This page explains how HourOps stores and isolates customer data, how protected exports work, and what happens when an organization is permanently deleted.
Operational records are associated with an organization or workspace. PostgreSQL Row-Level Security (RLS) enforces that tenant boundary at the database layer, alongside server-side identity, workspace, and permission checks.
Roles and permissions determine which users can view or change information. Shared projects provide only the intended collaboration access and do not remove the underlying organization boundary.
HourOps stores the account, workforce, project, task, timesheet, leave, invoicing, subscription, and limited operational information needed to provide and protect the service.
Eligible primary organization owners can request an export from HourOps. Because a complete export can require significant database and compute capacity, HourOps reviews the request and starts the background job manually. Large exports may take several hours.
Important organization records such as users, roles, designations, clients, projects, shared-project information, tasks, timesheets, leave information, holidays, workflow statuses, subscriptions, payments, chargeback records, and Work-to-Invoice records. The requester may choose to include eligible sub-accounts.
Passwords, one-time passwords, authentication tokens, secrets, uploaded attachments, AI conversation history, internal security logs, and raw payment-provider or webhook payloads are not included.
Exported organization records are provided as structured CSV files, with a manifest, so customers can review them in spreadsheet tools or analyze them with an LLM service they choose. HourOps does not automatically send exported data to an LLM. Customers should review the privacy, security, and data-retention terms of any external service before uploading an export.
Generated files are stored privately. HourOps emails a protected download link when processing finishes. The link expires after seven days, and download and file-deletion actions are audited. The requester can delete the generated files earlier from HourOps while their organization remains active.
Permanent deletion is protected by explicit confirmation and email verification. Once a verified customer deletion request is accepted, access to the organization and its included sub-accounts is disabled immediately. The operational deletion then continues as a protected background process and cannot be undone.
If the owner requests an export during deletion, HourOps keeps access locked, places the export in the manual processing queue, and emails the download link when the job is complete. Permanent deletion continues after the export is prepared and its notification is sent. The customer cannot sign back in while this work is pending.
Limited payment, subscription, dispute, and deletion-confirmation evidence may be retained in a restricted record for up to 180 days for security, fraud prevention, accounting, tax, legal, and payment-dispute purposes. This retained evidence does not include payment-card details or the deleted operational workspace.
Contact privacy@hourops.com for privacy questions, or support@hourops.com for help with an export or deletion request.