Privacy Policy
Last updated: 21 October 2026
1. Who we are
Network Place S.L., tax ID (NIF) B40203689, C/ Pablo Freire, 10, local 3, 28918 Leganés (Madrid), Spain (“we”) operates LockedHours. We are the controller of the personal data described in sections 3 to 10. We have not appointed a Data Protection Officer because the law doesn’t require one for us; for any privacy question write to [email protected].
2. Customer Data: when we act for our customers
The time entries, clients, contacts, projects, invoices and other records that a company puts into LockedHours, or imports from another service, are “Customer Data”. For Customer Data, the company that uses LockedHours is the controller and we are its processor (or “service provider”), under our Data Processing Agreement. If your employer, your supplier or a firm you work with uses LockedHours and you have questions about your data, please contact them first; we’ll help them answer you.
3. What we collect, why, and on what basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Waitlist: email, campaign (UTM) parameters, referring website's domain, sign-up page, confirmation time | Tell you when LockedHours opens; measure which channels work | Your consent (Art. 6(1)(a)), given by confirming your email. Withdraw it at any time by replying to any of our emails or writing to us | Unconfirmed: 30 days. Confirmed: until you withdraw consent, or 12 months after we open to everyone |
| Account: name, email, organisation, role, sign-in method, a one-way hash of your password if you set one, sign-in records (time, IP address, browser). If you sign in with Google or Microsoft, they send us your name, email and a profile identifier; we don't get access to your mailbox, contacts or files | Create and secure your account; sign you in with one-time links, a password, Google or Microsoft | Contract (Art. 6(1)(b)); security: legitimate interest (Art. 6(1)(f)) | While the account exists; sign-in records up to 12 months |
| Teammates you invite: the name and email you give us | Send the invitation and add them to your account | Legitimate interest of you and us in letting you invite your team (Art. 6(1)(f)). The invitation tells invitees who invited them | Pending invitations expire after 14 days; then as Account |
| Billing: company name, address, VAT ID, billing email, subscription and payment history (card details are handled by Stripe, not us) | Charge for the Service, issue our invoices, meet tax and accounting duties | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Subscription period, then 6 years (Spanish Commercial Code, Art. 30; General Tax Law, Art. 66), with access restricted |
| Support messages and our replies | Answer you and improve our help | Contract (Art. 6(1)(b)) for customers; legitimate interest (Art. 6(1)(f)) for others | 3 years after the conversation ends |
| Website visits (our marketing pages and the sign-in page, not the app): the page, the referring website's domain, campaign (UTM) tags, whether the link carried an ad click identifier (gclid, msclkid, fbclid or li_fat_id; never its value), country (from our network provider, not looked up from your IP address), device type, browser family and language, and a daily visitor code: a one-way hash of your IP address and browser with a random value that changes every day and is deleted the next day. We never store your IP address, set no cookies and store nothing on your device. If you sign up, which pages and campaign brought you is linked to your new account (a keyed hash of your email is kept for at most 30 days to make that link) | Count visits and sign-ups, and learn which pages, channels and campaigns work, in aggregate | Legitimate interest (Art. 6(1)(f)): measuring our own website, without cookies or third parties. If your browser sends Do Not Track or Global Privacy Control, we don't record your visit or link it to your sign-up | Visits: 25 months. The daily random value: 1 day. Sign-up link: while the account exists |
| Product and service data: a small set of events (waitlist signup, sign-up started and completed, first use, trial started and ended, paid, cancelled, import started and completed, data export, account closure scheduled or cancelled) linked to your organisation, plus technical logs | Understand whether the product works, keep it secure, fix errors, bill correctly | Legitimate interest (Art. 6(1)(f)): running and improving a reliable service. You can object (section 7) | Events: 24 months, then aggregated. Server logs: up to 30 days |
| Errors you hit in the app: page path, error message and time (never what you typed) | Answer your support requests without asking you to repeat what went wrong; fix errors | Legitimate interest (Art. 6(1)(f)): reliable support and service. You can object (section 7) | 30 days |
| Records of acceptance of our Terms: email, Terms version, time, browser | Prove what was agreed | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | 6 years after the contract ends |
Giving account and billing data is necessary to sign a contract with us; without it we can’t provide the Service. Everything else is optional.
