Data Processing Agreement
Getting a signed DPA
Email team@timenova.ai from the account owner's address with your company's legal name and registered address. We will return a signed DPA, normally within two business days. If your own template must be used, send it and we will review it rather than insist on ours.
There is no minimum plan and no fee. A DPA is available on a trial.
The short version, for a security review
| Question | Answer |
|---|---|
| Who is the controller? | You are. TimeNova is the processor for everything your account tracks about your people. We are the controller only for our own business contacts: your billing details and the person who signed up |
| What is processed? | Tracked activity (hours, activity level, application and website names, window titles), screenshots or screen recordings where enabled, and the roster needed to attribute them |
| What is never processed? | Keystrokes. There is no keylogging anywhere in the product and the permission is never requested, so the data does not exist. URL query strings are stripped at ingestion, before storage |
| Where is it processed? | Managed cloud infrastructure operated by our sub-processors. Ask us for the current region of your account's database and media bucket and we will tell you in writing |
| Who are the sub-processors? | Listed in full on the sub-processors page, with what each one can see |
| How long is it kept? | Your plan's retention period: one year on Pro, two years on Max. After that, raw capture is deleted, media bytes before database rows |
| How is deletion handled? | Deleting a person erases their samples, screenshots and recordings down to the stored objects. Deleting an account erases the account. The activity log survives, because a deletion record that can be deleted is not a record |
| International transfers? | Standard Contractual Clauses are included in our DPA where they apply |
| Breach notification? | Without undue delay and within 72 hours of becoming aware, to the account owner's address, with what we know and what we are doing |
| Audit rights? | Documentation and written answers on request. TimeNova does not currently hold SOC 2 or ISO 27001 certification. The control environment is documented on the security page |
What your own compliance depends on
Monitoring software is lawful in most places and unlawful in some, and almost everywhere it depends on what you tell your team. TimeNova gives you the controls, the consent surfaces and the audit log, but the legal basis for monitoring your own employees is yours to establish. Our guide on whether employee monitoring is legal is a starting point, not legal advice.
Questions a review needs answered
Write to team@timenova.ai. Short, direct answers, from the people who wrote the code, usually the same day.