1. Information we collect

We collect the following categories of information:

• Account information — name, email address, and authentication identifiers, managed via our authentication provider (Clerk).
• Workspace and timesheet data — projects, tasks, time entries, expenses, approvals, and related content you or your team enter.
• Integration data — where you connect a third-party service (e.g. Google Calendar), the data necessary to provide that integration.
• Usage and technical data — log data, device/browser information, and error diagnostics used to operate and improve the Service.

2. Where your information comes from

We collect information directly from you, from your workspace (for example, when a workspace administrator or teammate enters projects, time entries, approvals, or other details that relate to you), and from third-party services you choose to connect (such as Google Calendar).

Some information is optional. If you choose not to connect an integration or not to use AI-assisted features, we will not collect the related data — the only consequence is that those features will be unavailable to you.

3. How we use your information

• To provide, maintain, and secure the Service.
• To authenticate users and manage workspace access.
• To provide support and respond to your requests.
• To monitor, debug, and improve reliability and performance.
• To comply with legal obligations.

4. Legal basis for processing (GDPR)

Where the GDPR applies, we process personal data on the basis of: performance of a contract (providing the Service), our legitimate interests (securing and improving the Service), your consent (where requested, e.g. optional integrations), and compliance with legal obligations.

5. Sub-processors and third parties

We use trusted third-party providers to operate the Service. These currently include:

• Clerk — authentication and user management.
• Neon — managed PostgreSQL database hosting.
• DigitalOcean — application hosting.
• Sentry — error monitoring and diagnostics.
• Google (Gemini) and Groq — AI processing for AI-assisted features (e.g. extracting time entries from natural-language input). Only the text you submit to those features is sent for processing.
• Google — where you enable the optional Calendar integration.

6. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. We will delete or anonymize personal information when it is no longer required, subject to any legal retention obligations. You may request deletion of your account and associated data at any time.

7. Data security

We use reasonable technical and organizational measures to protect personal information, including encrypted transport, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International transfers

Some of our providers may store or process data outside New Zealand. Where this occurs, we take reasonable steps to ensure your information is protected to a standard comparable to the Privacy Act 2020.

9. Your rights

Subject to applicable law, you have the right to access, correct, and request deletion of your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below.

10. Children

The Service is not directed to children and is intended for use in a workplace context. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you — for example, by email to your account address and/or a notice in the Service — and we will revise the “Last updated” date above. Where applicable law requires your consent for a particular change, we will obtain it. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy to the extent permitted by law.

12. AI agents and the MCP server

If you connect the Service to an external AI agent — for example via our Model Context Protocol (MCP) server — that agent sends and receives workspace data on your behalf. Depending on what you ask it to do, this can include project and task names, descriptions, and time-entry details.

That data is transmitted to and processed by whichever AI host you choose to configure (such as Anthropic, OpenAI, or another provider), under that provider's own terms and privacy practices. We do not control, and are not responsible for, the AI host or agent you choose to use. Only connect agents you trust, and review your chosen provider's terms before sending workspace data through them.

13. Contact us

If you have questions about this policy or your personal information, contact us at [email protected]. Ktria Limited's registered office address is available on the New Zealand Companies Register (company number 9439581).