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22). We don’t sell personal data and don’t use it for advertising.
4. Support messages and AI
When you write to us, we process your message, your account details and any data you choose to share, to answer you (see the table above). We may use an AI model (Claude, by Anthropic, PBC) to help draft and translate our replies. A member of our team reviews, edits if needed and sends every reply; the AI never sends anything on its own and never decides anything about you or your account. What would be sent to the AI provider, as our sub-processor, under terms that don’t allow it to use the data to train its models:
- the subject and messages of your support conversation, and the path of the page you wrote from;
- a few facts about your account that don’t identify you: your role (admin, manager or member), whether your trial is active (and how many days are left) or has ended, whether the account is closing, which settings are on (required notes, weekly reminders, timesheet approval), your business’s country code and whether a tax ID is set, the status of your Harvest import, and which help articles probably apply;
- the errors you hit in the app in the last 7 days: the page path and the error message only, never what you typed;
- earlier answers we wrote to similar questions, with names, emails, amounts and numbers removed.
Never your name, email, organisation name, amounts, or your clients’ data. Replies drafted with AI say so. You can ask us not to use AI tools on your messages by writing “no AI” in your request (then nothing about your conversation or account is sent to it), and you can ask us at any time whether AI helped with a reply.
To help with support, we keep a record of errors you hit in the app (the page path, the error message and the time, nothing you typed) for 30 days. Our team sees them, with your account details, when you write to us.
Status: we don’t use AI for support yet. Anthropic is listed below as a planned sub-processor, and we will give customers 30 days’ notice before we start.
5. Cookies
We use only cookies that are strictly necessary to keep you signed in to the app (see section 10). Our marketing pages set no cookies and store nothing on your device. We count visits ourselves, without cookies, as described in section 3 (“Website visits”): the count runs on our own servers, we never store your IP address, and nothing is shared with anyone. We don’t use advertising pixels, third-party analytics or third-party cookies.
6. Who receives your data
Our service providers (processors), bound by data processing agreements:
| Provider | What it does | Where the data is | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database and sign-in | Ireland (EU) | Data stored in the EU. Standard Contractual Clauses for any access from outside the EEA |
| Railway Corporation | Application hosting | Netherlands (EU) | Application runs in the EU. Standard Contractual Clauses for any access from outside the EEA |
| Resend (Plus Five Five, Inc.) | Sending emails (sign-in links, invitations, invoices, notifications) | United States | Standard Contractual Clauses, and the EU–US Data Privacy Framework where the provider is certified |
| Stripe Payments Europe, Ltd. | Subscription payments (once paid plans are live) | EU and United States | Standard Contractual Clauses and the EU–US Data Privacy Framework. Stripe also acts as an independent controller for fraud prevention and financial regulation |
| Cloudflare, Inc. | DNS and network security | Global network | Standard Contractual Clauses, and the EU–US Data Privacy Framework where the provider is certified |
| Anthropic, PBC Planned, not active yet. We will give 30 days’ notice before we start. | Helping draft and translate support replies (the support conversation, the page path, non-personal account facts such as role, trial state and settings, and recent app error messages; never names, emails, amounts or client data) | United States | Standard Contractual Clauses, and the EU–US Data Privacy Framework where the provider is certified |
We may also disclose data to authorities when the law requires it. You can ask us for a copy of the Standard Contractual Clauses we rely on at [email protected].
Where your data is processed. LockedHours stores your account and Customer Data in the European Union: the database is in Ireland and the application runs in the Netherlands. A few providers process limited data in, or can access it from, the United States (for example, email delivery). These transfers are protected by the European Commission’s Standard Contractual Clauses or, where the provider is certified, the EU–US Data Privacy Framework.
7. Your rights
You can ask us to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest, by writing to [email protected]. You can withdraw consent at any time, without affecting earlier processing. We answer within one month. Account admins can also export and delete all their account data themselves from Settings. If you think we haven’t respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the authority where you live or work.
