Privacy Policy

Who we are

eTime is operated by Sansavision, a division of Sansa Group AB, a limited company registered in Sweden (organisation number 559111-9507), Soldathemsgatan 20, 415 28 Göteborg, Sweden. Contact: support@etime.my. We haven't appointed a data protection officer; privacy questions go to the same address.

Two roles: your workplace's data and ours

Workplace data. When an organisation uses eTime to schedule its staff, the organisation (your employer, or the agency you work for) decides what goes in and why. It is the controller of that data, and we are its processor: we handle it only on its instructions, under our Data Processing Addendum. This covers staff, rosters, absences, time, pay estimates, clients and visits, and meeting guests. If you have a question about how your workplace uses your data, or want to use your rights, ask your workplace first. If you ask us, we'll pass your request on and help them answer it.

Our own data. We are the controller for your eTime account (sign-in and devices), your personal calendar and the calendars you link to it, billing, support and the technical data we need to run and protect eTime. The rest of this policy is mainly about that data, and about how we protect workplace data while we hold it.

What we collect as controller

• Account data: your email address and name (if you give them), your passkeys' public keys, and how you sign in. In a workplace that uses ID mode, you can have an account with a passkey and no email at all.
• Personal calendar: events you add yourself, and, if you link Google Calendar or Microsoft Outlook, the start and end times of your busy blocks there. We never read the titles, places or attendees of your own events in those calendars. The sign-in tokens for linked calendars are stored encrypted.
• Billing data: the workplace name, plan, the number of active people and payment status. Stripe holds the payment details; we never see your full card number.
• Device data: push notification tokens for the devices where you turn notifications on.
• Technical data: IP address, browser and device type, and request logs, used to run eTime, fix errors and limit abuse (for example, too many bookings from one place).
• Communications: messages you send to support and your notification choices.

What workplaces put into eTime

As processor we hold what a workplace adds: people (alias, and outside ID mode their name and contact details), roles, qualifications, units, availability and preferences, shifts and rosters, absences and leave, time entries, pay rates and cost estimates, meetings and the names and emails of guests who book them, and, in home visits mode, clients' contact details and visit plans. eTime is designed to keep this to the minimum:

• ID mode. A workplace can run eTime with aliases only (such as N-01). eTime then refuses real names; any names the workplace keeps stay on its own devices.
• Names are encrypted. Outside ID mode, people's names and contact details, client contacts and guest contacts are stored encrypted with a key for that workplace.
• No diagnosis, ever. A sick report records that someone is away sick and for which dates. eTime never asks for or stores a diagnosis, symptoms or medical certificates. Colleagues see only that someone is away.
• No surveillance. No continuous location tracking, productivity scores, keystroke or screen monitoring. If a workplace turns on a location check for clock-in, your phone sends one reading at the moment you clock in, after you agree; eTime compares it with the work area, keeps only whether you were inside, and throws the reading away. Kiosk QR codes and PINs don't use location at all.
• No care records. In home visits mode eTime may hold a link to a client's record in the agency's own care system, never the record's content.

Why we use it, and our legal bases

To provide eTime: signing you in, showing your shifts and calendar, sending the notifications you've asked for and keeping your devices in sync. Basis: performance of our contract with you or your workplace (GDPR Article 6(1)(b)).

To keep eTime safe: preventing abuse, spam and fraud, rate-limiting booking links and sign-in, and handling reports. Basis: our legitimate interest in protecting users and the service (Article 6(1)(f)), and our legal obligations under the EU Digital Services Act (Article 6(1)(c)).

To improve eTime using aggregated statistics that don't identify anyone, such as how many rosters were published. Basis: legitimate interests (Article 6(1)(f)).

Optional emails, such as the Monday briefing. Basis: your consent or our legitimate interest in sending you useful service emails (Article 6(1)(a) or (f)). You can turn them off at any time in your notification settings.

Bookkeeping and answering lawful requests from authorities. Basis: our legal obligations under Swedish and EU law (Article 6(1)(c)).

Where we rely on legitimate interests you can object, and we'll stop unless we have compelling grounds to continue.

