1. Who we are
Controller for the processing described in sections 3 and 4:
Eray Yilmaz, trading as InClox, Europaring 90, 53757 Sankt Augustin, Germany
Email: info@ponyagcy.com · Phone: +49 156 79 729 585
We are not required to appoint a data protection officer.
2. Two different roles — please read this first
InClox is time-tracking software that businesses ("customers") use for their own staff, contractors or virtual assistants ("team members").
- Website, sign-up, customer account, billing: we decide why and how data is processed. We are the controller. Sections 3–4 apply.
- Tracking data of team members (work sessions, activity score, screenshots, device information, payroll data): the customer decides whether and how InClox is used. The customer is the controller; we process these data on the customer's behalf as a processor under a Data Processing Agreement (Art. 28 GDPR). Section 5 describes what the software does so that team members are informed; questions and requests about these data should go to the customer (your employer or client) first. We will forward requests we receive.
3. Website
3.1 Hosting and server logs
The website and the web app are hosted by Netlify, Inc. (USA). When you visit, technically necessary data are processed: IP address, date and time, requested page, referrer, browser and operating system (user agent). Purpose: delivering the site, security, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Logs are deleted by Netlify after a short period.
3.2 No cookies for tracking, no analytics
The website uses no analytics, no advertising cookies and no third-party fonts or scripts. The web app stores a login token in your browser's local storage so that you stay signed in. This is strictly necessary for the service you requested (§ 25(2) no. 2 German TDDDG); no consent is needed.
3.3 Contact
If you email us, we process your email address, name and message to answer you (Art. 6(1)(b) or (f) GDPR). We delete correspondence when it is no longer needed, unless retention periods under commercial or tax law apply.
4. Customer account and billing
| Data | Purpose | Legal basis |
|---|---|---|
| Name, business email, company name, password (stored only as a hash), role | Creating and running the workspace, login | Art. 6(1)(b) GDPR |
| Plan, number of seats, billing period, invoices | Billing | Art. 6(1)(b) and (c) GDPR |
| Billing address, VAT ID, country | Invoicing, checking business status, tax rules | Art. 6(1)(c) GDPR |
| Support messages | Support | Art. 6(1)(b) GDPR |
Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland; Stripe, Inc., USA). Card and bank details are entered directly with Stripe; we never see full card numbers. Stripe processes payment data partly as its own controller, e.g. for fraud prevention and its legal duties; see stripe.com/privacy.
Service emails (sign-up confirmation, password reset, invitations) are sent through our email provider.
Retention: account data for the life of the contract; afterwards deleted within 30 days, see section 6. Invoices and accounting records: 8 or 10 years under § 147 German Fiscal Code (AO) and § 257 German Commercial Code (HGB).
5. What the InClox apps record (processing on behalf of the customer)
This section describes the default functions. The customer decides which functions are switched on and which legal basis it relies on. Recording only takes place while a team member has started a session and a timer is visibly running. There is no hidden mode and no keylogger.
| Category | What exactly | Apps |
|---|---|---|
| Account | Name, username/email, role, team, password hash | all |
| Work sessions | Start, end, duration, task, time zone, manual entries | all |
| Activity score | A percentage derived from how long the computer was idle (time since last keyboard or mouse input). Keystrokes, typed text and mouse movements are not recorded. On iOS/Android no activity is measured; a neutral value is stored. | Desktop |
| Screenshots | Off until a workspace administrator switches them on. Then images of the screen(s) at intervals configured by the customer (for example every 5–10 minutes), plus a small thumbnail. An administrator can also request a single screenshot during a running session. | Desktop only |
| Inactivity stop | The session ends automatically after 15 minutes without input. | Desktop |
| Hour limits | Daily/weekly limits set by the customer; the app stops tracking when a limit is reached. | all |
| Device information | A device ID, device name (hostname), operating-system user name, platform and version, device model, screen resolution, time zone, app version, first and last IP address. | all (scope varies by platform) |
| Remote-control detection | The desktop app checks locally whether the computer is being controlled remotely (e.g. AnyDesk, TeamViewer, RDP, Chrome Remote Desktop). For this it looks at running programs, open network connections and the log files of those programs on the device. Only the name of a detected tool and the time are sent; the list of programs, connections or log contents is not uploaded. | Desktop |
| Payroll | Hourly rate, worked hours, payout amounts, payment details (e.g. bank or crypto-wallet address) entered by the customer | Web |
Why: proof of hours worked, billing of clients, payroll, keeping working-time limits, and protecting accounts against misuse (e.g. someone else working on the account remotely).
Legal basis: set by the customer as controller — typically Art. 6(1)(b) GDPR (employment or service contract), Art. 6(1)(c) GDPR (legal duty to record working time) and Art. 6(1)(f) GDPR, or a works agreement under Art. 88 GDPR / § 26(4) German Federal Data Protection Act (BDSG). Customers must inform team members before tracking starts.
Retention: screenshots are deleted automatically after 90 days unless the customer sets a shorter period. Other tracking data are kept for as long as the customer's workspace exists or until the customer deletes them.
Your rights as a team member: you can see your own sessions, screenshots and totals in your personal portal. For access, correction or deletion, please contact the customer (your employer or client). If you write to us, we will forward your request.
6. Storage location, service providers, transfers outside the EU
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, login, file storage (screenshots), server functions | Data stored in AWS region Frankfurt (eu-central-1) |
| Netlify, Inc. | Hosting of website and web app, downloads | USA / global CDN |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, invoices | Ireland / USA |
| Resend (Plus Five Five, Inc.) | Service emails | USA |
All providers are bound by data processing agreements. Where data are accessible from outside the EU/EEA (especially the USA), transfers are based on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
After the contract ends, the customer can export its data. We then delete the workspace data within 30 days; backup copies are overwritten in the normal backup cycle within a further 30 days.
7. Security
Data are encrypted in transit (TLS) and at rest. Access is limited per workspace and per role (administrator, manager, team member). Screenshots are stored in a non-public storage area and can only be opened by authorised users via short-lived links. Details are in the Data Processing Agreement, Annex 2.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where we rely on legitimate interests, you can object at any time for reasons relating to your particular situation. Where processing is based on consent, you can withdraw it at any time with effect for the future.
You can lodge a complaint with a supervisory authority, e.g. the one where you live or work, or ours: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
9. No automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). The activity score is a simple calculation from idle time and is not an assessment of performance; it must not be used as the sole basis for decisions about a person.
10. Changes
We update this policy when our services or the law change. The current version is always available at inclox.com/privacy.