Curio Time – Terms & Privacy Policy

1. Who We Are

Curio Time is operated internationally by Curio Time OÜ.

2. Information We Collect

We collect only the information necessary to provide our Services securely and effectively:

• Account information: name, email, password, organization, role.
• Usage data: time tracking, attendance, logs entered by users.
• Foreground GPS location data: the Curio Go app may access precise location while the app is in use to show the user's position and saved workplaces on a map. If an employer requires GPS verification, coordinates captured at clock-in or clock-out are sent to Curio Time and are available to that employer.
• Optional background GPS location data: only after the user separately enables Auto and grants 'Allow all the time' access, Curio Go uses location in the background to detect arrival at and departure from saved workplaces and create private IN/OUT suggestions. These suggestions remain on the device and are not shared with the employer or added to a timesheet unless the user chooses to save them.
• Project attachments: photos and any location the user chooses to attach to a project.
• Notification data: push tokens and notification preferences.
• Device and technical data: IP address, browser/app version, cookies.
• Payment data (if you are a subscriber).

3. How We Use Information

We use your information to:

• Provide and improve the Services.
• Record time and attendance with GPS location for verification.
• Enable payroll integration and reporting.
• Communicate with you about updates and support.
• Comply with legal obligations.

We do not sell your data to third parties.

4. Sharing of Information

We may share your data only in these cases:

• With your employer/organization (if you are a registered member).
• With trusted service providers (hosting, analytics, payment processing).
• To comply with legal requests or protect rights and safety.

Private Auto IN/OUT suggestions stored on the device are not shared with the employer unless the user saves them to a timesheet.

5. Security & Data Storage

• Data is encrypted in transit (SSL) and stored securely.
• While we take all reasonable measures, no system is 100% secure.
• Data may be processed in the EU/EEA or other countries where service providers operate, always in compliance with GDPR.

6. Data Retention and Deletion

We retain personal data only for the period needed for the purposes described above. Retention depends on who controls the record and why it is needed:

• Private Auto IN/OUT suggestions and their background-location coordinates remain only in the app's local storage until the user clears the app data or uninstalls the app. Saving a suggestion creates a time record on Curio Time's servers; ignoring a suggestion hides it but it may remain in local app storage until the app data is cleared.
• Account, profile, device and push-token data is retained while the account is active. After a verified deletion request or an employer's instruction to remove an employee account, data that is not linked to an employment, payroll, accounting or other legal record is deleted or anonymized as part of the account-removal process.
• Submitted time, attendance, leave, payroll-support records and GPS coordinates attached to clock-in or clock-out are employer-controlled employment records. Curio Time does not apply one universal automatic deletion date to these records. They are retained until the employer instructs Curio Time to delete them, the customer account is lawfully closed, or the applicable payroll, accounting, employment-law, audit or legal-claim retention period ends, whichever requires the record to be kept longer.
• Project photos and other project attachments are retained while the related project or customer account remains active, or until the customer organization deletes them, unless they must be preserved for a legal claim.
• Private kiosk punch-photo files are scheduled for deletion six calendar months after capture. Their database rows may remain as deletion audit markers without the photo file.
• Security, access and support logs are retained for the operating or investigation period for which they are needed and are then deleted or anonymized, unless they must be preserved for a security incident, fraud investigation or legal claim.
• Residual copies in encrypted backups remain until they are overwritten through the ordinary backup-rotation process. Deleted data is not restored to the live service except where required for disaster recovery or law, and will be removed again after recovery.
• Payment, invoice and tax records are retained for the period required by applicable accounting and tax law.

Users may request access, correction or deletion by contacting their employer or info@curiotime.is. Where the employer is the data controller, Curio Time will act on the employer's documented instructions, subject to applicable law.

7. Cookies & Analytics

We use cookies and tools such as Google Analytics to improve the experience and measure usage. You can disable cookies in your browser, but some features may not work.

8. Your Rights (GDPR / Applicable Law)

Depending on your location, you may have the right to:

• Access a copy of your data.
• Request correction or deletion of your data.
• Restrict or object to processing.
• Withdraw consent at any time.
• Export your data to another provider (where technically feasible).

Requests can be made by emailing info@curiotime.is.

9. Account Deletion

• If you close your account, we remove your data from marketing and billing systems.
• Some historical records (attendance, GPS clock-in/out logs, payroll-related data) may need to remain for accounting and legal compliance.

10. Third-Party Links

If you use third-party services with Curio Time (e.g., payroll or accounting systems), their privacy policies apply. We are not responsible for their practices.

11. Updates to These Terms

We may update these Terms from time to time. If changes are material, we will notify you by email or within the app before they take effect.

12. Contact