Privacy policy

1. Who is responsible for your data?

• Private account (you log your own time without an employer): Tizfai Technologies AB is the controller.
• Employee: your employer is the controller of the data about you and your working time. We process it on the employer's behalf, as a processor, under an agreement with the employer. Ask your employer first about your time and your data.

2. Which data do we process?

• Account: name, email address, password (stored only as a secure hash), chosen language and, if your employer added it, mobile number.
• Employment: personal identity number or coordination number (stored encrypted and shown masked), employee number, workplace and employer.
• Stamps and working time: the time (set by our server's clock), the type of stamp (in, out, break, business trip), how it was approved and every change with who, when, before, after and why.
• Location: for employees, the app takes the phone's position at the moment you stamp, and only then. Your location is never followed in the background. Private accounts give no location.
• Network and security: IP address when stamping and signing in, and whether the app sees that the phone uses a VPN.
• Your phone: a random installation id created by the app, the phone's model, operating system and app version, so that you can see and sign out devices.
• BankID: when you approve a stamp with BankID we receive BankID's confirmation with your name and personal identity number.
• Schedule: if your employer uses ScheduleFai, your shifts and your applications for open shifts.

We use no advertising or analytics tools and no tracking. The web uses only a necessary sign-in cookie. Face ID, Touch ID and fingerprints stay on your phone and never reach us.

3. Why, and on what legal basis?

• Give you a private account and keep your time. Legal basis: contract (the terms of use).
• Record employees' working time, approval and the staff register. Legal basis: the employer's legal obligations, including the Swedish Working Hours Act and the staff register rules of the Tax Procedure Act, and the employer's legitimate interest.
• Location, network and BankID when stamping, so that nobody stamps for someone else or from the wrong place. Legal basis: the employer's legitimate interest.
• Email about the account (invitations, codes, passwords and notices). Legal basis: contract.
• Security, troubleshooting and preventing misuse. Legal basis: our legitimate interest.

4. How long do we keep the data?

• Location and IP address in the stamp log: removed after 12 months. The stamp itself remains.
• Stamp attempts that were never completed: 90 days.
• Operational logs and one-time codes: at most 30 days.
• Private account: until you delete it. The account and all your time are deleted 14 days after you choose Delete the account; signing in before then cancels the deletion. A private account unused for 24 months is deleted after we have told you by email.
• Employees: as long as your employer uses LogFai and as the employer instructs. The employer may be required to keep time records and the staff register for a certain period.

5. Who receives the data?

• Your employer (if you are an employee): your stamps, the location at stamping, changes and your schedule.
• Our sub-processors, who process data only on our behalf: Hetzner Online GmbH (servers in the EU), our own mail server for sending email, and Finansiell ID-Teknik BID AB (BankID), through Nordea, for approval with BankID.
• ScheduleFai, Tizfai Technologies AB's service for scheduling and payroll, if your employer uses it. The two services share the staff register.

We never sell personal data and never disclose it for advertising. The data is stored and processed within the EU/EEA.

6. Your rights

You have the right to know which data we hold about you, to have errors corrected, to have data erased, to restrict or object to processing, and to receive your data in a machine-readable format.

• Private account: under Settings you can download your data and delete the account. You can also write to us.
• Employee: contact your employer. We help the employer answer.

If you are unhappy with how we process your data you can complain to the Swedish Authority for Privacy Protection (imy.se).

7. Security

All traffic is encrypted (HTTPS). Personal identity numbers are stored encrypted and passwords as hashes. The app's sign-in is kept in the phone's secure storage and never in the web pages. The stamp log cannot be changed afterwards; every correction is saved as a new event.

8. Contact

Tizfai Technologies AB, Kumminvägen 1, 611 46 Nyköping, Sweden. Email: info@logfai.com.

9. Changes

We publish changes here with a new date and version number. For larger changes we tell you in the app or by email.