Last updated: 7 November 2026
Privacy policy
This policy explains what data Humatrack collects, why, for how long, and what your rights are. It applies to the humatrack.app website, the waitlist, the web application and the desktop application.
Design principle: your raw activity (window titles, visited addresses, opened folders) never leaves your computer. Only the time entries you approve are sent to our servers.
01Data controller
The data controller is Hugo Bachmann, sole proprietor (entrepreneur individuel), 13 rue Mirabeau, 66270 Le Soler, France, registered under SIREN number 913 801 080.
Contact for any question about personal data: contact@hugobachmann.fr.
02Data we collect
We only collect the data needed to run the service:
| Category | Data | Source |
|---|---|---|
| Waitlist | Email address, preferred language, sign-up date; with your consent to audience measurement, the campaign you came from (utm parameters) and the version of the page you saw | Website form |
| User account | Name, email, password (encrypted), avatar, time zone, language | Sign-up |
| Workspace | Name, currency, default hourly rate, settings | Entered by the owner |
| Clients and contacts | Name, email and notes of the clients you invite | Entered by you |
| Projects, tasks, time | Titles, approved durations, locked rates, reports, comments | Entered or approved by you |
| Devices | Device name, operating system, application version, last connection | Desktop application |
| Payment | Customer ID and subscription status. Card numbers never go through our servers. | Payment provider |
| Technical data | IP address, browser type, security logs | Automatic |
03What we do not collect
- No screenshots, ever.
- No window titles, visited addresses or file names: activity detection happens locally, on your machine.
- No draft time entries: only the entries you approve are synced.
- No data about your clients beyond what you enter to invite them.
04Why we use it
| Purpose | Legal basis | Example |
|---|---|---|
| Provide the service | Performance of the contract | Track, approve and share your hours with your clients |
| Manage the subscription | Performance of the contract | Billing, renewal, receipts |
| Inform you of the launch | Consent | Emails sent to waitlist members |
| Secure the service | Legitimate interest | Detection of abnormal logins, logs |
| Improve the product | Legitimate interest | Aggregated usage statistics, without content data |
| Measure website audience | Consent | Visits and page views with Google Analytics 4, only after your consent |
| Compare versions of the page | Legitimate interest (measurement exempt from consent under CNIL guidelines) | Anonymous counts of visits and sign-ups per version |
| Meet our legal obligations | Legal obligation | Retention of accounting records |
05Tests of page versions
To improve the page, we sometimes compare several versions of its content. An lp_ab cookie, kept for 90 days, remembers the version shown to you. It contains no identifier, only the name of the test and of the version.
We count visits and sign-ups per version and per day. These counts are anonymous: no IP address, no identifier, no cross-referencing with other data. The version shown is only sent with your sign-up if you have accepted audience measurement.
This measurement is exempt from consent under CNIL guidelines, but you can object to it. Your choice is kept for 13 months in the lp_ab_optout cookie.
06Retention periods
- Waitlist: until launch, then 12 months maximum without an account being created.
- Account and workspace: for the whole subscription, then 30 days after account deletion (recovery period), unless legally required otherwise.
- Accounting records: 10 years, in accordance with the French Commercial Code.
- Technical logs: 12 months maximum.
- Record of your cookie choice: 13 months; audience measurement data: 14 months.
07Who can access your data
Your data is never sold. It can be accessed by:
- members of your workspace, according to their role;
- your invited clients, only for the approved time on their own projects and the tasks you make visible;
- our technical subcontractors, under contract and within the limits of their mission:
| Subcontractor | Role | Location |
|---|---|---|
| OVH SAS | Hosting and database | European Union |
| Stripe | Subscription payments | EU / United States (standard contractual clauses) |
| Resend | Sending transactional emails | United States (standard contractual clauses) |
| Google Ireland Limited | Audience measurement (Google Analytics 4), with your consent | EU / United States (Data Privacy Framework) |
08Transfers outside the European Union
Our servers are located in the European Union. When a subcontractor is based outside the EU, the transfer is governed by the European Commission’s standard contractual clauses or an adequacy decision.
09Security
- Encryption of traffic (TLS) and of passwords (hashing).
- Strict workspace isolation: a user never accesses another workspace’s data.
- One access token per device, revocable at any time from the web application.
- Encrypted daily backups.
10Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to withdraw your consent at any time.
To exercise them: contact@hugobachmann.fr. We reply within one month. You can also lodge a complaint with the CNIL (cnil.fr).
Your invited clients can exercise the same rights; in that case we inform you, as you remain responsible for the data you enter about them.
11Changes
This policy may change with the product. In the event of a substantial change, we will notify you by email at least 30 days before it takes effect.
A question about this page?
Write to us, we reply within 2 business days.