Privacy Policy
Version 1.2 · Last updated: 10 October 2026
1. Introduction and legal framework
This Privacy Policy describes how personal data is collected and processed within the Workin application (https://app.workin.app) and the marketing website (https://workin.app), published by Pi-Com Sàrl. It is established in compliance with:
- the revised Swiss Federal Act on Data Protection (nFADP), revised and in force since 1 September 2023, and its ordinance (DPO) ;
- the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), where it applies (users or client companies located in the EU / EEA).
2. Roles: controller and processor
Workin acts in a dual capacity depending on the data concerned:
- Pi-Com Sàrl is the PROCESSOR for the data that the client company and its members enter into Workin: employee data (clock-ins, hours, geolocation, leave, medical certificates, etc.) and Projects module data (clients and their contacts, projects, documents, time per project). In this case, it is the client company that is the controller. The terms of this processing are set out in the Data Processing Agreement (DPA), available on request.
- Pi-Com Sàrl is the CONTROLLER for: the account data of administrators and the management of the contractual relationship (registration, subscription, billing, support); the marketing website data; the technical data necessary for the security and operation of the Service (logs, error monitoring).
Contact details:
- Controller: Pi-Com Sàrl, Rue de Lausanne 22, 1030 Bussigny, Switzerland
- IDE / register: CHE-490.271.650
- “Privacy” contact: app@workin.app
As Pi-Com Sàrl is established in Switzerland and the processing of data of persons located in the EU is not carried out on a large scale on a regular basis, Pi-Com has, as things stand, not appointed a representative in the EU (art. 27 GDPR) or a data protection officer (DPO). This assessment is reviewed in light of the development of the activity.
3. Categories of data collected
3.1. Account and identity data
First name, last name, email address (Firebase Authentication); password (hashed, never accessible in clear text by Pi-Com); postal address (optional); preferred language and theme; role (administrator, manager, employee) and company(ies) of affiliation.
3.2. Working-time data (employees)
Clock-ins (start/end times, breaks, net durations, multiple sessions); time-stamped timeline of events; type of device used for clock-in; contractual parameters (activity rate, hours per day, engagement periods, contract type, balances and carry-overs); overtime and its payment.
3.3. Geolocation data
GPS position (latitude, longitude, accuracy) captured at each clock-in event (start, break, end) when geolocation is enabled. It is disabled by default: it is the company that enables it (Pro plan). Each member can then disable it for themselves at any time in “My profile”; their choice is recorded (date, status). In addition, the browser asks for permission to access the location. The corresponding address is not stored: it is calculated on display by reverse geocoding (Nominatim / OpenStreetMap, see § 6).
3.4. Leave and absence data
Leave requests (dates, type of absence, reason, status, working days, comments) and medical certificates uploaded as attachments (see 3.5).
3.5. Sensitive data / data deserving particular protection
Certain data falls within the special categories (art. 9 GDPR) and sensitive data (art. 5 let. c nFADP):
- Medical certificates (health data): files uploaded as supporting documents, stored in Firebase Storage. Access is restricted to the employee concerned, administrators and the designated manager. These files are permanently purged upon deletion of the employee's or the company's account;
- Data revealing health status via the types of absence (sickness, accident, maternity, paternity);
- Geolocation (which may reveal movements / habits).
The processing of this data is the responsibility of the client company (employer), which must have an appropriate legal basis (see § 5).
3.6. Billing and subscription data
Subscription status (plan, number of seats, currency, status, dates); Stripe customer identifier and billing history (managed by Stripe). The payment card data is processed exclusively by Stripe and never stored by Pi-Com (which receives only the brand and the last 4 digits for display).
3.7. Technical data, logs and monitoring
Server logs (Google Cloud Logging / Error Reporting); error reports and application performance measurements via Sentry, sent without name or email address but with technical identifiers (company, member, date concerned), see § 11; rate-limiting data (counters per IP address, email address or identifier); anti-abuse signals processed by reCAPTCHA Enterprise (App Check); data stored locally in the browser (see § 8).
3.8. AI Assistant connector data
When the company enables the AI Assistant connector (Pro plan) and a member links an assistant of their choice to it, Workin processes:
- Connections: the member's identifier, the name declared by the connected application and its return domain, the level granted (read-only or read and write), and the dates of creation and last use. Access tokens are only kept as a fingerprint (hash); they cannot be read back. A connection is kept until it is revoked or after 90 days without use, then erased within 30 days. The token fingerprints of a revoked connection are erased no later than 90 days afterwards.
