Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for this website and for the data of your account is:

giant Computer Systems
Owner Marc Breuer
Am Altengraben 23
90768 Fürth
Germany
Phone: +49 (0) 911 976912-0
Email: [email protected]

We have not appointed a data protection officer because the requirements of Art. 37 GDPR and § 38 BDSG are not met. For any questions about data protection, contact us at the address above.

2. General information

Protecting your personal data matters to us. We process your data only on the basis of the statutory provisions (GDPR, BDSG, TDDDG). This policy explains which data we process when you visit the website and use HORAKA, why, and on which legal basis.

What you and your team record in HORAKA (time entries, clients, projects, notes, team member accounts) we process on behalf of the workspace that owns this data. The owner of the workspace is the controller for it and we are the processor; the data processing agreement applies.

3. Your rights

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

You can exercise many of these rights directly in the app: under Settings, Data you download a copy of your account data or, as the owner, the full export of the workspace, delete your account or request deletion of the workspace.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority (Art. 77 GDPR).

4. Hosting and delivery

HORAKA runs on our own infrastructure at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. The database, files (such as logos, exports and imports) and backups are stored on these servers. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and our legitimate interest in secure and efficient provision (Art. 6 (1) (f) GDPR).

The website is delivered through the content delivery network and security services of Cloudflare Germany GmbH, Rosental 7, 80331 Munich. Every request therefore first passes through a Cloudflare server, which acts as a proxy and connects to our servers. Cloudflare processes your IP address, technical information about your browser and device and the requested address in order to establish the connection, fend off attacks and deliver content faster. Your behaviour is not analysed, and Cloudflare does not set any advertising or tracking cookies for us. A data processing agreement pursuant to Art. 28 GDPR including the EU standard contractual clauses is in place with Cloudflare. The legal basis is our legitimate interest in secure and fast operation (Art. 6 (1) (f) GDPR).

5. SSL and TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses TLS encryption throughout. You can recognise an encrypted connection by the address bar of your browser starting with “https://”.

6. Server log files

When you access the pages, our servers automatically store information in server log files: browser type and version, operating system, referrer URL, requested address, time of the request and IP address. This data is not combined with other data sources. It is collected on the basis of Art. 6 (1) (f) GDPR to display the site correctly and to keep the systems secure. The log files are deleted automatically once they are older than 90 days; longer only where needed to investigate a specific security incident.

7. Cookies and browser storage

We use only strictly necessary cookies and no cookie banner, because no consent is required:

• Session and CSRF protection: keep you signed in and protect forms against requests from other sites.
• sprache: remembers your chosen language.
• appearance: remembers whether you want light, dark or your system setting.
• sidebar_state: remembers whether the app sidebar is expanded or collapsed.

If you install HORAKA as an app, your browser stores the program files and, for offline use, a copy of your own entries and the clients, projects and activities of your workspace on your device (IndexedDB, separate per account). This data only leaves your device when it syncs with our servers; you can delete it at any time through your browser’s site data. The legal basis is § 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR.

8. Sign up and account

When you create a workspace, we process the data you enter: the name of your company or workspace, your name, your email address, your password (only as a hash), your language and the time at which you confirmed that you have read the terms and the privacy policy. Optionally a time zone, a logo, two factor authentication and passkeys are added. Anyone who joins a workspace by invitation provides a name, email address and password. The legal basis is Art. 6 (1) (b) GDPR.

To protect against automated sign ups, the sign up page may use Cloudflare Turnstile by Cloudflare Germany GmbH. Turnstile checks whether a human is submitting the form and processes your IP address and technical information about your browser and device for this purpose; it does not set tracking cookies. The legal basis is our legitimate interest in protection against abuse (Art. 6 (1) (f) GDPR).

9. Payments through Stripe

You pay for paid plans through our payment service provider Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter payment details, billing address, VAT number and payment methods directly on Stripe’s pages (checkout and customer portal); we ourselves do not process or store any card or account details. We pass the name of your workspace, the email address and language of the owner and the chosen plan to Stripe. From Stripe we receive the status of the subscription and the invoice details (number, amount, date). Stripe calculates VAT and validates VAT numbers. Transfers to Stripe, Inc. in the USA are based on the EU standard contractual clauses; Stripe’s privacy policy also applies (stripe.com/privacy). The legal basis is Art. 6 (1) (b) and (c) GDPR.

10. Emails

We only send emails that belong to using the service: confirming your email address, forgotten password, team invitations, notices about the trial, plan and payment, reminders you set up, and exports and reports you have sent to an address. The emails leave our servers through our own mail server (Postfix); no third party newsletter or sending service is involved. The legal basis is Art. 6 (1) (b) GDPR.

11. Web push notifications

You only receive notifications on your device (such as “Timer running for more than eight hours”) if you explicitly switch them on in the app and your browser agrees. We then store the address your browser issues for notifications and the name of the device. Notifications are sent encrypted through the push service of your browser’s vendor (such as Apple, Google or Mozilla), which cannot read the content. You can switch notifications off at any time in the app or in your browser. The legal basis is your consent (Art. 6 (1) (a) GDPR).

12. Interfaces you set up

If you create API tokens, devices, webhooks or a connection to EARLY, we transmit data to the destinations you enter there or receive data from them. This happens only at your instigation and to the extent of your settings. The legal basis is Art. 6 (1) (b) GDPR.

13. No analytics or advertising services

We do not use any analytics, tracking or advertising services and do not embed third party content. Fonts and images are served from our own servers; no font service such as Google Fonts is contacted.

14. Storage period and deletion

We store personal data only for as long as necessary for the respective purposes. We delete exports and uploaded import files after seven days. If you delete your account, we remove it immediately; your time entries remain with the workspace under your name because they are part of its billing. If the owner requests deletion of the workspace, we permanently delete all data of the workspace after a notice period of 14 days. We keep invoices and billing records for 10 years because of statutory retention obligations.

15. Changes to this privacy policy

We update this privacy policy when the legal situation or our services change. The version published here applies.

The German version of this privacy policy is authoritative.