Privacy policy

Last updated: 4 November 2026 · This translation is provided for information: in case of any discrepancy, the French text prevails.

Pointly is a time tracking app for field teams. This page explains what data we process, why, where it is stored and how to exercise your rights. It concerns visitors to pointly.be, client companies and their employees.

1. Who is responsible for your data?

Pointly is a project being set up, published by Matias Arbesu, a natural person domiciled in 1420 Braine-l'Alleud (“Pointly”, “we”). It is not yet operated by a company: this page will be updated when it is set up. For any question: contact@pointly.be.

Depending on the data, our role is not the same:

• We are the controller for the data of site visitors, the accounts of client companies (their administrators) and their billing.
• We are a processor for the employee data that the client company records in Pointly: time entries, photos, contract hours. The company, as employer, is responsible for it. We process it solely on its instructions, to provide it with the service, and we undertake to protect it and delete it at the end of the contract (article 28 of the GDPR, detailed in article 8 of our terms).

2. What data?

On the pointly.be site

No audience measurement, no third-party service loaded by the site. As for any site, our host processes your IP address to display the pages and protect the service.

If you apply for the pilot programme, we receive what you fill in: the name of your company, your trade, the number of employees, your name, your email address and, if you provide them, your phone number and your message, as well as the language of the page, so we can reply in yours. To limit abusive submissions, we also keep a fingerprint of your IP address, not the address itself.

In the app

• Administrator account: first name, last name, email address, company name, the language chosen for the app, and the latest app update shown to you, so it isn't shown again. The password is managed by Google (Firebase Authentication): we never have access to it.
• Employees, recorded by the company: first name, last name, email address, contract hours, start date, whether the account is active. Each employee adds the language they choose for the app.
• Time entries: date, start and end times, breaks, client or site, tasks done, notes, photos added, approval status, reason for a rejection, and the history of changes (who changed what, and when).
• The company's clients: name, address and, if the company enters them, contact person, phone, email and notes. A file chosen to import clients is read on the administrator's device: it is neither sent to nor kept by Pointly, and only the imported clients are saved.
• Billing: the bank card is entered with Stripe, our payment provider; we never see its number. We keep the Stripe customer ID, the subscription status, the amounts and the invoices.
• Time entry reminder, if you turn it on on a device: the subscription address that the device's browser gives us so we can send it notifications (a technical identifier, without your name or phone number) and the keys that encrypt these notifications. The reminder is sent based on your time entries and your timer for the day, already recorded in the app.
• Dictating a time entry, if you use it: the recording of your voice is sent to Gemini, Google Cloud's artificial intelligence service, which extracts the text of what you said and the proposed time entries. Neither the recording nor this text is kept: only the time entries you save after checking them are kept, like a time entry entered by hand. We also count the number of dictations per person per day, limited to 20.
• Emails: invitations sent to employees and account-related emails.
• Technical data: operation and error logs from our servers.

3. Why, and on what basis?

• Providing the app: accounts, time entries, approvals, reportsPerformance of the contract with the client company (art. 6.1.b GDPR)
• Sending invitations and account-related emailsPerformance of the contract
• Sending the time entry reminder, on the devices where it has been turned onPerformance of the contract
• Proposing time entries from a dictation, when you use itPerformance of the contract
• Invoicing the subscription and keeping our accountsLegal obligation (art. 6.1.c)
• Securing the service, preventing fraud and abuseLegitimate interest (art. 6.1.f)
• Reviewing your application for the pilot programme and replying to youSteps taken at your request before a contract (art. 6.1.b)
• Replying to your messagesLegitimate interest, or performance of the contract

For employee data, the employer determines the legal basis, for example its obligation to record working time or the employment contract.

4. Where is it stored, and who has access?

The app's database and the time entry photos are hosted in Belgium, with Google Cloud (europe-west1 region).

Each company only has access to its own space. Within a company, an employee only sees their own time entries; administrators see the company's.

We use these providers, each for its part of the service:

• Google Cloud and Firebase (Google Ireland Limited)Hosting of the site and the app, database, accounts, photos, server functions, and Gemini for dictation. The voice is analysed on Google's servers, which may be located outside the European Union; Google does not use it to train its models.
• Stripe (Stripe Payments Europe, Ireland)Subscription payment and invoices
• Resend (Resend, Inc., United States)Sending emails: invitations, and pilot programme applications received by the publisher
• OVHcloud (France)Domain name and contact@pointly.be mailbox
• Browser notification services (Google, Apple, Mozilla or Microsoft, depending on your device)Delivery of the time entry reminder to your device. Its content is encrypted: only your device can read it.

Some of these providers may process data outside the European Union, particularly in the United States. These transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.

We do not sell or rent any data, and we do not use it for advertising.

5. How long?

• Company account and data (employees, time entries, photos, clients): as long as the account is active. When the account is closed, on simple request to contact@pointly.be, the company can first export its time entries; we then delete its data within 90 days.
• Invoices and accounting data: 10 years, as required by Belgian law.
• Pilot programme applications: 12 months after our reply, then deleted. If your company joins Pointly, its account takes over.
• Invitation links: valid for 7 days.
• A device's subscription to the time entry reminder: deleted when you turn off the reminder or sign out on that device, when the notification service tells us it is no longer valid, or when you leave the company.
• Dictation: the voice recording and its text are not kept; they are only used to propose the time entries. The dictation counter is reset every day.
• Technical logs from our servers: 30 days.

6. How is it protected?

• All connections are encrypted (HTTPS), and the data is encrypted on Google's servers.
• Access rules, checked by the server, restrict each company to its data and each employee to their time entries.
• Passwords are managed by Firebase Authentication: they are never stored in plain text and we have no access to them.
• Payments are processed by Stripe, which is PCI DSS certified.
• Every change to a time entry is kept in its history.

7. Cookies and storage on your device

• pointly.be site: no cookies. If you start the demo timer, its start time is kept in your browser for as long as the tab is open, and is never sent. The font is served by the site itself.
• app.pointly.be app: the app keeps your sign-in session, the language chosen on this device and a copy of the data so it works offline, in your browser's storage. If you turn on the time entry reminder, it also keeps this device's subscription there, and whether you tapped “Not now”. These elements are strictly necessary for the service.
• Payment: the payment page is hosted by Stripe, which uses its own cookies there to secure the payment and prevent fraud (see Stripe's privacy policy).

As we use neither audience measurement nor advertising cookies, we do not ask for your consent. If that were to change, we would ask you before placing anything.

8. Your rights

You can request access to your data, its rectification, erasure or portability, and the restriction of its processing, and you can object to processing based on our legitimate interest. Write to us at contact@pointly.be: we reply within one month.

Are you an employee? Your employer is responsible for your time entry data: send your request to them first, and we will help them respond. You can also write to us, and we will pass it on to them.

Finally, you can lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).

9. Changes

We update this page when our practices change; the date at the top shows the latest version. In the event of a significant change, we notify client companies by email.