Privacy Statement

1. Who We Are

TimeCatchApp, LLC ("TimeCatchApp," "we," "us," or "our") provides project and time-tracking software to businesses. TimeCatchApp, LLC is located at 1102 Haywards Heath Ln, Apex, North Carolina, United States.

This Privacy Statement explains how we collect, use, share, and protect personal data in connection with our website (timecatchapp.com) and our application (the "Service"). It should be read together with our Cookie Policy and our Terms of Service.

2. Our Role: Controller and Processor

Depending on the data at issue, TimeCatchApp acts either as a data controller (we decide why and how the data is used) or a data processor (we handle data on behalf of our business customers, who are themselves controllers of that data).

In general:

• We are the controller of account data (such as your email address) and billing metadata.
• We are a processor of the content our business customers and their users choose to enter into the Service — project data, task data, client information, and uploaded documents. Our business customers, not TimeCatchApp, are the controllers of that content and are responsible for having a lawful basis to collect and use it, including data about their own clients and employees.

If you are an employee, contractor, or client of one of our business customers and have questions about how your data is used within the Service, please contact that business directly. We assist our customers in responding to such requests as described in Section 8.

3. Data We Collect

The only information required to use the Service is an email address. All project, task, client, and document information is entered voluntarily by you or your organization; none of it is mandatory for account creation.

We do not collect or store credit card numbers or bank account details. Payments are processed by Stripe, Inc.; TimeCatchApp receives only whether a payment succeeded, the amount, and the date/time. See Section 6.

4. How We Use Data

We use personal data to:

• Provide, operate, and maintain the Service
• Process payments and send billing-related communications (including the reminder sent before each recurring charge)
• Provide customer support
• Maintain the security and integrity of the Service
• Comply with legal and tax obligations
• Improve the Service and our support materials, including through analysis of chatbot interactions (see Section 7)
• Provide optional AI-assisted features, where you have chosen to use them (see Section 7)

5. Legal Basis for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — to create and administer your account, provide the Service, and process payments
• Legal obligation (Art. 6(1)(c)) — to maintain financial and tax records
• Legitimate interests (Art. 6(1)(f)) — to maintain security, prevent fraud, and improve the Service and support content, balanced against your rights
• Consent (Art. 6(1)(a)) — for non-essential cookies (see Cookie Policy) and for optional AI features

6. Third Parties and Sub-processors

We share personal data with the following categories of service providers, each under a data processing agreement:

• Hosting: hosting.com (cloud infrastructure, Arizona, United States) — Data Processing Agreement executed
• Payments: Stripe, Inc. (payment processing; Stripe is an independent controller for the card/bank data it holds)
• Search: Algolia (search indexing of content within the Service)
• Email delivery: Brevo (primary transactional email), Google (Gmail SMTP, backup email delivery), and Mailgun (legacy email delivery)
• AI providers (optional feature only): OpenAI, Google (Gemini), and Mistral AI. All AI providers process data only in the United States or European Union. See Section 7.
• Website analytics (only with your consent): Google Analytics and Microsoft Clarity (aggregate usage statistics, session replays, and heatmaps; see our Cookie Policy)
• Support chatbot: Elfsight (website chat widget, marketing website only; uses OpenAI's GPT-6 Luna model)
• GDPR representation: Euverify Limited (Ireland) and Euverify Ltd (UK) — see Section 9

We do not sell personal data, and we do not share personal data with third parties for their own advertising purposes.

7. Optional AI Features

TimeCatchApp offers optional AI-assisted features that can read project and task files to help you work faster. These features are not used automatically or in the background — data is sent to an AI provider only at the moment a user actively chooses to invoke the feature.

