Privacy Policy

Last updated: 31 July 2026

This Privacy Policy explains how Hourline("we", "us") processes personal data when you use the Service. We act as the data controller for account and usage data.

1. What we collect

Account details: name, email address, password hash
Timesheet data: shift dates, durations, custom columns, employer name and email you enter
Billing data processed by Stripe (card details never stored on our servers): customer and subscription identifiers, status, period end
Technical data: application error logs. When you sign in, register, or request a password reset, we may use your IP address together with your email (in memory on the application server) for short-lived rate limiting. We do not operate a separate long-term IP analytics store.
Cookies / local storage needed for sign-in sessions and theme preference (essential for the Service)

2. Why we use it

To provide and secure your account and the timesheet Service
To email PDFs to addresses you choose (and CC yourself if enabled)
To process subscriptions and prevent fraud
To respond to support requests and meet legal obligations

Legal bases under UK GDPR typically include contract performance (providing the Service you signed up for), legitimate interests (security, product improvement), and legal obligation where required.

3. Who we share with

We use processors that help us run the Service, including:

Stripe — payments and subscriptions
Google — optional sign-in (name, email, and profile image)
Hosting / database providers for the application and Postgres data
Email (SMTP) provider — sending timesheets and password resets

We do not sell your personal data. Employer emails receive only the content you choose to send.

4. Retention

We keep account and timesheet data while your account is active. You may export or delete your account from Settings (Account / Data tabs) at any time while signed in, including after canceling a subscription. You can also request deletion by emailing hello@bagghu.com. Backups may persist for a limited period after deletion. Billing records may be retained as required for tax and accounting.

5. Your rights

Under UK data protection law you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. You may also complain to the Information Commissioner's Office (ICO). Contact us first at hello@bagghu.com so we can help.

6. Security

We use HTTPS, hashed passwords, and access controls appropriate to a small SaaS. No method of transmission is perfectly secure.

7. Children

The Service is intended for adults using it for work timesheets, not for children under 16.

8. Contact

Privacy questions: hello@bagghu.com.