Privacy Policy

From admins: name, email address, a hashed password (we never store or see your actual password), and your company name.

From employees: name, email address, and a hashed password. While clocked in, we also record GPS coordinates at clock-in, clock-out, breaks, and periodically (at most every 2 minutes) during the shift. Employees can also add shift notes and task titles, which are visible to their company's admins.

If an admin uses the payroll exports, they can also enter an employee's hourly rate or salary, the employee's ID in their payroll provider, and recurring deduction or reimbursement amounts. Only that company's admins can see or change this - employees can't, and it isn't shown anywhere in the employee app.

We don't collect payment card details ourselves - those go directly to Stripe, our payment processor, and never touch our servers.

To operate the service your company signed up for: verifying and recording clock in/out location, tracking shift time and breaks, and generating the reports and payroll export files admins download (hours, overtime, gross pay and the deductions admins list - we don't calculate taxes or withholding). Location data specifically exists to verify punches actually happened where an employee says they did - it's a core, disclosed part of the product, not incidental tracking.

Your card details go directly to Stripe, our payment processor - you'll see their checkout page when you pay. A handful of trusted infrastructure providers help us run the service behind the scenes, each bound by its own data protection terms. We don't sell data, and we don't share it with anyone for advertising or marketing.

If an admin connects QuickBooks Online, Punchcard sends that company's worked hours (employee, date, hours and a short description) to the QuickBooks company the admin chose, and reads its employee list so people can be matched. We store the QuickBooks connection encrypted and use it only for that. An admin can disconnect at any time from Reports or from QuickBooks; canceling the account deletes the connection and its records.

Your company's data is kept for as long as the account is active. If an admin cancels the subscription, every employee record, every shift and location entry, and the company record itself is permanently deleted immediately - there's no retention period or recovery window after that point. When an admin deletes a single employee, that person's past shifts (and their name and pay settings, if any were entered) are kept with the company's records so payroll history stays complete, until the company cancels.

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data. In this product specifically:

• Access & portability - admins can export full shift history (with location data) as PDF or CSV at any time from Reports; employees can do the same for their own hours from My time.
• Rectification - admins can correct shift records; every correction is logged with who made it and why, not applied silently.
• Erasure - canceling the subscription erases all company data immediately. For an individual request outside of that, contact us below.

Questions about this policy or a request about your data: Contact