Privacy policy

1. Data controller

The controller responsible for the processing described here is:

Zest Labs GmbH
C 7 1, 68159 Mannheim, Germany
Email: puncha@zestlabs.io
Phone: +49 (0) 160 698 818 9

2. What we collect

On the website

The marketing website sets no cookies and stores nothing in your browser. Usage is measured with a self-hosted Plausible Analytics instance, which is cookieless and records only aggregated page views, referrers and coarse country-level location. No profile is built and no data leaves our infrastructure.

If you send us a message through the contact form, we process the name, email address, optional company name and the content of your message in order to answer you.

In the application

Account data: your name, email address and a securely hashed password, together with the roles you hold in a team. Accounts are managed by our authentication service.
Organisation data: the company profile you create, the members you invite, and the clients and projects you set up.
Time entries: the project, start and end time or duration, and any description you add.
Working time settings: your country (and, where relevant, region) of residence so that the correct public holidays are applied, and the weekly or monthly target hours agreed for you.
Technical data: IP address, timestamp and user agent in our server logs, kept to operate the service securely.

3. Why we process it, and on what legal basis

To provide the service - creating your account, storing your time entries, calculating targets and holidays, showing reports (Art. 6(1)(b) GDPR, performance of a contract).
To send reminders - the quota reminder emails that tell you when your month is short of the target agreed with your organisation (Art. 6(1)(b) GDPR). They can be switched off in your profile.
To keep the service secure and available - logging, abuse prevention, backups (Art. 6(1)(f) GDPR, our legitimate interest).
To answer your enquiries - messages sent through the contact form (Art. 6(1)(b) and (f) GDPR).
To meet legal obligations - in particular commercial and tax retention duties for invoices (Art. 6(1)(c) GDPR).

4. Emails we send

Puncha sends transactional email only: account confirmation and password reset, invitations to a team, and the monthly quota reminder. We do not send marketing email unless you have explicitly asked for it, and every such message can be unsubscribed from with one click.

5. Cookies and local storage

The application stores a session token in your browser so that you stay signed in. It is strictly necessary for the service to work and is deleted when you sign out. We use no advertising or cross-site tracking technologies anywhere on puncha.app.

6. Who your data is shared with

Your time entries are visible to you and to the administrators of the organisation you belong to - that is the purpose of a shared timesheet. Beyond that we share personal data only with processors acting on our instructions under a data processing agreement: hosting and email delivery providers operating within the European Union. We do not sell personal data and we do not transfer it to third countries without a valid transfer mechanism.

7. Where your data is stored

All application data is stored on servers located in the European Union. Backups are encrypted and are held in the same region.

8. How long we keep it

Account and time tracking data: for as long as the account exists.
After an account is deleted: erased within 30 days, except where a longer statutory retention period applies (invoices, for example, are kept for ten years).
Server logs: 14 days.
Contact form messages: up to 12 months after the enquiry is closed.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15);
have inaccurate data corrected (Art. 16);
have your data erased (Art. 17);
restrict processing (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interest (Art. 21);
withdraw consent at any time, with effect for the future (Art. 7(3)).

Write to puncha@zestlabs.io to exercise any of them. You also have the right to lodge a complaint with a supervisory authority; ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

10. Changes to this policy

We will update this page when the service changes. If a change materially affects how we handle your personal data we will notify account holders by email before it takes effect.