redundant servers. Our information security management system is in conformity with the requirements of ISO 27001.

We may update this Policy. The current version with its "last updated" date is always available on this page.

timeghost Solutions GmbH, Reichenaustr. 11a, 78467 Konstanz, Germany
Email: info@timeghost.io / support@timeghost.io — Phone: +49 7531 9783000