Privacy policy

When your business uses HoursEasy, your business decides what is recorded about your workers and why. In the language of the Australian Privacy Principles you are the entity handling that information, and HoursEasy holds it on your behalf.

HoursEasy is responsible for keeping it separated from every other customer, for the sub-processors listed below, and for the information collected directly from you when you enquire or sign up.

HoursEasy is operated by A.C.N. 640 377 457 Pty Ltd, ABN 33 640 377 457.

From the business: the organisation name, its timezone, billing details, and the name and email address of whoever administers the account.

From field workers: name, email address, the hours they record against a project, any consumables they log, photographs they attach, and their device sending those records when a connection is available.

From the person who signs a docket: their name, their signature as an image, and their email address where they give one. The real signed dockets this product was built from often collected no email at all, so it is optional.

From visitors to this website: page views through Vercel Analytics, which sets no cookies; visit, click and advertising-measurement data through Google Analytics; and, when you arrive from a link that names its campaign, which campaign that was. Each is described in its own section below.

Producing approved hours totalled by staff for payroll and by client for invoicing, and the dockets, summaries and exports built from them. Nothing recorded in HoursEasy is sold, and it is not used to train anything.

HoursEasy computes no pay, no cost, no margin and no GST. It records hours against the rate a project’s own rate table names, and everything after that happens in your accounting software.

Supabase provides the database, authentication and file storage. Vercel serves the application and this website. Resend sends transactional email such as sign-in links, invitations and signing links. Where these providers offer Australian regions, Australian regions are used.

Transactional and marketing email never share a channel. That is deliberate: it means unsubscribing from anything promotional can never suppress somebody’s sign-in link.

Nobody else receives it, and there is no data broker. Google, described below, learns which of our ads and campaigns lead to a sign-up; it never receives anything your business records in HoursEasy. If you buy a plan, the campaign that brought you travels through Stripe’s checkout with the rest of your order, so that it can be stored with your new organisation.

This website, hourseasy.com, uses Google Analytics to learn which pages people read and which sign-up buttons they press, and to measure which of our Google ads lead to a sign-up. No Google script is loaded inside the HoursEasy product, and nothing your business records in HoursEasy is sent to Google.

Google receives the page address, the page you came from, your browser, device type and screen size, an approximate location derived from your connection, which sign-up button you pressed, and, if you arrived from one of our Google ads, the click identifier Google added to the link. It sets first-party cookies named _ga and _ga_<id> to recognise a returning browser, and where an ad click is measured it may set cookies beginning _gcl. Google processes this data on servers outside Australia, including in the United States. Google Analytics does not store IP addresses.

Two things are reported to Google Analytics from the product’s server, without any script running in your browser: that an organisation signed up (with whether it chose Free or a trial, and which plan), and that it connected a real Xero organisation for the first time. Each report carries the browser identifier from the _ga cookie and the campaign tags described below; the sign-up report also carries the session number from that visit. HoursEasy adds nothing else: no name, email address, organisation name or anything recorded in HoursEasy. The campaign tags are sent as they were recorded, so a link someone else made with personal details in its tags would pass those on. Neither is reported when the request that triggers it comes from a browser sending a Global Privacy Control signal or from the European Economic Area, the United Kingdom or Switzerland.

Ad personalisation and Google signals are turned off, so we do not ask Google to link this data to Google accounts or to use it to personalise ads. Event-level data is set to expire after two months, and Google deletes expired data in monthly batches; its reports keep aggregated totals, which identify nobody.

Visitors from the European Economic Area, the United Kingdom and Switzerland are treated as not having consented: no analytics cookie is set, and Google receives only cookieless measurement pings, without analytics cookies or a persistent browser identifier.

To opt out: if your browser sends a Global Privacy Control signal, Google Analytics is not loaded at all. You can also install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout, or use a browser or extension that blocks Google Analytics. Blocking cookies alone stops a returning browser being recognised, but not the visit being counted. The website works the same either way.

When you arrive on hourseasy.com or the product from a link that carries campaign tags (utm_ parameters) or an ad click identifier, a first-party cookie named he_attr records those tags, the page you landed on and the website you came from, for 90 days. If you then sign up, they are stored with your organisation, so that we know which campaigns work.

If you start a Free sign-up, they are also held on your sign-in account. That copy is normally removed when your organisation is created. Otherwise it stops being used after 90 days, and a weekly clean-up deletes it within a week after that. If a clean-up run fails, it is flagged to us and the next week’s run deletes it.

The tags in our own links name a channel and a campaign, never a person. Tags someone else put on a link are stored as they arrived, except that spaces at either end are removed, campaign tags are lowercased and each value is cut to 200 characters; ad click identifiers keep their case. A link with unusually long tags may have some of them left out altogether. Attribution stored with an organisation is kept while its account is open and deleted with it.

The cookie is not set, and nothing is read, stored or reported, when the request doing it comes from the European Economic Area, the United Kingdom or Switzerland, or from a browser that sends a Global Privacy Control signal. For a paid plan, that request is the one that starts checkout; what it read is then stored when the payment completes.

To give support, HoursEasy can see account details: which organisations a person belongs to, their role, when they last signed in, pending invitations and the state of the subscription. These are looked at to answer a request from you or to deal with a security problem, and not otherwise. Viewing them does not open anybody’s hours, dockets or photographs.

An admin of an organisation can also give HoursEasy support access to the account itself for 24 hours, to help with a problem. While that lasts, support can see and change what an admin can, except sending to payroll, invoicing or Xero, deleting anything, inviting people and billing. The organisation’s admins see that support has access, can end it at any time, and can see everything support changed.

If an account looks compromised, for example because a phone has been lost or stolen, HoursEasy can remove that person’s access to an organisation or suspend their sign-in everywhere. Every such action is recorded with the reason for it.

HoursEasy never signs in as you or as anybody on your account.

For as long as the account is open, because a timesheet from two years ago is the evidence behind an invoice from two years ago. When an account closes, the data is retained for ninety days so it can be recovered by mistake-correction, then deleted.

Export everything at any time as CSV or PDF. There is no export fee and no notice period on getting your own numbers.

Write to hello@hourseasy.com to see what is held about you, to have it corrected, or to have it deleted. If the request concerns records held on behalf of an employer, we will tell you and put you in contact with them, because they decide what happens to their own records.

If a complaint is not resolved to your satisfaction, the Office of the Australian Information Commissioner accepts complaints at oaic.gov.au.

Every customer’s data is isolated at the database level by row-level security, and that isolation is covered by an automated test suite that runs against a real database rather than a mock. Access to production is limited to the people who operate the service.

If a breach occurs that is likely to cause serious harm, affected people and the Information Commissioner will be notified, as the Notifiable Data Breaches scheme requires.