CLOCKASK · LEGAL

Privacy policy

Last updated: 13 September 2026

1. Controller

nullpoint IT-Services GmbH
Lynkeusgasse 28, 1130 Wien, Österreich
mail@nullpoint.at

Privacy requests may be sent to this email address.

2. Data and purposes

ClockAsk processes account and login data, settings, projects, check-ins, time allocations and exports. Technical connection and log data is generated when the service is accessed. We use this data to provide, synchronise and secure ClockAsk, manage accounts and support, and handle billing under Article 6(1)(b), (c) and (f) GDPR.

3. Service providers and recipients

netcup GmbH in Germany hosts our website, API and database. Brevo sends account confirmation and password-reset emails. Database backups are stored by Wasabi Technologies LLC in Frankfurt and deleted after 30 days; support and metadata processing may involve the United States. With consent, seriouscode GmbH in Austria provides Vemetric product analytics, using EU servers and Cloudflare infrastructure. Stripe handles payments and subscriptions; Google provides optional sign-in; GitHub serves desktop downloads and update checks. Depending on the processing, Stripe, Google and GitHub may act as independent controllers. International transfers may rely on an adequacy decision, including the EU-US Data Privacy Framework, or EU Standard Contractual Clauses; copies of applicable safeguards may be requested from us.

4. Analytics and cookies

Vemetric is loaded only with consent. We send an internal user ID, the product surface and fixed usage events, but no name, email address, time-entry content, project or check-in IDs, report dates, full URLs or authentication tokens. The necessary session cookie expires after 30 days; the analytics choice is stored for up to one year. Consent can be withdrawn at any time.

5. Retention and rights

Account and content data is generally retained for the contractual relationship and then deleted unless legal retention periods or claims require longer storage. Sessions expire after 30 days, database backups are deleted after 30 days, and analytics events are retained for one month under Vemetric’s free plan. The analytics choice on the device is stored for up to one year. You may request access, rectification, erasure, restriction, portability or object to processing, and may complain to the Austrian Data Protection Authority at dsb.gv.at. No solely automated decision with legal or similarly significant effect is made.