Privacy policy

Last updated: [DATE]

Draft. Items in [square brackets] must be completed before this policy takes effect.

This policy explains what personal data Teamwik handles, why, and what you can do about it. Teamwik is run by [LEGAL NAME OR COMPANY NAME], [ADDRESS] (“we”). Contact: [CONTACT EMAIL].

Two roles

• Your workspace content. The company that creates a workspace decides what goes into it. For that content the company is the controller and we act as its processor, handling it only to run the service.
• Accounts and the website. For sign-up details, sign-in and keeping the service secure, we are the controller.

What we collect

• Account details: name, email address and a password. Passwords are stored only as a salted one-way hash, never in readable form.
• Workspace content: people’s job titles, skills and weekly hours; projects, tasks, logged time and comments; files your team uploads; review requests and approvals.
• The audit log: a record of actions in a workspace (who did what, and when), including attempts the system blocked. It is designed so entries cannot be quietly changed.
• Technical data: IP addresses held briefly in memory to limit repeated sign-in attempts, and [SERVER LOGS: what is logged and for how long].

Cookies

We use one sign-in cookie that keeps you signed in for up to 14 days, and, only while you sign in with Google, a short-lived cookie (10 minutes) that protects that step. Both are strictly necessary. We use no analytics or advertising cookies.

Why we use it, and our legal basis

• To provide the service you or your company signed up for (contract).
• To keep accounts and data secure and prevent abuse (legitimate interests).
• To send emails a manager asks for, such as invitations and password resets (contract).
• To meet legal obligations, for example tax records if paid plans are introduced (legal obligation).

Who else handles data

We use these providers, each only for its part of the service:

• Hosting: [HOSTING PROVIDER], in [REGION]. Workspace data and files are stored here.
• Resend, for invitation and password-reset emails a manager chooses to send.
• Google, only if you choose to sign in with Google.
• Stripe, only if paid plans are enabled, for payments. We never see full card numbers.
• An AI provider ([AI PROVIDER]), only when a manager uses an AI feature and the workspace has AI switched on. People's and project names are replaced with codes and email addresses are removed before anything is sent. What is sent depends on the feature: for staffing suggestions and team questions, job titles, skills and workload hours; for questions about the audit log, the log entries the server selected as relevant (actions, times, file names, commit messages and review comments); for a digest summary or a client update draft, the facts Teamwik computed (task titles, file names and notes, approvals, progress and dates; for a client update, only that project's); and for summaries of file changes, the changed lines of text files and their version notes, only if a manager has turned on “Let AI read text files”. File contents are never sent otherwise. Teamwik does not send AI drafts to anyone.

Where a provider processes data outside the UK, we rely on [UK adequacy regulations / the UK International Data Transfer Agreement or Addendum]. We do not sell personal data.

How long we keep it

• Workspace content and the audit log are kept while the workspace exists. Because the audit log is tamper-evident, individual entries are not edited or removed.
• A workspace manager can delete the whole workspace at any time from Team settings. Its data is removed from our servers straight away. Nightly backups are kept for 14 days, so deleted data leaves backups within that time.
• Sign-in sessions end after 14 days or when you sign out.

Your rights

Under UK data protection law you can ask to access, correct, delete or restrict your data, object to processing, and receive a copy in a portable form. For data in a company workspace, contact that company first; we will help them respond. You can also contact us at [CONTACT EMAIL].

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

Security

Passwords are hashed, sessions use secure cookies, uploaded files are stored by their fingerprint so changes can be detected, and backups are checked against the audit log. No system is perfectly secure; if a breach affects your data, we will tell you and, where required, the ICO.

Changes

We will post changes here and update the date above. For significant changes, we will tell workspace managers by email.