Privacy Policy

This policy explains how JobTally ("we", "us") processes personal data. The data controller is Pierre Lamey, entrepreneur individuel (France). You can reach us at contact@jobtally.com. We comply with the EU General Data Protection Regulation (GDPR).

1. Data we process

Account data (we act as controller)

• Business name, email address, and hashed password when you sign up.
• Subscription and billing status (via Stripe; we never store card numbers).
• Currency preference and settings you configure.

Your clients' data (we act as processor)

• Names, contact details, and invoice/quote data that you enter about your own clients. You are the controller of this data; we process it only to provide the Service, on your instructions, and never use it for our own purposes.

Technical data

• Standard server logs (IP address, user agent, timestamps) kept for security and troubleshooting.

2. Purposes and legal bases

• Providing the Service (accounts, invoices, payments) : performance of a contract (art. 6(1)(b) GDPR).
• Billing and accounting: legal obligation and contract (art. 6(1)(b) and (c)).
• Security, abuse prevention, service emails (e.g. trial and billing notices): legitimate interest (art. 6(1)(f)).

We do not sell personal data and we do not use it for advertising.

3. Cookies

We only use strictly necessary cookies: a session cookie to keep you signed in and a CSRF protection cookie. We use no advertising or cross-site tracking cookies, which is why the Service shows no cookie banner.

4. Processors and recipients

Personal data is shared only with the providers that run the Service:

• Stripe(Stripe Payments Europe Ltd / Stripe Inc.): subscription billing and, through your own Stripe account, your clients' card payments.
• Vercel (Vercel Inc.): application hosting.
• Neon (Neon Inc.): database hosting.

Where these providers process data outside the EU/EEA, transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

5. Retention

• Account and invoicing data: for the life of your account, then deleted or anonymized within 30 days of account deletion (invoices may be retained longer where bookkeeping law requires).
• Billing records: as required by French accounting law (up to 10 years).
• Server logs: up to 12 months.

6. Your rights

You have the right to access, rectify, erase, and port your data, to restrict or object to processing, and to withdraw consent where processing is based on consent. Contact contact@jobtally.com to exercise these rights; we respond within one month. You may also lodge a complaint with the French supervisory authority, the CNIL.

If you are a client of a business that uses JobTally, that business is the controller of your data. Please direct requests to them; we will assist them in fulfilling your rights.

7. Security

Data is encrypted in transit (TLS) and at rest, passwords are stored hashed (bcrypt), and access to production systems is restricted. No method of transmission or storage is 100% secure, but we take commercially reasonable measures appropriate to the risk.

8. Changes

We will announce material changes to this policy by email or in the app. The "Last updated" date above reflects the latest version.