Privacy Policy

1 Information We Collect

We collect information you provide directly to us and information generated through your use of our platform.

Account information: When you register, we collect your name, email address, and password (hashed). If you sign up via Google OAuth, we receive your name, email and profile picture from Google.

Usage data: We automatically collect information about how you use TotalApp, including features accessed, actions taken, and time spent. This helps us improve the product.

Business data: Data you enter into TotalApp (employees, projects, invoices, etc.) is stored on your behalf. You own this data.

Technical data: IP address, browser type, operating system, referring URLs, and device identifiers are collected for security and diagnostic purposes.

Communications: If you contact our support team, we retain the content of those communications.

2 How We Use Your Information

We use the information we collect to:

• Provide, maintain and improve TotalApp services
• Process transactions and send related information (receipts, invoices)
• Send technical notices, security alerts and support messages
• Respond to your comments and questions
• Send marketing communications (with your consent and opt-out option)
• Monitor and analyse trends, usage and activities to improve the platform
• Detect, investigate and prevent fraudulent transactions and other illegal activities
• Comply with legal obligations

We process your data on the legal bases of contract performance, legitimate interests, compliance with legal obligations, and consent where required.

3 Sharing of Information

We do not sell, trade or rent your personal data to third parties. We may share your information in the following limited circumstances:

• Service providers: We share data with vendors who help us operate TotalApp (cloud hosting, payment processors, email delivery). They are contractually bound to use data only as instructed.
• Within your organisation: Data you add is visible to other members of your TotalApp workspace, according to the permissions you configure.
• Legal requirements: We may disclose data if required by law, court order or government authority.
• Business transfers: In the event of a merger or acquisition, your data may be transferred to the successor entity with prior notice.
• With your consent: We may share data for other purposes with your explicit consent.

4 Data Retention

We retain your data for as long as your account is active or as needed to provide services. When you delete your account, we delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer.

Business data (projects, employees, invoices) is deleted according to your workspace settings and upon account termination.

5 Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted with TLS 1.2+
• Passwords are hashed using bcrypt
• JWT tokens are signed and have short expiry windows
• Access to production systems is restricted and logged
• Regular security reviews and dependency audits

No method of transmission over the internet or electronic storage is 100% secure. If you discover a security vulnerability, please report it confidentially via our contact form.

6 Cookies & Tracking

TotalApp uses cookies and similar technologies to:

• Keep you signed in (session cookies)
• Remember your preferences and settings
• Understand how you use the platform (analytics)

You can control cookies through your browser settings. Disabling cookies may affect some functionality. We do not use third-party advertising cookies.

7 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Ask us to limit how we use your data
• Objection: Object to certain types of processing
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us via the form below. We will respond within 30 days.

8 International Transfers

TotalApp operates globally. Your data may be transferred to and stored on servers in countries other than your own. We ensure appropriate safeguards are in place (such as Standard Contractual Clauses) when transferring data internationally.

9 Children's Privacy

TotalApp is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately and we will delete it.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice in the platform at least 14 days before the changes take effect. Your continued use of TotalApp after that date constitutes acceptance of the updated policy.

11 Contact Us

If you have questions about this Privacy Policy or your personal data, please reach out: