Privacy Policy

1. Who we are and what this covers

ProjEase is provided by Dev Inception Limited, a company registered in Canada ("we", "us"). This policy explains how we handle personal information when you visit our websites, use the ProjEase Hub, Colloza, OrgEntity (including the OrgEntity Tracker), Plagenda or Bookuracy on the web, desktop or phone (the "Services"), or contact us.

It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). Words such as "controller" and "processor" have the meaning those laws give them.

2. Our two roles: controller and processor

The Services are used by organisations — your employer, or a company you work with. Most of the personal information in the Services is put there by, or recorded for, that organisation. Who decides what happens to it depends on what it is:

If you use the Services through your employer or another organisation, that organisation is responsible for your information in its Hub, and its own privacy notice applies. Questions and requests about that information — including asking for a copy, a correction or deletion — are best sent to the organisation first. If you contact us about it, we will pass your request on and help the organisation answer it.

3. Information we collect

3.1 You give us

• Account details — name, work email address, password (stored only as a one-way hash), profile photo, job title, department, phone number, time zone and preferences.
• Organisation and billing details — organisation name, logo and settings, the plan and products chosen, and the billing contact. Card details are entered into a form provided by Stripe and go directly to Stripe; we receive only a reference to the card, its brand, last four digits and expiry.
• Support and correspondence — what you tell us when you contact support, email us, or answer our messages.

3.2 Your organisation puts into its Hub (Customer Data)

• ProjEase Hub — members and their roles and product access, security settings, invitations, the audit log of important actions, support requests.
• Colloza — messages, reactions, files, shared documents and whiteboards, call participation and duration, and call recordings where someone records a call.
• OrgEntity — employee profiles and documents, contracts and compensation, leave and absence (which may include health information), attendance and time, clock-in location and network address where location-checked clock-in is turned on, expenses, recruitment and candidate records, performance and engagement records, policy acknowledgements, and privacy requests.
• OrgEntity Tracker — working time, activity levels, idle time, application names (if turned on), device names and screenshots (if the add-on is bought and turned on). Section 11 explains this in full.
• Plagenda — projects, tickets, tasks, comments, documents, time entries and test records.
• Bookuracy — customers, suppliers and their contacts, invoices, bills, expenses, payments, bank statements you upload, ledger entries, payroll calculations and tax figures.

3.3 We collect automatically

• Sign-in and security records — sign-in times, IP address, browser and operating system, device name, and whether two-step verification was used, to keep accounts secure and let you see and end your sessions.
• Device details for the apps — for the desktop and phone apps, the app version and operating system, and for phone notifications a push token that identifies the app installation.
• Service logs — technical records of requests and errors, including IP address, to operate, secure and fix the Services.
• Usage counts — for example how many members, messages or tickets a Hub has, which the Hub shows to its administrators and which we use to run and bill the Services. We do not use third-party analytics or advertising trackers in the Services or on our websites.

3.4 From others

• Your organisation — when an administrator invites you, they give us your name and email address.
• Stripe — whether a payment succeeded, and the card reference above.
• Services you connect — if your organisation imports from another tool or connects an integration, the content it chooses to bring in.

4. How we use information, and our legal bases

For Customer Data, we act on the organisation's instructions and the organisation decides the legal basis. For the information we control, we rely on the following:

Under PIPEDA we rely on your consent, which may be implied by your use of the Services for these purposes, and you may withdraw it subject to legal and contractual restrictions. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. We do not make decisions producing legal or similarly significant effects about you by automated means.

AI and DUA. The Services include DUA, an assistant available to everyone who uses them. DUA does two things. It answers questions about your organisation's own records: those answers are produced by our own software, from records you are already permitted to see, and DUA refuses what your role may not see. When our software does not recognise how a question is worded, the question itself is sent to a large language model run by OpenAI, only so that it can choose which of our lookups answers it; your organisation's records are not sent for this. DUA also helps with writing (for example summarising, improving or drafting text): the text you give it, and your instruction, are sent to the same model and its suggestion is returned to you to use or discard. Nothing is sent to OpenAI unless a person asks DUA for it. We ask OpenAI not to store what we send; it may keep it for a limited period to detect abuse, as its terms describe, and under its terms for this service it does not use it to train its models. DUA's suggestions are generated text and may be wrong: check them before relying on them. Where message translation is turned on, it runs on a translation service we operate ourselves; the text is not sent to a third party.

5. How we share information

• Within your organisation. Information in a Hub is visible to the people in that organisation according to the roles and settings its administrators choose. Administrators can export the Hub's data.
• Our subprocessors, listed in Section 6, who help us run the Services under contracts that restrict them to that purpose and require them to protect it.
• Services your organisation connects. When your organisation connects its own payment gateway, an import or another integration, we exchange data with it on the organisation's instructions. Those providers are responsible for what they do with it.
• Our staff, only as needed to provide and secure the Services and to answer support requests. When support staff view a Hub to resolve a request, the session is recorded in the Hub's audit log.
• Legal reasons. Where the law, a court order or a valid request from an authority requires it, or where needed to protect people's safety or our rights. For Customer Data, we direct authorities to the organisation where we can, and tell it unless the law forbids us.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may pass to the new owner, who must continue to protect it as this policy describes. We will give notice before that happens.

We never sell personal information.

6. Subprocessors and service providers

We run our own databases, file storage, search, call media and translation software on servers we rent from infrastructure providers in their data centres; no other company operates that software or reads your data. The companies below process personal information for us. We announce a new subprocessor here, and by email to Hub owners, at least 30 days before it starts processing Customer Data.

When your organisation connects its own Stripe or PayPal account to Bookuracy to collect payments, or connects another integration, that provider acts for your organisation, not for us, and is not our subprocessor.

7. Where information is stored, and international transfers

• The Services are hosted in data centres in the United States and the European Union, where encrypted backups are also kept. Our subprocessors may process information in the locations listed in Section 6. We are based in Canada.
• EU, EEA, UK and Swiss customers. We do not currently offer hosting inside the EU or the UK. Transfers from the EEA to Canada rely on the European Commission's adequacy decision for Canada (for organisations subject to PIPEDA). Transfers to other countries without an adequacy decision — including the United States unless the recipient is certified under the EU-U.S. Data Privacy Framework — rely on the EU Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, together with the security measures in Section 9. You can ask us for a copy of the safeguards at [email protected].
• Canadian customers. Your information may be processed outside Canada, where it is subject to the laws of that country and may be accessible to its courts, law-enforcement and national-security authorities.

8. How long we keep information

9. How we protect information

• In transit: every connection to the Services uses TLS.
• At rest: servers use encrypted disks; backups are encrypted; secrets for connected services (such as payment-gateway and import credentials) are additionally encrypted in the database.
• Passwords are stored as salted one-way hashes; recently used passwords cannot be reused; repeated failed sign-ins lock the account and are rate-limited.
• Two-step verification with an authenticator app, and single-use backup codes stored as hashes.
• Sessions use short-lived tokens in cookies that scripts cannot read; refresh tokens rotate on every use, and reuse of an old one ends the whole session family.
• Separation between organisations: every query is scoped to the organisation, backed by database row-level security.
• Least privilege: role-based access inside every product, field-level restrictions on HR records, and restricted access for our staff.
• Audit trail: a tamper-evident (hash-chained) audit log of important actions.
• Payments: card numbers never reach our servers.

We are open about the limits too. Messages in Colloza are not end-to-end encrypted: our servers can read them in order to display, search and export them. We have not yet completed an independent certification such as SOC 2 or ISO 27001. No system is perfectly secure; if we learn of a breach affecting your information, we will notify the organisation responsible (and, where we are the controller, you and the authorities) as the law requires.

10. Your rights and how to use them

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — to know what we hold and receive a copy.
• Correction — to have inaccurate information corrected.
• Deletion — to have information erased, subject to legal exceptions.
• Portability — to receive information you provided in a machine-readable format.
• Restriction and objection — to limit or object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, at any time, without affecting earlier processing.
• California residents — to know the categories and specific pieces of information collected, used and disclosed; to delete and correct; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only as permitted); and not to be discriminated against for using these rights. You may use an authorised agent.
• Complain to a supervisory authority — in the EU, your local data protection authority; in the UK, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner.

How to ask

• Yourself, in the product. You can view and edit your profile in your settings, and download a copy of the data held about your account from your profile settings ("Export my data").
• Information in an organisation's Hub — contact that organisation; its administrators can export, correct and delete it, and OrgEntity tracks such requests and their due dates. If you cannot reach them, write to us and we will pass it on.
• Anything else — email [email protected] with "Privacy request" in the subject line.

