Privacy policy

1. Who we are and what this policy covers

ClearHours is made by MYLABS AI SOLUTIONS (OPC) PRIVATE LIMITED, a company in Puducherry, India (“MYLABS”, “we”, “us”). This policy explains how we handle personal data when you:

• visit clearhours.app;
• sign up for a trial, buy a plan, or use ClearHours as an administrator or user of your organisation’s account;
• contact us.

Section 5 explains how personal data in the ClearHours service is handled for the organisations that use it, and where employees should go with questions.

ClearHours is a workplace product sold to organisations. It is not meant for children, and we do not knowingly collect personal data of children.

2. Our two roles

The Digital Personal Data Protection Act 2023 (the DPDP Act) separates the Data Fiduciary, who decides why and how personal data is processed, from the Data Processor, who processes it on the fiduciary’s behalf. We act in both roles, for different data.

We are the Data Fiduciary

for this website, for the accounts of the people who sign up for and administer ClearHours, for billing and for support conversations. This policy covers that data.

We are a Data Processor

for the data the ClearHours service holds about a customer’s employees: activity, attendance, timesheets, projects and the records around them. The customer, as employer, is the Data Fiduciary for that data and decides what is recorded, why and for how long. Our duties to the customer are set out in the data processing agreement.

3. This website

clearhours.app is a set of static pages.

• It sets no cookies.
• It loads no analytics, advertising, tracking or other third-party scripts, and no fonts or images from other sites.
• It has no forms, so nothing you type on it is sent to us.

To deliver the pages, our hosting provider, Microsoft Azure, receives your IP address and the details of each request, as any web server does. We do not use that data to identify or profile visitors.

Links to the free trial carry campaign tags that name the page and the button you used, for example utm_campaign=pricing. If you then sign up, the tags are kept with your organisation’s record so we can see which page led to the sign-up. They contain nothing about you.

4. Account, billing and support data

What we collect

When you sign up

Your organisation’s name and workspace address, your name and work e-mail, your country and, if you give them, the GSTIN, legal name and billing address. We record your acceptance of the terms with the time, your IP address and your browser details.

When you use the dashboard

Your user account: name, e-mail, role, sign-in identifiers and last sign-in time. The audit log records what you change and which pages about a named person you open. The dashboard keeps your sign-in session and a few preferences, such as your workspace and display settings, in your browser’s storage. It uses no analytics or advertising cookies.

When you pay

The billing contact, address and GSTIN, plan, seats and invoices. Card payments are made on Stripe’s own page: we never receive the card number or security code. Stripe sends us payment events that can include the billing name, e-mail, address and phone, and the card’s brand, last four digits and expiry date.

When you write to us

What you send us and our replies.

When you use the service

Request details, including IP address and browser, in our service logs.

Why we use it

• To create and run your organisation’s account and let you sign in.
• To send the e-mail the service needs: verification, invitations, notices and the digests your organisation switches on.
• To bill your organisation and issue GST tax invoices.
• To keep the service secure and to investigate incidents.
• To meet our legal duties, including GST record keeping and the CERT-In Directions of 2022, which require us to keep records of the customers who use our service.
• To send you product updates, only if you ticked the box for them at sign-up. You can ask us to stop at any time.

We do not sell personal data, use it for advertising or use customer data to train models.

5. Data in the service about employees

If your employer uses ClearHours, your employer is the Data Fiduciary and decides what is recorded about you. We process that data only on your employer’s instructions, under the data processing agreement. Your employer’s notice, shown when the agent first runs, says what is recorded and why.

The agent is visible: it shows an icon in the notification area, displays the notice and is listed among the installed programs. ClearHours gives no productivity scores or rankings and makes no automated decisions about people. When a manager or administrator opens a page about you, that is written to the audit log.

From the My data pages of the dashboard you can see what is recorded about you, download it, ask for erasure and raise a question or complaint, which gets a respond-by date no more than 90 days away. Your employer’s privacy contact is shown on the notice and on those pages.

