Privacy Policy

Last updated: 21 April 2026

1. Controller

The data controller for ClockInv is Daniel Adámek, based in the Czech Republic, acting as data controller under the GDPR. Contact: daniel@nullptr.cz.

2. What we store

For each Clockify workspace that installs the addon, we store the following in a database hosted in the EU region:

• Clockify workspace ID — opaque identifier issued by Clockify when you install the addon.
• Clockify addon auth token — credential issued by Clockify so the addon can call the Clockify API on your behalf (scopes: read clients / projects / time entries, mark entries invoiced).
• Fakturoid OAuth refresh token — encrypted at rest with AES-GCM; used to obtain short-lived access tokens that let us create invoices in your Fakturoid account.
• Fakturoid account slug — identifier of the target Fakturoid account.
• Client mapping — pairs of Clockify client ID ↔ Fakturoid subject ID, cached so repeated invoicing is consistent.

We do not store your time entries, invoice amounts, client contact details, or PDF copies of invoices. These flow through the Service at the moment you request an invoice and are handed directly to Fakturoid.

3. Purpose & legal basis (GDPR)

Data is processed solely to deliver the feature you requested: generating Fakturoid invoices from your Clockify data. Legal basis under Art. 6(1)(b) GDPR: performance of a contract (you installing and using the addon).

4. Where it’s stored

Data is stored in the EU region.

5. Retention

Data persists until you uninstall the addon in Clockify, at which point an ON DELETE CASCADE removes all rows belonging to your workspace.

6. Sharing

We do not sell, rent, or disclose your data to third parties. Data is sent only to:

• Clockify / CAKE.com — to read your own time entries and mark them invoiced.
• Fakturoid — to create invoices in your own Fakturoid account.

7. Your rights

Under GDPR you may request access to, correction of, or deletion of your personal data, and you may lodge a complaint with the supervisory authority (in Czechia: ÚOOÚ). To exercise your rights, email us or uninstall the addon — uninstalling is the fastest way to erase all your data.

8. Security

Fakturoid refresh tokens are encrypted (AES-GCM, 256-bit) before being written to the database. All traffic is HTTPS. Access logs are retained for up to 7 days for troubleshooting.

9. Changes

Material changes to this policy will be announced on the addon’s settings page in Clockify. The “Last updated” date above reflects the current version.