We may need to confirm your identity before acting, usually by asking you to write from the email address on the account. We answer within one month (GDPR and UK GDPR), 30 days (PIPEDA) or 45 days (CCPA), and tell you if we need an extension the law allows. Using your rights is free unless a request is manifestly unfounded or excessive.

11. Workplace monitoring and the OrgEntity Tracker

The OrgEntity Tracker is a desktop app some organisations use to record their staff's working time. If your employer uses it, this is what it means for your privacy. The full terms, including your employer's duties, are in Section 18 of our Terms of Service.

Your employer is responsible

Your employer decides whether to use the Tracker, which settings to turn on, who in the organisation can see the results, and how long screenshots are kept. It is the controller of your monitoring data; we process it only on its behalf, never sell it, and never use it for our own purposes. Your employer must tell you why and how it monitors, have a lawful basis, and meet any works-council, union or local-law requirements before it starts.

What is recorded

• Nothing until you have agreed to the monitoring notice in the Tracker and started a session. Recording pauses when you pause and when your computer is locked or asleep.
• Working time: starts, pauses, stops, breaks, and the project or task you chose.
• Activity level: the share of each interval with keyboard or mouse input — never what you typed or clicked. There is no keylogging.
• Where your mouse pointer is on the screen, read once a second, and (where your system offers it) how long ago your keyboard and mouse were last touched. This is used on your computer only, to tell your own input from a script that fakes it. The pointer's position is dropped after about ten minutes; it is never sent to your employer or to us and never stored, and it is not a record of what you clicked or looked at.
• Time the Tracker could not vouch for: when a stretch looks made by software, or one of your screens could not be captured, your employer is told when it began and ended and one line saying what was seen. It is held back from your hours until whoever approves your time decides.
• Idle time, marked as idle, which you and your manager can keep or discard.
• The name of the application in focus, if your employer turned this on — never window titles, web addresses or on-screen content.
• Screenshots of your screen, only if your employer bought the Screenshots add-on and turned it on, only while you are tracking, never of applications your employer marked private, and never where your organisation operates in a country where screenshots are blocked (Section 18.3 of the Terms). The Tracker shows you when screenshots are on.

Who sees it, and for how long

• You can see your own time, activity and screenshots in the Tracker.
• People in your organisation with monitoring permission can see them too. Only they can delete screenshots; you cannot.
• Screenshots are kept for the period your employer sets (90 days unless it changes it), then permanently deleted. Time records are kept as long as your employer keeps them.

Your choices and rights

• You can decline the monitoring notice; the Tracker then records nothing for you. Your employer may have other ways of recording working time.
• You can withdraw at any time from inside the Tracker; recording stops at once.
• When the notice changes in substance, you are asked to agree again, and nothing is recorded until you do.
• To get a copy of your monitoring data, screenshots included, or to ask for correction or deletion, ask your employer's administrators first. If they do not respond, write to [email protected] and we will pass your request to your employer and help it answer.
• Consent at work is often not freely given. Where the law says so, your employer must rely on another legal basis and consult your representatives; you can complain to your data protection authority if you think monitoring is unlawful.

12. Children

The Services are for organisations and their staff and are not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

13. Cookies and similar technologies

Our marketing website (projease.com) sets no cookies. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device.

The Services use only cookies that are strictly necessary to sign you in and keep your session secure. Because they are necessary, they do not need consent, and there is no advertising, analytics or cross-site tracking cookie.

The Services also keep your preferences (such as theme and layout) and a copy of your profile in your browser's local storage, so screens open quickly. The desktop apps keep your sign-in in your operating system's secure credential store, and the phone apps in the device keychain or keystore. Signing out removes them.

14. Emails and notifications

We send service emails that are part of the Services — verification, invitations, security alerts, trial and billing notices, and notifications your settings allow. Product notifications can be turned off in your notification settings, and phone notifications in your device settings. We do not send marketing email to Users without the consent the law requires, and every marketing email has an unsubscribe link.

15. Changes to this policy

We update this policy when the Services or the law change. Each version is dated at the top of the page. For a material change we give Hub owners at least 30 days' notice, and everyone is asked to review and accept the new version the next time they sign in, as described in our Terms of Service.

16. Contact us

• Privacy questions and requests: [email protected] (subject "Privacy request"). Our privacy lead is responsible for this policy and answers these messages.