Custom Hours

Who we are

Custom Hours is operated by Custom Projects AS, a Norwegian aksjeselskap. Organisation number: 934561112. Country: Norway. This Privacy Policy explains how personal data is processed when Custom Hours is used.

What data we process

Account data: name, email, role, company membership, and access status.
Company data: company name, settings, billing email, organisation number, employee access, and subscription metadata.
Work data: projects, work dates, start/end times, breaks, comments, statuses, rejection reasons, and approval decisions.
Absence data: absence type, dates, status, and related administrative notes.
Audit logs: records of important actions, including actor, action, entity, summary, and timestamps.
Technical and security data: session identifiers, timestamps, IP address, user agent, and hashed security identifiers where stored.
Payment metadata: Stripe customer, subscription, billing status, and payment-related metadata. Custom Hours does not store full card details.

Why we process data

To provide authentication, company access, hour registration, project tracking, absences, approvals, and reporting.
To keep an audit-friendly history for accountability and troubleshooting.
To operate subscriptions, billing status, payment handling, and applicable tax calculation through Stripe.
To keep the Service secure and investigate abuse, errors, or unauthorized access attempts.
To maintain and improve reliability of the Service.

Legal basis and roles

For business customers, the customer is usually the data controller for employee data, and Custom Projects AS acts as a processor. Some processing may also be necessary to operate the Service, protect security, comply with law, manage customer subscriptions, handle billing, or respond to legal or support requests.

Payment processing

Payments, subscription management, billing, and applicable tax calculation are handled through Stripe. Stripe may process payment and billing information according to its own terms and privacy documentation. Custom Hours does not store full card details.

If a customer owner chooses immediate workspace deletion while a Stripe subscription is still active or recoverable, Custom Hours may request immediate subscription cancellation through Stripe before deleting the workspace.

Data sharing and service providers

We do not sell personal data. Data is shared only with service providers needed to run, secure, maintain, and bill for Custom Hours, and only to the extent required for those purposes.

Render: hosting and PostgreSQL database infrastructure. The production database is hosted in Frankfurt (EU Central).
Resend: transactional email delivery, including employee invitations and password reset emails.
Stripe: payment processing, subscriptions, billing management, and applicable tax calculation during checkout.

DomainShop is used for domain and DNS administration. It is not used as an application data processor unless customer personal data is sent through a DomainShop service.

Data retention

We retain personal data as long as needed to provide the Service and meet legitimate operational needs such as auditability, billing, security, legal compliance, dispute handling, and accounting requirements. Customers may request export or deletion where applicable.

When a customer owner requests workspace deletion, Custom Hours records a retention-until date that is currently 90 days after the deletion request. Final workspace deletion requires explicit confirmation and is intended to be permanent and irreversible.

Final workspace deletion may anonymize company, employee, and project identifiers, revoke active sessions, clear notes and personal identifiers, and mark operational records such as hour entries and absences as deleted. The 90-day marker does not mean that all database rows are automatically physically purged after 90 days.

If a deleted workspace was a user's only active company membership, the user's global account email may be anonymized or released so the email can be used again for a new signup. If the user still belongs to another active company, the global account email may be retained so access to that other company can continue.

Some records may be retained where needed for billing, accounting, security, legal compliance, dispute handling, audit integrity, or backup rotation. Production database recovery is handled by Render. The current Render PostgreSQL setup supports point-in-time recovery for the past 7 days. Logical database export files, if created, are retained by Render for at least 7 days.

Security

We use reasonable technical and organizational measures to protect data, including server-side tenant isolation, role-based access control, server-side sessions using an HttpOnly session cookie, Secure cookies in production, hashed server-side session tokens, validation and authorization checks on protected routes, audit logging for key actions, and standardized API error handling with request identifiers.

Cookies and tracking

Custom Hours uses a necessary authentication session cookie named cph_session to keep users signed in and protect access to the Service. The session cookie is configured as HttpOnly, SameSite=Lax, and Secure in production, with a session lifetime of 30 days.

Based on the current application code, Custom Hours does not use analytics cookies, advertising pixels, or marketing tracking scripts. If this changes, this Privacy Policy should be updated and additional consent handling may be required.

Your rights

If you are an employee using Custom Hours through your employer, contact your employer first. Customer administrators may contact Custom Projects AS to request access, correction, export, or deletion where applicable.

Customer owners can request workspace export and deletion from the account settings. Employee requests about work records should normally be handled through the employer, because the employer is usually the controller for employee work data.

Contact

For privacy requests, contact Custom Projects AS by email at support@customhours.no.