Privacy Policy

This Privacy Policy explains how [Your Legal Entity Name] ("PTO Manager", "we", "us") collects, uses, and shares information when you use our workforce time-off management service at pto-manager.com (the "Service").

1. Who we are

The Service is operated by [Your Legal Entity Name], registered at [Registered Address]. For privacy questions, contact us at privacy@pto-manager.com.

2. Information we collect

2.1 Information you provide

• Account information: your name, work email address, and password (stored only as a one-way hash).
• Workspace information: your company name, industry, and team size.
• Employment details (optional): department, position, and hire date.
• Time-off data: leave requests, dates, leave types, approval decisions, decline reasons, and related notes.

2.2 Information from Google sign-in

If you choose "Sign in with Google" or "Sign up with Google", Google authenticates you and shares your name, email address, email verification status, and a unique Google account identifier. We use this to create or locate your account. We do not receive your Google password, and we do not access your Gmail, Calendar, Drive, or any other Google content.

2.3 Information collected automatically

• Session and security data: cookies required to keep you signed in and to protect our forms against cross-site request forgery.
• Technical data: aggregate, non-identifying visit statistics (pages viewed, referrer, and approximate country) used to understand site usage.

3. How we use information

• Provide, operate, and maintain the Service.
• Authenticate you and keep your account secure.
• Send transactional emails: email verification, team invitations, and password resets.
• Maintain team calendars, leave balances, and approval records.
• Respond to support requests and troubleshoot issues.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your data for advertising.

4. Legal bases for processing (GDPR)

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you (or your employer) signed up for.
• Legitimate interests — to secure the Service, prevent abuse, and improve functionality.
• Legal obligation — where we must retain or disclose information by law.
• Consent — where you have given it; you may withdraw it at any time.

5. Cookies

We use strictly necessary cookies to keep you signed in and to protect form submissions. See our Cookie Policy for the full list.

6. Sharing and service providers

We share information only as needed to run the Service:

• Hosting provider — stores the application and database.
• Email delivery provider — transmits verification, invitation, and password-reset emails.
• Google — only when you choose Google sign-in, for authentication.
• Professional advisers and authorities — where required by law or to protect our rights.

If you use PTO Manager as part of your employer's workspace, your employer's administrators can access the time-off data you submit within that workspace.

7. Data retention

We retain account and time-off records while your account is active and for as long as needed to provide the Service to your workspace. When an account is deleted, we remove or anonymize the associated records, except where we must retain certain information to meet legal, tax, or audit obligations.

8. Security

We protect your information with measures including encrypted transport (HTTPS), hashed passwords, server-side authorization checks on every action, and protection against cross-site request forgery. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

Our servers and service providers may be located outside your country. Where we transfer personal data internationally, we rely on appropriate safeguards such as standard contractual clauses.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to receive a portable copy, and to withdraw consent. See our GDPR & CCPA page for how to exercise these rights.

11. Children

The Service is intended for use in a workplace and is not directed to anyone under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you through the Service or by email, and update the "Last updated" date above.

13. Contact us

Questions about this policy or your data? Email privacy@pto-manager.com or write to [Registered Address].