Privacy Policy

Tascimo (“Tascimo”, “we”, “us”) is a work management, time tracking and team activity platform, made up of this website, the web application at app.tascimo.com and the Tascimo desktop app for Windows, macOS and Linux. Tascimo is provided by:

TODO: Company legal name (e.g. Tascimo LLC)
TODO: Registered address, USA
TODO: State of formation and registration / EIN
Email: privacy@tascimo.com

For anything about this policy or your personal data, write to privacy@tascimo.com.

Tascimo is used by organisations, usually employers, to manage their teams’ work and time. That gives us two different roles:

• Processor for customer data. Everything an organisation puts into or collects through its Tascimo workspace, including projects, tasks, time records and desktop activity data about its people, is processed on that organisation’s behalf and on its instructions, under our Data Processing Agreement. The organisation is the controller of that data. If you use Tascimo through your employer, your employer decides what is tracked and who can see it, and is your first point of contact for questions about it.
• Controller for our own data. We are the controller for the data we need to run our service and business: account and sign-in data, security logs, support requests and communications with us, and visits to this website.

Account data

Your name, email address and password (stored only as a one-way bcrypt hash), your organisation and role, and optional profile details such as a photo, job title, department, an “about me” text and out-of-office status.

Sign-in and security data

Session tokens (stored only as hashes), the identifier of the computer your desktop app is signed in on, and an audit log of security-relevant events such as sign-ins, password changes, and member, role and tracking-setting changes, including the IP address and browser or device information of the person who made the change. Our servers also keep short technical request logs.

Timezone check

To keep time records consistent, the desktop app compares your computer’s timezone with the timezone suggested by your IP address. The IP address is used only for this lookup; the result is not stored with your account.

Support requests

When you email us, for example to ask for help or to request a demo, we process your name, email address, the message and anything you attach. When you book a demo on our website, the booking is handled by our scheduling provider Cal.com, Inc. (USA), which receives the name, email address, chosen time and any notes you enter, so it can schedule the call and send the invitation. We use these details only to hold the call and follow up on it.

This website

This website sets no cookies and uses no analytics or advertising tools. Our hosting provider may keep standard server logs (such as IP address and pages requested) for security. See our Cookie Policy.

On behalf of the organisation that uses Tascimo, we process:

Workspace content

Projects, tasks, comments, files and attachments, project messages, notes, goals, custom fields and anything else people add to the workspace, together with who created or changed it and when.

Time and attendance

Work sessions, start and end times, manual time entries, timesheets and their approval status, time-off requests and daily totals.

Desktop activity, while the timer is running

• Keyboard and mouse activity: whether the keyboard or mouse was used in each second, to separate active time from idle time. The keys pressed and the text typed are never recorded.
• Applications: the name of the application in use and its window title.
• Websites: for the active browser window, the website address (domain only) and the page title. Page contents and form entries are not recorded. To read the address the desktop app uses the operating system’s accessibility features; on Linux it may enable accessibility support in the desktop environment and in supported browsers.
• Screenshots: images of all connected screens at full resolution, taken at random moments within each 10-minute period, at the frequency the organisation sets for each person, together with smaller preview images. On Linux the desktop app takes screenshots without the system’s per-capture confirmation prompt.
• Idle time, the computer’s timezone, and the identifier of the device used.
• Automation tools: the names of running programs are checked against a list of known auto-clicker and “mouse jiggler” tools; only matches are recorded.

If the organisation connects Slack, Tascimo posts clock-in and clock-out notices (name, organisation, time and timezone) to the organisation’s chosen channel and uses the person’s email address to mention them in Slack.

Reports

Insights and reports derived from the data above, such as performance views, unusual-activity flags and scheduled PDF reports.

For employers: monitoring employees is regulated. Before you enable tracking you must have a legal basis for it and inform your staff about its scope, purpose and method, as required by the data protection and employment laws that apply to you. For example, the GDPR applies to staff in the EU and UK, and some US states, such as New York and Connecticut, require written notice of electronic monitoring.

We do not sell personal data. We share it only with the service providers that help us run Tascimo, under contracts that bind them to protect it:

Inside a workspace, the organisation’s admins and managers can see data according to the roles the organisation assigns.

We may also disclose data when the law requires it, or to protect the rights and safety of our users and of Tascimo.

Tascimo is operated by a company based in the United States, and our team may access data from outside the European Economic Area and the UK to run and support the Service. Files and screenshots are stored in the EU. Where personal data from the EEA or the UK is transferred to or accessed from another country, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Account data: while the account exists, then deleted or anonymised unless we must keep it longer by law.
• Session tokens: until they expire (7 days, or 30 with “remember me”) or you sign out. Password reset links expire after one hour.
• Deleted projects and tasks: kept in the trash for the organisation’s retention period (30 days by default), then removed.
• Customer data, including activity data and screenshots: for as long as the organisation keeps it in its workspace or instructs us otherwise, and deleted after the contract ends as described in the DPA.
• Support requests: as long as needed to resolve them and handle any follow-up.
• Accounting records: as long as tax law requires.

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. To use these rights, write to privacy@tascimo.com. We reply within one month.

If the data is customer data, for example activity data collected by your employer, we will pass your request to the organisation and help it respond, because it decides how that data is used.

You can also complain to the data protection authority in the country where you live or work. If you are in the EU or UK, you can also contact our representative there: EU: TODO: EU representative (name, address, email); UK: TODO: UK representative (name, address, email).

We use technical and organisational measures to protect personal data, such as hashed passwords and tokens, role-based access, audit logging and encrypted connections. See Security for details.

Tascimo is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect children’s data.

We will update this policy when our processing changes. The date at the top shows the latest version. If a change is significant, we will tell organisation admins by email or in the app before it takes effect.