- Connected application registrations: technical metadata supplied by the application (name, return addresses), erased after 90 days without use (30 days if the application has never been used).
- Personal administration tokens: label, dates of creation and last use; only the token's fingerprint is kept, until it is revoked.
- Log: for each action of an assistant, the date, the member, the action, the item concerned and a summary (for example "90 min on 22.09.2026 on Website"). For a clock-in day or a project time entry, the log also keeps the state before and after the write (start and end times, break, note, allocation per project) and, for a deleted day, its full copy, so that it can be restored. Each member reads the entries for the actions they requested; the administration reads the entire log.
- Versions: the text replaced by an assistant (project text or page), kept so that it can be restored (20 versions per item).
Purposes: to provide the service requested by the member, to allow the company to control what the assistants do (log, revocation, read-only cap), to repair an unwanted write, and to secure the service (rate limiting, detection of token reuse). Legal basis: performance of the contract and legitimate interest in security.
Assistant provider. The data read by an assistant is transmitted to the provider of the assistant chosen and connected by the member themselves: names of clients, projects and tasks, statuses, due dates, assignments, estimates, amounts and time per project; texts and pages viewed; first and last names of members and externals; time entered per project; clock-in days (date, start and end times, break, net duration, note, allocation per project, running timer) of the member and, if they are an administrator or manager, of the members they manage. This provider is not a processor of Pi-Com: it processes this data under its own terms and its own privacy policy, under the responsibility of the user company and the member. The connector never gives access to leave requests, absence types and reasons, medical certificates, balances, contracts, salaries, geolocation, client contact details, members' email addresses, attached files or settings; it can only indicate that a day is an absence, without stating its type or reason.
3.9. Projects module data
When the company uses the Projects module, Workin processes:
- the company's client records: name, reference, address, contact person, email, telephone, note;
- projects and tasks: name, status, due date, estimate, amount, assignment, texts;
- documents: written pages and uploaded files;
- time entered per project: date, duration, note, author;
- externals (persons without an account, designated by a label) and teams.
This data may concern third parties, for example the contacts of the company's clients; the company is responsible for it. An item moved to the trash is kept for 60 days before its permanent deletion.
3.10. Notifications on the device
When a member enables notifications on a device, Workin records that device's subscription: technical address provided by the browser's notification service, encryption keys, browser type, date. Notifications (timer left running, leave, month approval, estimated time alerts) pass encrypted through this service (Google, Apple, Mozilla or Microsoft); their text may contain a company, project or member name. The subscription is deleted when the member disables notifications, when the service declares it invalid or when the account is deleted.
3.11. Integrations
When an administrator links a third-party service (ClickUp, Pro plan), Workin imports and synchronizes, on the company's instructions: the members of the ClickUp workspace (name, email), lists and tasks (name, status, due date, assignment, description, attachments), documents and logged time. The access token is stored encrypted and erased when the service is disconnected; the imported data remains in Workin.
4. Purposes of processing
| Purpose | Data concerned |
|---|---|
| Provision of the time tracking and hours management service | Accounts, clock-ins, contractual parameters |
| Geolocation of clock-ins (option enabled by the company, which each member may refuse) | GPS position, derived address |
| Leave and absence management | Leave requests, medical certificates |
| HR reporting and exports (PDF/Excel) | Hours, absences, identity |
| Authentication and access security | Credentials, verified email, App Check |
| Sending transactional emails | Email, first name, language |
| Subscription management and billing | Subscription data, Stripe identifier |
| Customer support | Contact details, company reference |
| Security, abuse prevention, monitoring | Logs, technical data, Sentry |
| Compliance with legal obligations (labor law) | Clock-ins, contracts, absences |
| Management of clients, projects and time per project | Client records, projects, documents, time per project |
| Notifications on the device | Device subscription, notification text |
| AI Assistant connector and integrations | Connections, log, versions, imported data |
5. Legal bases
On the client company side (controller of its employees; indicative bases): performance of the employment contract (art. 6(1)(b) GDPR; art. 31 nFADP); legal obligation (art. 6(1)(c) GDPR) for the retention of working-time data; legitimate interest (art. 6(1)(f) GDPR) for internal organization and abuse prevention; consent (art. 6(1)(a) and 9(2)(a) GDPR) for geolocation and, where applicable, health data. The precise classification is for each company as controller.
