Privacy Policy

1.Data controller

The company named in the Legal Notice (referred to below as "LogSheet", "we") operates this website and the LogSheet application. Contact: info@logsheet.ch. Our role differs depending on the data: for the data your employer records about you in the application (working time, absences, profile), the customer company is the data controller and LogSheet acts only as its processor — see section 2. For our own operations — visitor data on the public website, account administration, support correspondence and technical diagnostics — LogSheet is itself the controller. This policy addresses both the Swiss Data Protection Act (nFADP) and, where applicable — in particular for users and customer companies based in the EU — the EU General Data Protection Regulation (GDPR).

2.LogSheet's role: processing on behalf of customer companies

For the personal data of employees recorded in the application, the registered customer company is generally the data controller under data protection law; LogSheet processes this data as a processor within the meaning of Art. 9 nFADP or, for customer companies established in the EU, as a processor within the meaning of Art. 28 GDPR, under a data processing agreement and exclusively on the instructions of the respective company. Employees who have questions about their data recorded in LogSheet should contact their employer first.

3.What data we process

In the course of operating LogSheet, we process in particular: account and profile data (name, email address, role, date of birth, start/end date, canton), timesheet data (working hours, categories such as home office or vacation, remarks), holiday and absence data including approval status, company data (company name, team and department structure), and technical data (IP address, device type, access time, approximate region) generated automatically when visiting the website. Absence data includes health-related categories — in particular sickness, and where applicable parental leave and military service. Access to the reason is restricted: a sickness absence is visible in full only to the employee concerned, to company administrators, and to the people the employer has designated to approve absences. All other colleagues see a neutral "Absent" in the team calendar, with no reason and no comment. This restriction applies by default and does not require the employer to enable it.

4.Purpose and legal basis of processing

We process personal data to perform the agreement with the respective company (Art. 6(1)(b) GDPR), to comply with statutory retention obligations (Art. 6(1)(c) GDPR), and to ensure the security and stability of the application and for troubleshooting, based on our legitimate interest (Art. 6(1)(f) GDPR). As part of analyzing visits to our public website, we process data to improve our offering and to measure our advertising — including how many people who saw an advertisement went on to visit the site or open an account. That processing rests solely on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time, and it stays on the public website: it does not follow you into the application.

5.Where your data is processed, and transfer to the USA

LogSheet runs on Google Cloud infrastructure. The application logic — our Cloud Functions — runs in Google's Zurich region (europe-west6), but the primary database (Cloud Firestore), which holds working time, absences and profiles, is currently hosted in the United States, in Google's North America multi-region. Your personal data is therefore transferred to and stored in the USA. Firebase Authentication (email address, password hash, sign-in timestamps) and the delivery of the web application run on Google's global infrastructure, for which no regional option exists; transactional email is relayed by Hostpoint AG in Switzerland. The transfer to the USA rests on Google LLC's certification under the Swiss–U.S. Data Privacy Framework and the EU–U.S. Data Privacy Framework — recognized as providing an adequate level of protection by the Swiss Federal Council and the European Commission respectively — together with the Standard Contractual Clauses approved by the European Commission, with the Swiss addendum, which form part of our agreement with Google.

6.Recipients and service providers used

For the application and the data in it we use the following processors, and no others. Google Ireland Limited / Google LLC (Firebase and Google Cloud): hosting of the web application, authentication, the application database, the server-side functions, abuse prevention (App Check with reCAPTCHA v3, which processes the visitor's IP address and interaction signals on our public pages) and — only on the public website, only with your consent and only while you are signed out — Google Analytics. Hostpoint AG, Rapperswil-Jona, Switzerland: the authenticated mail relay and the info@logsheet.ch mailbox, through which every transactional message is sent (email verification, password reset, employee invitations, timesheet reminders, approval digests, operational notices); it sees the recipient address, the display name and the content of that message, on Swiss infrastructure. Apple Inc.: for the iPhone app only, the App Attest service verifies that a request comes from a genuine installation of our app; it receives a device attestation, not your working-time data. All of them act on our instructions and may not use the data for their own purposes. Our public website additionally carries the Meta pixel from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), which we use to measure our advertising. It is not a processor: it loads only after you accept it in the cookie banner, only on our public pages, and only while you are signed out — signing in removes it, and it is never present in the application or in the iPhone app. It transmits your IP address, the page you are viewing, your browser and device type and a cookie identifier to Meta, which tells us how many people who saw one of our advertisements went on to visit the site or open an account. For that collection and transmission we and Meta act as joint controllers within the meaning of Art. 26 GDPR, on the basis of Meta's controller addendum; what Meta does with the data afterwards is its own responsibility and is described in Meta's own privacy policy. Meta receives no working-time, absence or profile data. Data transmitted to Meta may be transferred to the USA; that transfer rests on Meta's certification under the EU–U.S. Data Privacy Framework and its Swiss extension, together with the Standard Contractual Clauses approved by the European Commission. We do not sell data, and inside the application we run no advertising, attribution or session-replay tools of any kind — the measurement described here exists only on our public website, before you sign in.

Last updated: 29 July 2026

LogSheet processes customer data as a processor and uses the sub-processors listed below — and no others. Each acts on our documented instructions, under a data processing agreement, and may not use the data for its own purposes. This list covers the application and the data your employer records in it. The measurement tools on our public marketing website never touch that data, are not sub-processors, and are described in the privacy policy instead. This page is the notice channel for changes to that list (see below).

