Short version: Kệ collects only the data needed to run the time-tracking service. We do not sell your data. Employee data is controlled by the business owner, not Kệ.
1. Who This Policy Applies To
This Privacy Policy applies to two groups:
- Owners — business owners who create and manage a Kệ Timesheet account
- Employees — staff who clock in/out via a PIN on the business's Kệ app
2. Data We Collect
From Owners:
- Name and email address (used for account login and support)
- Business name, address, and timezone
- Subscription and billing information (processed by our payment provider — we do not store card numbers)
From Employees (entered by the owner):
- First and last name, role/title
- PIN code (stored as a one-way encrypted hash — not readable by anyone)
- Clock-in and clock-out timestamps
- Tip distribution estimates and commission summaries
- Optional notes added by the owner
Automatically collected:
- Browser type and device type (for troubleshooting)
- IP address (for security and fraud prevention)
- Usage logs (pages visited, actions taken within the app)
3. How We Use the Data
- To provide and operate the Kệ Timesheet service
- To display time, tip, and commission reports to the owner
- To allow employees to view their own schedule and hours
- To send account-related emails (login, billing, support)
- To improve the product and fix bugs
- To prevent fraud and unauthorized access
4. Who We Share Data With
We do not sell your data. We share data only with:
- Supabase — our database and authentication provider (data stored in the US)
- Netlify — our web hosting provider
- Payment processor — for subscription billing (does not receive employee data)
- Law enforcement — only if required by a valid legal order
5. Employee Data and the Owner's Role
The business owner acts as the "data controller" for their employees' information. Kệ acts as a "data processor" — we store and display the data on the owner's behalf, but the owner is responsible for:
- Informing employees that their work hours and tip estimates are recorded digitally
- Complying with applicable privacy laws in their state or country
- Managing employee data access and removing former employees from the system
6. Data Retention
- Active accounts: Data is retained for as long as the account is active
- Cancelled accounts: Data is deleted within 30 days of account cancellation
- Employee PIN sessions: Anonymous login sessions older than 30 days are automatically cleaned up
7. Security
We take reasonable technical measures to protect your data, including:
- All data transmitted over HTTPS (encrypted in transit)
- Employee PINs stored as bcrypt hashes (not reversible)
- Row-level security (RLS) in our database — each business can only access its own data
- Authentication managed by Supabase Auth with industry-standard JWT tokens
No system is 100% secure. If you discover a security issue, please contact us at support@kenailapp.com immediately.
8. Your Rights
Depending on your location, you may have rights to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention requirements)
- Export your data in a portable format
To exercise any of these rights, email us at support@kenailapp.com.
9. Cookies
Kệ Timesheet uses only essential cookies required for authentication (session tokens). We do not use tracking cookies, advertising cookies, or third-party analytics.
10. Children's Privacy
Kệ is intended for use by adults (18+) in a business context. We do not knowingly collect data from individuals under 18.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify owners via email or in-app notice at least 14 days before material changes take effect.
12. Contact
Questions about your privacy or this policy? Email us at support@kenailapp.com.