On the Pi-Com side (controller): performance of the contract (Terms / subscription); legal obligation (accounting retention); legitimate interest (security, fraud prevention, monitoring, improvement of the Service).
6. Processors and recipients
Pi-Com uses the following processors, selected for their security guarantees. None is authorized to use the data for purposes other than the provision of its service to Pi-Com.
| Processor | Role | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd. / Google LLC) | Authentication, database (Firestore), file storage, Cloud Functions, application hosting, anti-abuse protection (App Check, reCAPTCHA Enterprise) | Database: Switzerland (Zurich). Files: Germany (Frankfurt). Cloud Functions: Belgium. |
| Resend (Resend, Inc.) | Sending transactional emails | United States (transfer with safeguards, see § 7) |
| Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) | Payments, subscription, tax calculation | Ireland (EU) and United States |
| Sentry (Functional Software, Inc.) | Monitoring of application errors and performance (without name or email address) | European Union (Germany); company established in the United States (see § 7) |
| Infomaniak Network SA | Hosting of the workin.app marketing site | Switzerland |
| Google Analytics / Google Tag Manager (Google Ireland Ltd. / Google LLC) | Audience measurement for the marketing site, after consent (see § 8.2) | European Union and United States |
| OpenHolidays API | Public holidays and subdivisions (no personal data) | European Union |
Other recipients. The following services receive data without being processors of Pi-Com:
- Browser notification services (Google, Apple, Mozilla, Microsoft): they deliver the notifications that a member has enabled (see 3.10); their content is end-to-end encrypted.
- OpenStreetMap (Nominatim): when an authorized person displays the address of a geolocated clock-in, their browser sends the coordinates to this service, which also sees their IP address.
- Third-party service linked by the Client (for example ClickUp, see 3.11): Workin reads from it the data that the Client chooses to import; no Workin data is sent to it.
- Provider of an AI assistant connected by a member (see 3.8): it is chosen and connected by the member, who transmits Workin data to it under the responsibility of the user company.
The application's fonts (Arimo, Inter) are self-hosted: no request is sent to Google Fonts servers. The application does not use any audience analysis tool; only the marketing site uses one, with your consent (see § 8.2).
7. Data transfers outside Switzerland / the EU
The application's data is hosted in Switzerland and the European Union (see § 6). Some processors may process data in the United States: Resend, the US entity of Stripe, Google LLC and Functional Software, Inc. (Sentry) as parent companies, and Google Analytics for the marketing site. These transfers are covered by appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (SCC) (art. 46 GDPR) and the standard clauses recognized by the FDPIC (PFPDT) for transfers from Switzerland, where applicable supplemented by the recipient's adherence to the EU-US Data Privacy Framework (DPF) and its Swiss extension. The other recipients mentioned in § 6 (notification services, OpenStreetMap, AI assistant provider) process the data under their own terms, where applicable outside Switzerland and the European Union.
8. Cookies, audience measurement and local storage
8.1 Strictly necessary elements (without consent)
The Workin application relies on the browser's local storage (localStorage, sessionStorage, IndexedDB) and Firebase authentication, strictly necessary for the operation of the Service:
| Element | Purpose |
|---|---|
| Firebase authentication token | Keeping the logged-in session |
workin-lang | Remembering the interface language |
workin-theme | Remembering the theme (light / dark / auto) |
workin-companyId | Remembering the active company |
| Display preferences | Last project used, list sorting and filters |
| Local copy of viewed data (IndexedDB) | Display speed and offline operation |
| Service Worker cache (PWA) | Offline operation |
| Technical session data | Reloading after an update, startup diagnostics |
As these elements are strictly necessary, they do not require prior consent.
8.2 Website audience measurement (with consent)
The marketing site workin.app uses Google Analytics 4 (loaded via Google Tag Manager) to measure traffic and improve content. These measurement cookies are placed only after your explicit consent (banner displayed on your first visit); the IP address is anonymized. You can decline or change your choice at any time via the “Manage cookies” link at the bottom of the page. The processing is carried out by Google Ireland Ltd / Google LLC; any transfer outside the EU/Switzerland is covered by appropriate safeguards (standard contractual clauses). Your choice is stored in your browser (workin-consent).