7.EU representative (Art. 27 GDPR)

As we also process personal data of users located in the European Union without being established there, we have appointed a representative in the EU pursuant to Art. 27 GDPR: designation in progress. For data protection matters, you may contact either our EU representative or us directly at info@logsheet.ch.

8.Retention period

Working-time records, absences and the monthly archives belong to your employer and follow the retention duty that applies to them — under Swiss law, working-time records must be kept for five years (Art. 73 para. 2 OLT 1), and business and accounting records for ten years where Art. 958f CO applies. They therefore survive the deletion of an individual account (see section 11), attached to an identifier that no longer resolves to a named person in LogSheet. Weekly timesheet snapshots are self-limiting: only the five most recent per timesheet are kept and older ones are deleted automatically. For the data of which we are ourselves the controller, we apply fixed periods: technical error logs are deleted after 90 days, and support conversations 24 months after they are closed. Account and company records are kept for the term of the contract with the customer company and then for as long as statutory retention periods require, after which they are deleted or anonymized.

9.Your rights

You have the right to request information about the personal data we process about you, as well as its rectification, deletion, restriction of processing, data portability, or to object to the processing. Where processing is based on consent, you may withdraw it at any time with effect for the future. We respond to requests for information within 30 days (Art. 25 para. 7 nFADP) or within one month (Art. 12(3) GDPR); please contact info@logsheet.ch. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the data protection authority of your place of residence or work.

10.Cookies and analytics

On the application we set only what is technically necessary: the Firebase Authentication session that keeps you signed in, and a local entry recording your cookie choice. On the public website two things load, and only after you have accepted them in the banner: Google Analytics, and the Meta pixel we use to measure our advertising (which sets a Meta cookie in your browser). Declining means neither is ever started, which is why the choice is real rather than decorative. You can change or withdraw that choice at any time with the "Cookie settings" link below and in the footer: it brings the banner back, and declining there also switches off whatever is already running for the current session. Both are confined to visitors who are signed out: the moment you sign in, analytics is switched off and the pixel is removed, and nothing takes their place. The application itself contains no analytics or advertising tools of any kind, and the iPhone app ships none.

Cookie settings

11.Deleting your account in the iPhone app

The LogSheet iPhone app lets you delete your account from within the app (Account → Delete my account). Doing so permanently removes your sign-in and your personal details — display name and email address — and you can no longer sign in on any device. Your recorded working time, absences and customer-work entries are NOT deleted: under labour law they are your employer's documentation, which they are required to retain, and they remain associated with an internal identifier that no longer resolves to a named person in LogSheet. Employment parameters needed to interpret those records (employment percentage, weekly schedule, vacation allowance) are likewise retained. If you want your employer to erase the records themselves, contact them — they are the data controller for that data (see section 2).

12.Data security

We protect your data through technical and organizational measures, in particular encryption of data transmission (TLS), role-based access permissions, and strict separation of data per customer company.

13.Our own access, and technical diagnostics

We would rather state this than leave it implied: LogSheet operations staff can access customer data, and that access is limited but real. An operator account can open a customer company's administration view in order to provide support, and can view the technical error console. This is used for support and fault diagnosis only, never for any purpose of our own, and today that access is held by one person. Separately, when the application hits a database error it records a diagnostic entry containing the account identifier, the company identifier, the error message, the screen you were on and your browser type, and notifies us by email; the message text is truncated and repeated errors are de-duplicated. These entries are deleted after 90 days (see section 8). No advertising, tracking or profiling is derived from any of it.

14.Calendar feed (iCal)

You can optionally subscribe to a private calendar feed of your own approved absences together with your company's public holidays and events. The feed is protected by an unguessable token in the URL rather than by a login, so anyone who obtains that URL can read it — treat it like a password, and regenerate it in Settings at any time, which immediately invalidates the previous link. Note that once you subscribe, your calendar provider (for example Apple, Google or Microsoft) fetches and stores a copy of those entries, including absence categories such as sick leave, on its own systems. That copy is created at your initiative, sits outside LogSheet, and is governed by that provider's own privacy terms.

15.No automated individual decision-making

LogSheet makes no automated decisions producing legal effects concerning you or similarly significantly affecting you (Art. 21 nFADP, Art. 22 GDPR). The application calculates hours, balances and entitlements, and it flags months for attention, but every approval, rejection and employment decision is taken by a person at your employer. There is no profiling, scoring or behavioural monitoring: no keystroke, screenshot, location or activity tracking of any kind.

16.AI assistant connections

LogSheet offers an optional connection that lets you make your own working-time data available to an AI assistant you choose yourself — for example to ask "how much overtime do I have?" in your assistant instead of opening the app. The connection is entirely voluntary, is set up per person, and requires you to sign in and approve it explicitly. It is READ-ONLY: an assistant connected this way can read data, and can never create, change or delete anything in LogSheet. What can be read is your own working time, absences, balances and public holidays; if you are an administrator, it also covers your team, subject to the same limits that apply in the app — individual figures only for months the employee concerned has validated, and otherwise anonymous group totals covering at least three people. Before any data leaves LogSheet it is pseudonymised: names of people are replaced by their initials and a stable code, e-mail addresses and telephone numbers are masked, and your company name is replaced by a three-letter code. The AI provider you choose processes the data under its own terms, as a processor of your employer, not of LogSheet; we neither select that provider nor decide what it does with the data. You can see and revoke your connections at any time under Settings → Connected apps, and revoking one takes effect immediately.

17.Changes to this policy

We may update this privacy policy to reflect changes in law or in the application. The version published on this page at any given time is authoritative.

18.Contact

For questions about data protection, please contact us at info@logsheet.ch.