Privacy policy.

Work Tracker is operated by Avena Technologies Limited, trading as Unifybase, a company registered in England and Wales (company number 17004284), 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE (“we”).

For activity data and screenshots from the extension, the employer that invited the employee decides what is collected and why; we process that data on the employer's behalf. Employees with questions about their employer's use of Work Tracker should ask their employer first. For admin accounts on this website, we are responsible.

Only while a session is running in that Chrome profile:

• By default, which HTTP/HTTPS sites are visited and for how long: the site name and, if enabled by company policy, the page title. The company can instead choose approved-sites-only mode. Never page text or form contents.
• Whether the person is active or idle, and how long Chrome is not in focus. It cannot see which other app is in use.
• On sites blocked by company policy, and on sites outside the list in approved-sites-only mode, only time is counted: the site is not named, and there are no input counts or screenshots.
• On tracked sites, counts of key presses, clicks and scrolling, never what is typed. Password and card fields are not counted.
• Screenshots of the visible Chrome tab on tracked sites: about every 5 minutes by default (never more often), and 30 seconds after switching tabs (at most once a minute). The company can turn screenshots off.
• The email of the Google account signed in to that Chrome profile, if there is one.
• Technical details: extension and Chrome version, and the profile name the employee gives when connecting.

Nothing is recorded while the session is stopped or paused. The extension shows when it is recording, when it takes a screenshot and how often screenshots are taken, and the employee can see their own activity in the extension.

Before the extension is connected to a company, everything stays on the computer. Once connected, the data is sent to the company's Work Tracker account. A copy is kept on the computer for a limited time (7 days by default), and longer only if it hasn't been sent yet.

• For admin accounts: name, email address, company name and time zone. Passwords are stored only as a secure hash.
• For employees an admin adds: the name and email address the admin enters. When the admin chooses to email an invitation, we use that address to send the connection code and installation instructions.
• Sign-in sessions, including the IP address and browser type, to keep accounts secure.
• A log of admin actions, such as inviting or removing someone or changing settings.

The website uses only the cookies needed to keep you signed in. There is no advertising or analytics tracking, and we do not sell personal data or use it for advertising.

• The admins of the company the extension is connected to. Employees cannot see each other's activity.
• Our operations team, only where needed to run, secure or support the service.
• Service providers that run parts of the service for us: Hetzner (servers and database, Germany), Cloudflare (screenshot and backup storage) and Namecheap (sending account emails and employee invitations).
• Authorities, where the law requires it.

Some of these providers may process data outside the UK. Where they do, we rely on the safeguards UK data protection law requires, such as standard contractual clauses.

• Screenshots: deleted after the period the company chooses, 30 to 180 days.
• Activity records: deleted after the period the company chooses, 180 to 730 days.
• Admin action logs: two years.
• Backups: up to 30 days after the data they contain was deleted.

Data is sent over encrypted connections (HTTPS). Each company's data is kept separate, and access to screenshots requires being signed in as an admin of that company.

Employees can stop or pause recording at any time from the extension, and removing the extension stops it completely. If it is removed while connected to a company, Chrome opens a page on this website so the company sees that Chrome profile as removed; activity already sent is kept under the company's retention settings, and anything not yet sent is deleted with the extension. Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to its use. Employees should contact their employer; we will help the employer respond. Admins can contact us directly. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

The extension reads the email of the Google account signed in to Chrome only to show the company which account a Chrome profile belongs to. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

If we change this policy materially, we will update the date above and, where the change affects what the extension collects, ask employees to confirm again in the extension. Questions: privacy@unifybase.io.