Privacy policy

1. Controller

The controller responsible for data processing on this website and in the Firetracker application (“Firetracker”) is:

2. Overview

Firetracker is a time tracking application for teams. We process personal data only where this is necessary to provide the website and the application, to perform our contract, to comply with legal obligations, or where you have given consent. We do not use analytics or advertising trackers and we do not sell data.

3. Visiting the website and server logs

When you access Firetracker, our server processes technically necessary data: IP address, date and time, the requested address, amount of data transferred, browser and operating system details and the referring page. This serves to deliver the content and to ensure stability and security (e.g. defending against attacks, limiting sign-in attempts). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and error-free operation. Logs are deleted after 30 days at the latest unless they are needed to investigate a security incident.

Connections are encrypted with TLS. Certificates are issued by Let's Encrypt (Internet Security Research Group, USA); no visitor data is transmitted in the process.

4. Hosting

Firetracker runs on servers operated by an external hosting provider. The provider processes data solely on our behalf and according to our instructions (data processing under Art. 28 GDPR).

5. User account and use of the application

To register, we process your name, email address and password (stored only as a secure hash), as well as your language, time zone and the time you accepted the terms and privacy policy. Using the application creates content data such as time entries, projects, clients, time off, expenses with receipts, invoices and comments, and security data such as active sessions (device, IP address, time), sign-in attempts, two-factor settings and an audit log of changes.

The legal basis is Art. 6(1)(b) GDPR (contract) and, for security data, Art. 6(1)(f) GDPR. Data is stored for as long as the account exists. You can delete your account at any time in your profile; it is then anonymised. Under Profile › Privacy you can export all data stored for your account.

6. Data in workspaces (data processing on behalf of customers)

Companies and organisations that use Firetracker for their staff (“customers”) decide which data is recorded in their workspace – such as working hours, time off, optionally GPS locations when tracking time, and screenshots and application usage via the desktop app. The respective customer is the controller for this data; we process it as a processor under Art. 28 GDPR on the basis of a data processing agreement, which we provide to customers on request. Please direct questions about this data to your employer or the administrator of your workspace.

Location, screenshots and application usage are only recorded if the workspace has enabled the feature; the desktop app asks for your confirmation before the first capture.

7. Payment processing

Paid plans are billed via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. The data required for payment (name, billing address, email, payment details, amount) is transmitted to Mollie. You enter payment details such as card numbers directly with Mollie; we do not receive them. The legal basis is Art. 6(1)(b) and (c) GDPR. We keep billing records for the statutory retention periods (up to ten years). Mollie's privacy notice: mollie.com/en/privacy.

8. Emails

We send emails that are required for using the service (e.g. email confirmation, password reset, invitations, invoices) as well as notifications and scheduled reports that you can control in your settings. Emails are sent via the mail server of our email provider (data processing on our behalf). The legal basis is Art. 6(1)(b) GDPR.

9. Sign-in with Google, Microsoft or single sign-on

If you sign in via Google (Google Ireland Ltd.), Microsoft (Microsoft Ireland Operations Ltd.) or your company's identity provider, we receive your name, email address and an identifier of your account. We never learn your password. The legal basis is Art. 6(1)(b) GDPR. A transfer to the USA cannot be ruled out for Google and Microsoft; both are certified under the EU-US Data Privacy Framework.

10. Map view

Recorded locations are shown on a map. Your browser loads the map tiles from a map service (by default the OpenStreetMap Foundation, United Kingdom), which receives your IP address. The EU Commission has issued an adequacy decision for the United Kingdom. The legal basis is Art. 6(1)(f) GDPR. The map is only loaded when you open the location view.

11. Push notifications

If you enable push notifications, we store the endpoint created by your browser. Delivery takes place via the push service of your browser vendor (e.g. Google, Apple, Mozilla). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings or in your browser.

12. Cookies and local storage

We only use technically necessary cookies: a session cookie for sign-in and a cookie protecting against cross-site request forgery. We store settings (e.g. language) and data cached for offline use in your browser's storage. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. No consent is required for this.

13. Recipients and transfers to third countries

Data is only shared with the service providers named above or where we are legally obliged to do so. Transfers to countries outside the EU/EEA only take place as described above and where appropriate safeguards (adequacy decision, EU-US Data Privacy Framework or standard contractual clauses) are in place.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Please contact info@firepanda.ai.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

15. Obligation to provide data, no automated decision-making

The information requested at registration is required to conclude the contract; without it we cannot create an account. No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

16. Changes

We update this privacy policy when features or legal requirements change. The version published on this page applies.