At HourOps, your privacy and data security are our highest priorities. This Privacy Policy outlines how we collect, use, and protect your information, ensuring the highest standards of data isolation and compliance.

Who operates HourOps

HourOps is an independently operated software product. Paddle acts as the Merchant of Record for paid subscriptions and processes payment details separately from HourOps. HourOps receives only the billing and subscription information needed to provide your selected plan.

1. Strict GDPR Compliance

We strictly adhere to the General Data Protection Regulation (GDPR) and other global privacy frameworks. You have the right to access, rectify, or erase your personal data. We are committed to transparency and give you full control over how your information is handled.

2Tenant-Level Data Isolation

Security is built into the core of our architecture. We employ a strict data isolation policy at the database level.

Tenant-Level Validations: Every request is rigorously validated at the tenant level to prevent cross-tenant data leakage.
Siloed Architecture: Your organization's data is completely siloed and logically separated from all other users on the platform.

This ensures that your app environment remains incredibly secure and that your data is impossible to access by unauthorized parties.

3. Data Security & Safety

All our user data is safe. We use state-of-the-art encryption in transit (TLS 1.3) and rigorous Row-Level Security (RLS) at the database level to ensure tenant isolation. Our infrastructure is actively monitored 24/7 for vulnerabilities, ensuring that your workforce data, timesheets, and project details are guarded against any threats.

4. Standard Data Collection & Use

We only collect data that is strictly necessary for the operation of the HourOps platform. This includes:

Account Information: Name, email address, and role for authentication and RBAC.
Operational Data: Timesheets, leave balances, and project assignments required for workforce management.
Usage Logs: System logs used strictly for auditing and performance monitoring.
Billing Records: Limited payment, subscription, refund, dispute, and deletion-confirmation details used for billing support, fraud prevention, security, and compliance. HourOps does not store payment-card details.
AI Processing: When you use the AI Assistant, your requests are processed securely as intent-routing actions. We do not use your private company data or prompt history to train external AI models.

We do not sell, rent, or share your personal data with third-party advertisers.

5. Organization deletion and retention

When a verified permanent-deletion request is accepted, HourOps disables access to the organization and its included sub-accounts immediately. The operational workspace is then removed through a protected background process and cannot be restored.

We may retain a limited, access-restricted billing and deletion record for up to 180 days. This may include organization and billing contact details, Paddle transaction and subscription references, plan and payment history, dispute events, and proof of the deletion request. We use this record only for security, fraud prevention, accounting, tax, legal, and payment-dispute purposes, and delete or anonymize it when the retention period ends.

6. Organization data exports

An eligible primary organization owner can request an export of important company and operational records. HourOps reviews and manually starts this protected background job because larger exports require additional database and compute capacity. Processing may take several hours, particularly when sub-accounts are included.

Completed files are stored privately and made available through a protected link that expires after seven days. Organization records are delivered as structured CSV files with a manifest, making them suitable for customer-directed analysis in spreadsheet or LLM tools. HourOps does not automatically send an export to an LLM. If a customer uploads exported data to an external service, that service's privacy, security, and retention practices apply. Export requests, approvals, downloads, and file deletions are audited. Passwords, one-time passwords, authentication tokens, secrets, uploaded attachments, AI conversation history, internal security logs, and raw provider payloads are excluded. Read the complete Data Policy for details.

7. Security and Bot Protection

To protect our website and services from spam, abuse, unauthorized access, and automated bots, we use third-party security and anti-fraud services, including Web Application Firewalls (WAF) and Cloudflare Turnstile. These services may analyze traffic patterns, device characteristics, and network information (such as your IP address) solely to verify that you are a human and not an automated bot, and to block malicious activity. This data is not used for targeted advertising or cross-site tracking.

8. Contact Us

If you have any questions or concerns regarding this Privacy Policy or your data, please contact our Data Protection Officer at privacy@hourops.com or reach out to our support team at support@hourops.com for any queries related to data privacy.

For general inquiries, you can reach us at contact@hourops.com.

Last updated: October 18, 2026

This app was carefully crafted by security-aware engineers.