Privacy policy

Who we are

Teamfold is operated by [Company legal name], [address], [registration number] ("we"). Contact for privacy matters: [privacy contact email].

Our two roles

For account data of the people who sign up and for billing contacts, we act as data controller.

For the data that organisations put into Teamfold about their members (time records, meetings, custom databases), the customer organisation is the controller and we act as processor under a data processing agreement (GDPR art. 28). Employees should address requests about that data to their employer first.

Data we process

Account: name, email, password hash (never the password itself), language preference, sessions (device information and last activity).

Workspace content: memberships and roles, attendance records with timestamps and correction history including the reason and the author, meetings and participants, and content of custom databases.

Billing: handled by Stripe. We store the Stripe customer and subscription identifiers, invoice amounts and statuses; we never receive full card numbers.

Technical logs: IP address for security and rate limiting, kept for a short period.

Purposes and legal bases

Providing the service and the account (performance of a contract); security and fraud prevention (legitimate interest); billing and accounting obligations (legal obligation); optional privacy-friendly analytics only with consent.

Employers using attendance features must inform their staff and rely on an appropriate legal basis under labour law; Teamfold provides transparency tools (change history visible to the person concerned, data export).

Retention

Account data is kept while the account exists. Each organisation sets how long time records are kept (default 60 months). Billing records are kept for the period required by tax law. Deleted accounts are removed; time records kept by an employer are anonymised.

Recipients and transfers

Sub-processors: hosting and database provider [provider, region], Stripe (payments), [email provider] (transactional email). Where data leaves the EEA, transfers rely on adequacy decisions or standard contractual clauses.

Your rights

You can access, rectify, export and delete your data, object to or restrict processing, and withdraw consent. Most actions are available in your profile (data export and account deletion). You may lodge a complaint with your supervisory authority (in Portugal, the CNPD).

Security

Passwords are hashed with scrypt, sessions use secure HTTP-only cookies, access is enforced on the server and with database row-level security, and data is encrypted in transit.