Automated decisions

We don't make decisions with legal or similarly significant effects on you based solely on automated processing. eTime suggests rosters and a best pick for open shifts, with the reasons; a person in your workplace decides. A workplace can choose to let eTime pick automatically for open shifts. That is the workplace's decision as controller, and eTime still shows the reasons, which never reveal other people's pay, absences or preferences.

AI features

AI features run only when someone asks for them: chat, drafting rules from an agreement, finding the working-time rules for a country, and drafting a setup from a description, spreadsheet or screenshot.

• The AI sees aliases, not names. Before anything leaves eTime, names are swapped for aliases and contact details and ID numbers are removed. If a known name would still be sent, nothing is sent.
• Things you upload yourself. On a screenshot you cover the names before sending, and you see exactly what the AI will see. A PDF agreement or handbook you import is sent as it is, so don't import documents that contain personal data.
• No training, no keeping. Requests go through OpenRouter to Anthropic's Claude models with data collection turned off, so they aren't stored for or used in training. We don't log prompts or answers; we keep only the number of tokens used.

Who we share it with

Your workplace: it sees what you do in it (your shifts, time entries, leave and answers to shift offers). It never sees your personal calendar events. If you choose to, a workplace sees when you are busy, never what it is, and you can turn that off at any time.

Colleagues: what your workplace's transparency settings allow, such as the unit's schedule. Never your absence type or pay.

Service providers (subprocessors): Cloudflare (hosting, database, realtime, the roster solver and email delivery), OpenRouter and Anthropic (AI features, aliases only), Stripe (payments), Expo (push notification relay for the phone app), and AppHelm (visit counts on our public pages, only if you allow it). Each is bound by data protection terms; the full list, with what each receives, is on our Subprocessors page.

Services you connect: if you link Google Calendar or Microsoft Outlook, eTime exchanges data with that account as you've asked. The web app also loads its typeface from Google Fonts (see our Cookie Policy).

Authorities: when the law requires it, or to protect rights, safety and the integrity of the service.

We do not sell or rent personal data, and we don't use advertising trackers. On our public pages (the home page, docs, guide and these legal pages, never inside the app) we count visits with AppHelm, our own analytics, only if you say yes. See our Cookie Policy.

Where your data is stored, and transfers

eTime's database is held in the EU (Cloudflare D1 with EU jurisdiction). Cloudflare's network serves eTime from the location nearest to you. Some of our providers are based in the United States, and data they receive (for example aliased AI requests, push tokens, billing data) may be processed there. Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework where the provider is certified, and on the EU standard contractual clauses otherwise. Ask us for a copy of the safeguards.

Retention

• Sign-in codes and links: 10 minutes, and they work once. Sessions: 12 hours, renewed while you use eTime.
• Location readings at clock-in: not kept at all; only inside or outside is stored.
• AI prompts and answers: not logged.
• Account data and your personal calendar: while your account exists, and deleted within 30 days after you ask us to delete it.
• Workplace data: as long as the workplace keeps it, or as the law requires (for example working-time records). When a workplace asks us to delete it, we delete its data within 30 days, and backup copies expire within a further 30 days.
• Bookkeeping records for purchases: seven years (Swedish Bookkeeping Act).

Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time.

For data your workplace holds about you, ask your workplace; it is the controller, and we help it answer. For your account, personal calendar and other data we control, email us. Some things are self-service: you can remove passkeys and unlink calendars in your account, and stop sharing busy/free or location at any time.

For anything else, email support@etime.my. We may ask you to confirm your identity, and we'll respond within one month (or tell you within that month if a complex request needs up to two more).

Complaints

If you think we've handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, which supervises us, or to the data protection authority where you live or work.

Security

We use encryption in transit and at rest, field-level encryption of names and contact details, passwordless sign-in, role-based access and an audit log. See our Security page for details.

Children

eTime isn't directed to children. Young workers may use it when their employer invites them, and the employer is responsible for any consent the law requires. If you believe a child has given us personal data without the right to, contact us and we'll delete it.

Changes

We'll post updates here and notify you of material changes by email or in the app.