This Privacy Policy explains what personal data Bitrack (“Bitrack”, “we”, “us”) collects, why, who helps us process it, how long we keep it and the rights you have. For any privacy question or request, write to [email protected].
In short: your workspace’s data is yours; we use it only to run Bitrack for you; we don’t sell it, show you ads or train AI on it; and you can ask us about it at any time.
1. Our role
- Your account and our website: for the data about you as a Bitrack user (your name, e-mail, sign-in and security records) and for visitors to our website, we decide how the data is used: we are the controller.
- Workspace content: the data a workspace stores about other people (its clients and their contacts, the client people it invites to its client portal, leads, people who submit its lead forms, signers of its proposals and contracts) belongs to that workspace. The workspace’s company is the controller, and we process that data on its behalf, only to provide the Service. If you are one of those people, please contact the company that holds your data first; we will help them respond.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, work e-mail, password (stored only as a secure hash), role, photo, signature image, time zone, preferences | To create and run your account and workspace |
| Workspace content | Clients, contacts, leads, projects, tasks, time entries, files, proposals, contracts, tickets, messages, encrypted credentials | To provide the Service to the workspace |
| Client portal | Name, email and sign-in codes of the client people a workspace invites; their approvals, comments, tickets, meeting requests and replies to invitations | To let a workspace’s clients follow and approve their work |
| Invoices and payments | Invoice details, amounts, payment records and receipts. We do not take or store card numbers: clients pay by the methods each workspace offers | To provide invoicing to the workspace |
| Connected calendars | If you choose to connect Google Calendar or Outlook: your calendar account’s email, access keys (encrypted), and the times, titles and locations of your own events for the next two months (encrypted) | To put your Bitrack events in your calendar and show your busy times in Bitrack |
| Early access requests | Name, work email, company, team size, the kind of work and your message, plus the network address and country of the request | To review your request and reply to you |
| Signing records | Signer name, e-mail, time, IP address and device, a fingerprint of the signed document | To evidence who signed an agreement, and when |
| Security and usage records | Sign-ins, IP address, browser, active sessions, credential access history, e-mail delivery status | To keep accounts and workspaces secure, prevent abuse and troubleshoot |
| Product usage | Which features and pages are used, when, and by which role (for example “a task was completed”), never what you write | To learn what to improve, simplify or build |
| Error reports | Technical details of an error, without request contents or personal details | To find and fix bugs |
| Messages to us | What you send to [email protected] | To answer you |
We do not sell personal data, we do not use it for advertising, and we do not use workspace content to train AI models.
Google and Microsoft data
Connecting a calendar is optional and done by each person for their own account. Bitrack asks only for the permissions it needs: to manage a separate “Bitrack” calendar it creates, and to read your events so it can show when you’re busy. Your events are shown in full only to you; teammates only see that you’re busy. Disconnecting removes the Bitrack calendar from your account and deletes everything Bitrack read.
Bitrack’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to provide the calendar features you see in Bitrack, never for advertising, never to train AI models, and people at Bitrack don’t read it unless you ask us to for support, it’s needed for security, or the law requires it.
3. Legal bases
We process personal data to perform our agreement with you (providing the Service), for our legitimate interests in keeping the Service secure, preventing abuse and improving it, to comply with legal obligations, and, where the law requires it, with your consent, which you can withdraw at any time.
4. Service providers
We use a small number of providers to run Bitrack. Each processes personal data only on our instructions and under appropriate data-protection terms.
| Provider | Purpose |
|---|---|
| Hostinger | Servers that run the app and its database |
| Cloudflare | Network security and delivery, the sign-up robot check (Turnstile), and storage of our encrypted backups |
| Brevo | Delivery of the e-mails the Service sends |
| Google and Microsoft | Only if you choose to: “Continue with Google” sign-in, and connecting your Google Calendar or Outlook |
| Sentry | Error monitoring, set up to exclude personal details and request contents |
| Google Fonts | Typefaces on our website and app (your browser’s IP address reaches Google when a font loads) |
Some of these providers process data outside your country. Where that happens we rely on the safeguards the applicable law requires, such as standard contractual clauses. We may also disclose data where the law requires it, or to protect the rights, safety and security of our users and the Service.
5. Cookies
We use only the cookies needed for the Service to work, and no analytics or advertising cookies, so there is nothing to opt out of. The full list is in our Cookie Policy.
6. How long we keep data
- Account and workspace data are kept while the account or workspace is active.
- Items you delete stay in the workspace’s Trash for 30 days, so they can be restored, and are then deleted for good.
- Encrypted backups are kept for up to about 4 months and then deleted, so deleted data disappears from backups within that time.
- Early access requests are kept while we review them and for up to 12 months after, unless they become a workspace.
- Server logs are kept for 14 days. Sign-in history and the record of emails sent (the recipient and the kind of email, never its content) are kept for 180 days, and product usage records for 13 months. Signing records and credential access history are kept as long as the agreement or credential they belong to.
7. Security
Connections are encrypted in transit, each workspace is isolated from every other one, backups are encrypted and stored off-site, and secrets in the credentials vault are encrypted with a key for each workspace. Access within a workspace follows the roles and permissions its Owner sets. Our Security page has the details. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
8. Your rights
Depending on where you live (including under Jordan’s Personal Data Protection Law and, where it applies, the EU and UK GDPR), you can ask to:
- access the personal data we hold about you, or receive a copy of it;
- correct it or complete it;
- delete it, or restrict or object to how we use it;
- withdraw consent you have given.
Write to [email protected]. We will reply within 30 days, and may need to confirm your identity first. You can also complain to your data-protection authority.
9. Children
Bitrack is a business tool and is not intended for anyone under 18.
10. Changes
We will update this policy as the Service changes and show the date of the latest version at the top. If a change is significant, we will tell workspace Owners by e-mail or in the app before it takes effect.