What ClockLap collects about you, why, who else sees it, and how to get it removed.
Last updated October 18, 2026
ClockLap is a time-tracking service that employers (our customers) use for their staff. When an employer uses ClockLap, the employer decides what is collected about its staff and why; we process that information on the employer's behalf and only to run the service. If you're an employee with a question about your own records, your employer is the first place to ask, and we'll help them answer you.
For information about the people who run a customer account (owners and admins) and visitors to clocklap.com, ClockLap is responsible for it directly.
| Information | What it is | Why |
|---|---|---|
| Account details | Name, work email, phone (optional), employee ID, team, role, pay rate if the employer adds one | To sign you in, show the right screens, and produce payroll figures |
| Time records | Clock-in and clock-out times, breaks, edits and approvals, with who made them | The core of the service, and the payroll record employers must keep |
| Location | Your phone's position when you clock in or out, and when you enter or leave a work site's boundary (geofence) | Automatic clock-in and out, and to show where a punch happened. We do not record a continuous trail of where you go, and location isn't checked on days off |
| Punch photos | Only if your employer turns them on | To confirm who clocked in. Deleted after 90 days by default |
| Device details | Phone model, app version, a push-notification token, and whether location is faked | Notifications, support, and blocking fake-GPS punches |
| Billing | Company name, billing contact; card details are handled by Stripe and never reach us | To charge for the service |
| Logs | Sign-ins, API requests, and an audit log of changes | Security, troubleshooting and accountability |
Only the service providers we need to run ClockLap, each bound to use the data only for that purpose:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online | Servers, database and file storage | Finland (EU) |
| Postmark (ActiveCampaign) | Sending emails such as invites, sign-in links and reports | United States |
| Stripe | Card payments and invoices | United States |
| Expo, Apple and Google | Delivering push notifications to phones | United States |
| OpenStreetMap (Nominatim) | Turning a site's street address into map coordinates. Only the site's address is sent, never anyone's personal location | EU |
Your employer may also connect other tools (payroll, an AI assistant) through ClockLap's API or webhooks. Those connections are set up and controlled by the employer.
We may disclose information if the law requires it, and will tell the affected customer unless we're legally prevented from doing so.
You can get a copy of everything ClockLap holds about you from Me, then Privacy in the app (we email it to you) or Download my data in the console, and ask for corrections to your time through Request a fix. To ask for your information to be removed or for anything else, contact your employer or email us. Under Canadian law (PIPEDA, and Québec's Law 25 where it applies) and US state laws, you can access and correct your information and complain to a privacy regulator, such as the Office of the Privacy Commissioner of Canada.
Data is encrypted in transit, and the most sensitive fields (phone numbers, pay rates and sign-in secrets) are also encrypted individually in the database. Each customer's data is separated at the database level. Admins can require two-step sign-in or single sign-on. Every change is recorded in an audit log that can't be edited. If a breach affects your information, we'll notify the affected customers and regulators as the law requires.
We'll post any changes here and email workspace owners about anything significant, including the move to in-country hosting.