• Each time you invoke the feature, the relevant file or task content is sent to a third-party AI provider to generate a response for that specific request.
• Access controls are enforced before content is sent — the AI feature only draws on content the requesting user is already authorized to see.
• Our AI providers do not use your data to train their models, and do not retain it outside our account, under our agreements with them.
• All AI processing takes place in the United States or the European Union — we do not route AI feature data to data centers outside these regions.
• You may choose which AI provider handles a given request — OpenAI, Google Gemini, or Mistral AI — since different providers may perform better for different kinds of requests. Mistral AI is based in, and processes data in, the European Union; OpenAI and Google process data in the United States or European Union depending on the account configuration we use with them.
• Customers located in Europe have the option to route their AI requests to European servers rather than United States servers.
• Please do not upload special categories of data (such as health information) if you do not want it processed by our AI providers; our Terms of Service address this.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

You can delete your account and all associated data at any time from within the Service. If you are an employee, client, or contact of one of our business customers (rather than the account holder), please direct your request to that business; we will assist them in responding as required under our Data Processing Agreement.

To exercise a right directly with TimeCatchApp, contact us at admin@timecatchapp.com. If you are located in the EU or UK, you may also contact our appointed Article 27 representative directly — see Section 9.

9. International Data Transfers and EU/UK Representatives

TimeCatchApp is based in the United States, and our hosting provider (hosting.com) stores data on servers located in Arizona. We offer the Service worldwide, including in the European Union, United Kingdom, Switzerland, and India.

Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on one or more of the following safeguards:

• hosting.com: the European Commission's Standard Contractual Clauses (SCCs) for third-country transfers under Art. 46 GDPR, incorporated into our executed Data Processing Agreement (ref. JEC-962-00641)
• Other sub-processors: Standard Contractual Clauses (and the UK Addendum / Swiss amendments, where applicable) and/or self-certification under the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks, as reflected in each sub-processor's Data Processing Agreement

EU/EEA & UK GDPR Representatives (Article 27)

If you are located in the EU or UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:

EU Representative:

UK Representative:

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, you may also use our secure portal at gdpr.euverify.com. This portal allows you to verify our appointed representative and submit GDPR requests directly; requests submitted through it are logged and tracked to ensure a timely response.

Euverify Limited and Euverify Ltd act as our processor for the limited purpose of receiving, logging, and forwarding data-subject requests on our behalf; see Section 6.

10. Data Retention

Retention differs depending on whether data was generated by your use of the Service (your account, your projects, and — if you invoice your own clients through the Service — those invoices) or whether it is TimeCatchApp's own record of your subscription payments to us.

10.1 Your Account and Content

• Your account, project data, task data, client data, documents, and any invoices you generate within the Service for your own clients: retained for as long as your account exists. No data is deleted while an account is in force.
• A lapsed or inactive account (for example, one where a payment was missed and the Service has stopped working) is not the same as a deleted account. We retain all data for a lapsed account so that it is intact if you reactivate.
• You may delete your account, and all associated data described above, at any time from within the Service. Deletion is immediate and permanent.
• Backups: created weekly. Each new backup replaces the prior one — we do not keep a rolling history of older backup sets. A deleted account's data is therefore fully removed from backups within one week of deletion, at the next backup cycle.

10.2 TimeCatchApp's Own Invoices and Payment Records

Separately from the content described above, TimeCatchApp issues its own invoices to you for your subscription, and receives payment confirmations from Stripe for those charges. These are TimeCatchApp's own financial and tax records, not your content, and they follow a different, fixed retention period:

• Invoices TimeCatchApp issues to you, and the associated payment status/amount/date records described in Section 3, are retained for 7 years to comply with applicable tax and accounting recordkeeping obligations.
• This retention period runs independently of your account status. These specific records are retained for the full period even if you delete your account, consistent with GDPR Art. 17(3)(b), which permits continued retention where required to comply with a legal obligation.

11. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and regular review of our hosting provider's security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

The Service is intended for business use by adults. We do not knowingly collect personal data from children.

13. Changes to This Statement

We may update this Privacy Statement from time to time. If we make material changes, we will notify you by email or through an in-app notice before the changes take effect.

14. Contact Us

Questions about this Privacy Statement or our data practices can be directed to: