Privacy Policy

Last updated: October 2026

TimerOff ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect when you use timeroff.com and the TimerOff app, why we use it, and the rights you have under the UK GDPR, the EU GDPR and US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA).

Who is responsible for your data

For visitors to our website, advertisers and employer account holders, TimerOff is the controller. For employee records that an employer manages in its workspace (overtime, time off, GPS shift records), the employer is the controller and TimerOff acts as its processor under our Data Processing Agreement. Employees should direct requests about workspace data to their employer first; we will help the employer respond.

Information we collect

• Account data: name, email address, password (stored hashed), role and company.
• Work records: job title, employee code, overtime entries, time-off requests, approvals, decline comments and balances.
• Location data (only when you use the shift tracker): GPS coordinates and accuracy captured at the moment you clock in and clock out. We do not track location continuously or in the background.
• Notes sent to the AI helper: the free-text overtime note you choose to submit is sent to an AI model to suggest form values. It is not used to train models and nothing is saved until you submit the form yourself.
• Advertiser data: business contact details, ad images, links, booking and invoice records.
• Technical data: IP address, browser and device type, pages visited, and ad views and clicks, collected through cookies and similar technologies.

Why we use it and our legal basis

• To provide the service, sign you in, calculate balances and send notifications — performance of a contract.
• To keep the service secure, prevent abuse and keep business records — legitimate interests and legal obligation.
• GPS shift records — the employer's legitimate interest in verifiable attendance records, and only when the employee chooses to clock in; your device will ask your permission first.
• Personalised advertising and non-essential cookies — your consent, which you can withdraw at any time.

Cookies and advertising

Public content pages may show Google AdSense ads and our own sponsor banners. Ads are never shown on the sign-in page or inside the logged-in app. Until you click "Accept all" on our cookie banner, ads are requested as non-personalised. If you accept, Google and its partners may use cookies to serve ads based on your visits to this and other sites. You can opt out of personalised ads at Google Ads Settings and learn how Google uses data at How Google uses information from sites that use its services.

Change my cookie choices

Who we share data with

We do not sell your personal information for money. We share data only with service providers that help us run TimerOff — cloud hosting and database, email delivery, the AI model provider for the note helper, and Google for advertising on public pages — under contracts that limit their use of the data. Within a workspace, employers can see their employees' records. We may disclose data where required by law.

International transfers

Our providers may process data outside the UK and EEA, including in the United States. Where that happens we rely on adequacy decisions, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as long as UK law requires. Our standard retention periods are:

• Overtime, working-time and time-off records: at least 2 years, as required by the UK Working Time Regulations 1998, and up to 6 years after the end of the tax year they relate to where they affect pay or holiday (HMRC record-keeping rules and the limitation period for claims).
• GPS clock-in/clock-out records: kept with the related shift record for the same period, unless the employer deletes them sooner.
• Account data: while the account is active, then deleted or anonymised within 90 days of closure, except records we must keep under the periods above.
• Billing and advertiser invoices: 6 years from the end of the financial year, as required by UK company and tax law.
• Support emails: up to 2 years after the conversation ends.
• AI helper notes: not stored — only what you choose to submit is saved.
• Cookie consent choices: up to 12 months, after which we ask again.

For workspace data, the employer (as controller) may set shorter periods or ask us to delete records earlier, provided it meets its own legal obligations.

Your rights (UK and EU)

Under the UK GDPR and the Data Protection Act 2018 you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent at any time. Requests are free in most cases. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or the authority in your EU country. We would appreciate the chance to resolve your concern first.

Your rights (United States)

Depending on your state, you may have the right to know what personal information we collect, to access, correct and delete it, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising. Do Not Sell or Share My Personal Information: click "Change my cookie choices" above and choose "Reject non-essential", or email us. We honour Global Privacy Control signals where required. We will not discriminate against you for using these rights.

How to make a request

Email support@timeroff.com. We reply within one month (UK/EU) or 45 days (US) and may need to verify your identity.

Cookies and electronic marketing (PECR)

In line with the UK Privacy and Electronic Communications Regulations, we only set non-essential cookies after you consent, and we only send marketing emails if you opt in. Service emails (such as approval notices) are not marketing. Every marketing email includes an unsubscribe link.

Automated decisions

We do not make decisions with legal or similarly significant effects about you using only automated processing. The AI helper only suggests form values; a person always reviews and submits them, and employers make all approval decisions.

Security

We protect your data with appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, role-based access so employees only see their own records and employers only see their own workspace, database-level access rules, and restricted staff access. If a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell affected users without undue delay, as the UK GDPR requires.

Children's privacy

TimerOff is a workplace tool and is not directed at children under 16. We do not knowingly collect their data.

Changes to this policy

We will post changes on this page with a new "last updated" date, and tell account holders by email about significant changes.