Who we are
Time Off is provided by Mathies Ltd t/as TimeHR, company number 17377242. For anything in this policy, email support@timehr.io or write to Mathies Ltd, Timms Tower, 331 Stroud Road, Gloucester, GL4 0AY.
When your employer uses Time Off, they decide what leave data is recorded and who can see it. They are the data controller for that information, and we process it on their behalf. We are the controller for the account and billing information we hold about them directly.
What we collect
- Your identity at work: name, work email address, start date, role, team membership and your chosen calendar colour.
- Your leave: the dates you book, whether they were approved, your remaining allowance and any note you add to a request.
- Sign-in data: passkey credentials, single-use email sign-in links and, if set, a password stored only as a one-way hash.
- Technical data: your IP address, used to rate-limit sign-in attempts and prevent abuse, and a device token if you turn on push notifications.
We do not use tracking or advertising cookies. Time Off sets only the cookie needed to keep you signed in. The TimeHR marketing website does not set analytics or advertising cookies.
Demo requests
If you ask for a demo on timehr.io, we collect your name, job title, company, team size, work email and, if you give it, your phone number. We use it only to arrange and follow up the demo, on the basis of our legitimate interest in responding to your request. It is sent to our support inbox by Resend and is not stored by the website. Your IP address is held in memory for up to an hour to limit abuse of the form. We delete your details within 12 months if you do not become a customer.
Why we can use it
We use the data to provide the service your employer has asked us to provide. For security measures such as sign-in rate limiting and the audit log, we rely on our legitimate interest in keeping accounts safe.
Sickness and other sensitive information
If your employer records sickness absence in Time Off, that may count as health information and has extra protection in law. Notes on a leave request are free text, so avoid putting medical detail in them unless your employer has asked you to.
Where your data is held, and who else touches it
Your data is stored on servers in Germany. We use a small number of suppliers who process data strictly on our instructions:
- Hetzner (Germany): hosting and backups.
- Resend: sending emails such as sign-in links, leave decisions and demo requests.
- Stripe: payment processing where a company subscribes. We never see or store card details.
How long we keep it
We keep the data for as long as your employer has an account with us. Backups are kept for 14 days. If your employer closes their account, everything belonging to it is deleted.
Your rights
You can ask for a copy of your data, ask us to correct it or ask us to delete it. You can delete your account from your profile page. We remove your name, email address and sign-in details. Your booked dates remain on your team calendar so its records still add up, but they are no longer linked to you.
You can export your leave using the calendar feed on your profile, or ask your admin for the allowance report. You can also object to or ask us to restrict how we use your data. Email support@timehr.io. If you are unhappy with our response, you can complain to the Information Commissioner's Office.
If you are in the United States
Depending on your state, you may have rights to know what personal information we hold, to have it deleted, to correct it and not to be discriminated against for exercising those rights. We do not sell personal information or share it for targeted advertising. Email support@timehr.io to exercise these rights. Your data is stored in Germany as described above.
Changes
If we change this policy in a way that matters, we will tell account admins by email. The version number is shown at the top of this page.