8. Deletion
When an organisation closes its account, everything in it is permanently deleted 30 days later, including the invoices it issued. During those 30 days an admin can export the data or cancel the closure; after that it cannot be recovered. We do not keep backups of Customer Data, so keeping your own copies, including of invoices you must keep for tax purposes, is your responsibility. We keep only the billing and acceptance records described in section 3, with access restricted, for as long as the law requires.
9. Security
We protect data with encryption in transit and at rest, database row-level security that separates each company’s data, short-lived encrypted import credentials and least-privilege access. See Security & data for details.
10. Cookies we set
| Name | Purpose | Duration | Type |
|---|---|---|---|
| sb-<project>-auth-token (may be split into .0, .1) | Keeps you signed in to the app | Up to 400 days, renewed while you use the app; removed when you sign out | Strictly necessary, first-party |
| sb-<project>-auth-token-code-verifier | Completes a sign-in link, password reset or Google / Microsoft sign-in securely (PKCE) | Until sign-in completes | Strictly necessary, first-party |
| lh_terms_pending | Remembers, for the few seconds you spend on Google or Microsoft, that you accepted the Terms on our page, so we can record it | 15 minutes, or until you come back | Strictly necessary, first-party |
These cookies are exempt from consent under Article 22.2 of Spanish Law 34/2002 because they are needed for the service you asked for. You can delete them in your browser; you’ll be signed out.
Storage on your device. So the app opens faster and the Time page works without a connection, your browser keeps copies of the app pages you open and the time changes you make offline (until they sync), on your device only. It’s strictly necessary for that feature, isn’t used to track you, and is deleted when you sign out.
11. If you received an invoice through LockedHours
Invoices sent through LockedHours are issued by the business named on the invoice, which is the controller of your data. We process your name, email and invoice details only on its behalf, to deliver the invoice, show it at its private link and send any reminders it has set up. For questions, contact the business that sent it.
12. Children
LockedHours is a business service and is not directed to children under 16. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.
13. Information for people in the United States
Who we are. Network Place S.L. operates LockedHours. For Customer Data, we act as a service provider or processor for the organisation that uses LockedHours; please direct requests about that data to that organisation, and we will help them respond.
Categories we collect (last 12 months): identifiers (name, email, IP address); commercial information (plan, billing records); internet activity on our site and app (request logs, the cookieless visit counts and the product events listed above); professional information you or your organisation enter (role, rates, time entries); and the content of messages you send us. Sources: you, your organisation, services you connect (such as Harvest), and our providers. We do not collect sensitive personal information for inferring characteristics.
Purposes: providing and securing the Service, billing, support, improving the product, and complying with law. Disclosures: to the service providers listed in section 6, for these purposes only, under contracts that restrict their use of the data.
No sale or sharing. We do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined in California law, and have not done so in the last 12 months. We do not use advertising pixels or third-party tracking cookies.
Do Not Track and Global Privacy Control. We don’t track you across third-party sites or sell or share personal information. If your browser sends a Do Not Track or Global Privacy Control signal, we also don’t count your visits to our website or link your sign-up to them, and we treat a GPC signal as a valid opt-out of sale and sharing.
Your rights. Depending on your state, you may have the right to know, access, correct, delete or obtain a copy of your personal information, and to opt out of sale, sharing, targeted advertising or profiling. We extend these rights to all users. Write to [email protected]; we will verify your request by email and answer within 45 days. You may use an authorised agent. You can appeal a refusal by replying to our answer; if we deny your appeal, you may contact your state attorney general. We will not discriminate against you for exercising your rights.
Retention is described in sections 3 and 8. Security and breaches: we protect personal information with the measures described on our Security page and will notify you and authorities as required by applicable state breach-notification laws. LockedHours is not directed to children under 13.
14. Changes
We’ll post any changes here with a new “Last updated” date and, if they’re significant, email account admins in advance.
Contact: [email protected] · Network Place S.L., C/ Pablo Freire, 10, local 3, 28918 Leganés (Madrid), Spain.