9. Retention periods
| Category | Duration (indicative) |
|---|---|
| Clock-ins, hours, absences | Duration of the employment contract, then according to the legal obligations of labor law (Switzerland: ≈ 5 to 10 years depending on the documents; to be adapted to the Client's country) |
| Medical certificates (health) | The time strictly necessary to process the absence; purged upon deletion of the employee's or the company's account |
| Geolocation data | Retained with the associated clock-ins |
| Administrator / user accounts | Duration of the contractual relationship |
| Billing / subscription | Legal accounting obligations (Switzerland: ≈ 10 years) |
| Technical logs and monitoring | Application technical log: 90 days; infrastructure logs and error reports: according to the period set by the provider (a few months at most) |
| Rate limiting (security) | IP address, email address or identifier, and number of requests: erased at the latest one day after the end of the control window |
| Administration logs | Log of space deletions and log of Workin administration access: one year |
| After account deletion (art. 17 GDPR) | Anonymized identity, medical certificates purged; clock-ins may be retained (anonymized/pseudonymized) for the employer's accounting and labor law needs |
| AI Assistant connector | Connections until revoked or after 90 days without use, then erased within 30 days; action log 180 days; text versions 180 days; application registrations erased after 90 days without use; fingerprints of revoked tokens 90 days at most |
| Projects module | Duration of the company space; items moved to the trash 60 days |
| Notification subscriptions | Until deactivation by the member, invalidation by the notification service or deletion of the account and, at most, 180 days without the app being opened on that device |
| Database backups | Daily backups kept for 7 days, weekly backups for 28 days |
Restriction related to labor law: an employee still active in at least one company cannot self-delete. Deletion must be preceded by a removal by the employer, due to the legal obligations to retain time-tracking data.
Deleted spaces: when a space is deleted, by its administrator or for inactivity (free spaces, 60 days after it was last opened and following two email warnings, in line with the principle of proportionality of the revised Swiss FADP (nFADP)), a technical copy of its data, without the files, is kept for 180 days for security purposes, then erased. When a space is deleted, its paid subscription is cancelled and the ClickUp access is removed from Workin.
10. Rights of data subjects
In accordance with the nFADP and the GDPR, every person has the following rights: access (art. 25 nFADP; 15 GDPR), rectification (art. 32 nFADP; 16 GDPR), erasure (art. 17 GDPR; 32 nFADP), portability (art. 28 nFADP; 20 GDPR) (Workin offers a JSON export of your time and absence data from “My profile”), objection (art. 21 GDPR; 30 nFADP), restriction (art. 18 GDPR) and withdrawal of consent at any time (in particular geolocation).
How to exercise: for data processed by Pi-Com as a processor (employee data), the person addresses, in principle, their employer (the client company as controller); Pi-Com assists them. For data for which Pi-Com is the controller (administrator account, billing), requests are sent to app@workin.app. The response is provided within the legal time limits (in principle 30 days). The requester's identity may be verified before the request is processed.
11. Security
Pi-Com implements appropriate technical and organizational measures, in particular: encryption in transit (HTTPS/TLS) and at rest (Google Cloud infrastructure); strict multi-tenant isolation (Firestore and Storage security rules); authentication with mandatory email verification; App Check (reCAPTCHA Enterprise); role-based access control; rate limiting; security HTTP headers (strict CSP, etc.); removal of names and email addresses before transmission to monitoring; encryption of integration tokens; logging of sensitive actions.
In the event of a data breach likely to give rise to a risk, Pi-Com notifies the competent authority (the FDPIC (PFPDT) in Switzerland and/or the relevant EU supervisory authority) as soon as possible (in principle within 72 hours where the GDPR applies), and informs the data subjects where the law requires it.
12. Minors
The Service is intended for professional use within an employment relationship. It is not aimed at minors outside this context. Where a minor apprentice is concerned, the processing is the responsibility of the employer, who ensures compliance with the specific rules applicable to minors' data.
13. Right to lodge a complaint with a supervisory authority
Any data subject may lodge a complaint with the competent authority:
- In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC (PFPDT)), www.edoeb.admin.ch;
- In the European Union: the supervisory authority of the State of residence (e.g. the CNIL in France).
14. Changes to this Policy
Pi-Com may modify this Policy to take account of legal or technical developments. The applicable version is the one published at https://workin.app/confidentialite. In the event of a substantial change, the users concerned are informed by an appropriate means.
15. Contact
Email: app@workin.app
Publisher: Pi-Com Sàrl, Rue de Lausanne 22, 1030 Bussigny, Switzerland
IDE: CHE-490.271.650