Track

Privacy Policy

Track ("the app") is a time-tracking and billing tool for freelancers. This policy explains what personal data the app processes, why, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller for your account data is:

• Valderas BV, Raapstraat 2 403, 9100 Sint-Niklaas, Belgium. Enterprise no. BE 1035.767.483
• Contact: inti@valderas.be

For the data you enter about your own clients (names, VAT numbers, amounts), you are the controller and Valderas BV acts as your processor (see §7).

2. What data we process

Account data

• Your email address, used to create your account and send you one-time sign-in codes. Sign-in uses a six-digit code by email; we do not store a password.

Content you enter (only you can see it, see §5)

• Clients: name, VAT number, and an optional grouping label.
• Projects: name, billing mode, and rate.
• Time entries: start/end times, an optional note, billable flag, and rate.
• Costs: description, amounts, and dates.
• Time off: a date range, a type (personal, vacation, sick, other), and an optional note. If you choose the "sick" type or write health information in a note, that is data concerning health (a special category under GDPR Art. 9); you decide whether to record it. We recommend keeping notes to a short label.
• Your business profile: business name, address, VAT number, and an optional logo, used to brand exported timesheets.

We do not collect: analytics, advertising identifiers, location, contacts, or any tracking data. The app contains no third-party trackers or ad SDKs.

3. Why we process it, and the legal basis

• To provide the app you asked for, recording your time, computing what you are owed, and producing timesheets. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To send sign-in codes to your email. Same basis.
• Any health data you choose to enter (sick leave) is processed only because you chose to record it. Legal basis: your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by deleting that entry.

We do not use your data for advertising, profiling, or automated decision-making, and we never sell it.

4. Who else processes it (sub-processors)

Your data is handled by a small number of providers, all offering EU data regions and standard data-processing terms:

Scaleway only receives your email address and the sign-in code, for the moment it takes to deliver the message. No content you enter is shared with it.

5. Where it is stored, and how it is protected

• Data is stored on EU servers (Supabase, eu-west-1).
• Every account's rows are isolated by row-level security: a signed-in user can only ever read or write their own data. Your clients, entries, and amounts are not visible to other users.
• Traffic is encrypted in transit (HTTPS/TLS). Your sign-in session token is stored in the device's secure keychain.
• Honesty note: your content is stored in readable form on our servers. It is access-controlled and encrypted at rest by the hosting provider, but it is not end-to-end (client-side) encrypted, so the operator technically has the ability to access stored data. We do not access it except as needed to operate the service or where legally required.

6. How long we keep it

We keep your data for as long as your account exists. You can delete your account at any time in the app (Settings → Delete account); this permanently erases your profile, clients, projects, time entries, costs, bills, and time off from our servers. There is no separate "paid" archive.

7. Data about your clients

When you enter a client's name, VAT number, or amounts, that is personal data of a third party for which you are the controller. Valderas BV processes it only to run the app on your behalf (as your processor), stores it in the EU, and deletes it when you delete the record or your account. You are responsible for having a lawful basis to record your clients' data and for responding to their requests; we will assist you where the app makes that possible (export, deletion).

8. Your rights

Under the GDPR you can, at any time:

• Access the data we hold about you and rectify anything inaccurate.
• Erase it, via in-app account deletion, or by contacting us.
• Port it, export your data (timesheets today; a full export on request).
• Restrict or object to processing, and withdraw consent for any health data you recorded.
• Complain to a supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), gegevensbeschermingsautoriteit.be.

To exercise any of these, email inti@valderas.be. We respond within 30 days.

9. Children

Track is a professional tool and is not directed at children under 16. We do not knowingly collect data from them.

10. Changes to this policy

If we change how we handle your data we will update this page and its "last updated" date, and, for material changes, notify you in the app or by email.

11. Contact

Questions or requests: inti@valderas.be.

Last updated, 31 July 2026