If you write to us about data your employer controls, we pass your request to your employer within 5 business days and do not answer it ourselves, because the decision is your employer’s.

6. Who we share data with

• Sub-processors. A small number of providers process data for us, each only what it needs: Microsoft Azure, Stripe and Resend. The sub-processor list says what each one receives and where.
• Authorities. We disclose personal data to a government authority only when the law requires it, and only what it requires. Where the request concerns a customer’s data, we tell the customer first unless the law forbids it.
• Nobody else. We do not sell personal data, and one customer’s data is never shared with another customer.

7. Where data is processed

Service and account data

Microsoft Azure Central India, in Pune.

Website and dashboard files

Azure Static Web Apps in the East Asia region. These files hold no customer data.

Card payments

Stripe, which keeps Indian payment data in India. Stripe affiliates outside India may process data, depending on the service and the payer’s location.

E-mail

Resend, outside India. It receives the recipient’s address and name and the message, never activity data.

8. How long we keep data

Data we control

User accounts

Until an administrator removes the user, or until the organisation’s data is deleted after it leaves ClearHours.

Organisation records

For the life of the account and 5 years after it ends, as the CERT-In Directions require.

Invoices and billing records

For as long as GST law requires.

Payment events from Stripe

Deleted 400 days after we process them.

E-mail we send

Deleted 90 days after it was queued.

Service logs

At least 180 days, as the CERT-In Directions require.

Website visits

We keep no record of visits.

Data customers control

Each customer sets how long activity data is kept, from 30 to 3,650 days. A one-year minimum for India is on by default. Activity data older than the period is deleted every day. Attendance records, timesheet periods, work logs and the audit log are kept as records; they are removed for one person by an approved erasure request, and for everyone when the customer leaves ClearHours, as the data processing agreement describes.

9. How we protect data

• Data is encrypted in transit (TLS 1.2 or later) and at rest. Secrets are kept in Azure Key Vault; API keys and enrolment tokens are stored only as hashes.
• Each customer’s data carries its organisation key, which the service binds to every query. Row-level security in the database is a second line of defence.
• Roles limit who sees what. Viewers see team and organisation figures only, and groups smaller than the customer’s minimum size are withheld.
• Our staff open a customer’s data only for a support case or an incident, through the same role-based access customers use and from India. Every look is recorded in the customer’s audit log.
• If an incident affects a customer’s data, we tell the customer within 4 hours of noticing it and report it to CERT-In within 6 hours, as the CERT-In Directions require.

The security overview describes these measures in more detail.

10. Your rights

For the data we control as Data Fiduciary, you can ask us to:

• give you a summary of the personal data we hold about you, how we process it and whom we have shared it with;
• correct, complete or update it;
• erase it, unless the law requires us to keep it, for example GST and CERT-In records;
• stop using it for product updates, if you agreed to receive them;
• let a person you nominate use these rights for you if you die or become unable to.

You can also raise a grievance with us (section 11). If you are not satisfied with our response, you may complain to the Data Protection Board of India through the means the Board publishes.

For data about you in your employer’s ClearHours account, use the My data pages or contact your employer’s privacy contact (section 5).

11. Questions and grievances

Send questions, requests and grievances about this policy or the data we control to us. We respond within 90 days at most, and we may ask you to confirm your identity before we act on a request.

Privacy and grievance contact

support@clearhours.app

Company

MYLABS AI SOLUTIONS (OPC) PRIVATE LIMITED

Registered office

6 Atchutha Padayatchi Street, Mudaliarpet, Puducherry, Pondicherry, India, 605004

CIN

U72900PY2019OPC008482

GSTIN

34AANCM0560F1ZN

12. Changes to this policy

When we change this policy we publish the new version on this page with a new version number and date. If a change affects how we use account data in a material way, we tell the administrators of each customer organisation by e-mail before it takes effect.