Privacy Policy

1Who holds what

Two different relationships run through this product, and they are governed differently.

Your account is ours to look after. The name, work email and password you signed up with, the organization you created, your billing details and the record of who did what in the console. We decide how that is handled, and this policy is our commitment about it.

What the desktop agent records about a member at work belongs to their organization. That organization decides whether to record at all, what the tracking window is, how long screenshots are kept and who may look at them. We store and process it on their instructions. If you are being tracked by an employer, they are the ones who chose these settings — and clause 7 says what you can see and ask for regardless.

TrabajoCRM is operated by [legal entity — to be confirmed]. Questions about anything on this page go to [contact address — to be confirmed].

2What the desktop agent records

Only while a timer is running, and only inside the tracking window the organization set. Stopping the timer stops all of it.

3What is never recorded

These are the same six promises the front page makes. They are not settings, and there is no plan or contract under which they are turned on.

4What we collect from the website and the console

• Your account. Name, work email, a hashed password, your role and the organization you belong to. If you sign in with Google we receive your Google account identifier, name and email — and nothing else from Google.
• Your CRM. The clients, contacts, deals, invoices and notes your organization puts into the product. This is your material; we do not read it, mine it or train anything on it.
• A record of decisions. Who approved a week, raised an invoice, changed a setting, removed a member or unpaired a machine, and when. A member can always read the entries about themselves.
• When you used the console. The first and last time each day you had the console open or the desktop app recorded work, so your organization can see who was in. Only the people who can already see your hours can see this, and you can see your own on the Attendance page.
• Questions you put to AI. When you use an AI feature, such as Ask AI on a task, the question and what it needs are sent to the provider named in clause 5 to write the answer. For Ask AI that is the question you typed or the quick question you chose, and for 'Check my plan' the plan you typed, together with the task's title, description and thread. TrabajoCRM does not store Ask AI questions or answers unless somebody chooses 'Post as comment', in which case the answer is an ordinary comment and is kept like one. Plans sent to 'Check my plan' are not stored either; only if you click 'Ready to start' is the check's short summary posted to the task, as an ordinary comment kept like any other.
• Plans from the AI assistant. What you ask the assistant on the AI page is kept with the plan it proposed, the name of any document you attached and what applying the plan made, so you can find it again under Recent plans. The attached document itself is read for that one request and not stored.
• Courses written with AI. Only when an owner or manager presses 'Write the draft' on the Training page, the material they chose is sent to the provider named in clause 5 to write a course: each chosen file, with its name — a PDF as the document itself, a Word, text or Markdown file as its extracted text — any pasted text, and what was typed in 'Who is it for?', the rough number of lessons, the pass mark and the course language. The draft that comes back — title, summary, lessons and quiz questions — is saved as an inactive course the organization can edit or delete. The uploaded files are kept with it as document lessons in the private storage bucket, when file storage is set up. Pasted text is not stored. A run refused before anything is written, or cancelled before the AI starts, discards the draft and its files. A run cancelled after the AI has started still saves its draft, which can be deleted from the course list.
• Training progress. Which lessons a member has completed, and when; their quiz attempts and scores; and any certificate earned. For a lesson with a video, the completion also records how it was shown to have been watched: that the video played to the end, or that the member ticked 'I watched this' instead. Nothing else about the viewing — how far they got, whether they paused or skipped — is recorded.
• Social accounts you connect. When somebody in Marketing connects a Facebook Page, an Instagram account, a LinkedIn profile, a YouTube channel or another social account, that platform's own sign-in gives us an access token for it, and for some platforms a refresh token. We store them encrypted (AES-256-GCM) and use them only to publish the posts your organization schedules for that account and to read, for your reports, the account's name and follower count and the likes, views and comment counts of the posts we published. Pressing × on the account in Manage connections deletes the stored tokens; what was already published keeps its numbers. You can also withdraw our access on the platform itself at any time. Threads and Pinterest connect through their own sign-in the same way. A Bluesky account connects with an app password that its owner makes in Bluesky: we use it once, to open a session, and never store it; we keep only the encrypted session Bluesky gives back, and revoking the app password in Bluesky ends our access. For a Google Business Profile location we may also read, once Google has approved it, how many times it was shown and the words people searched when it was, counted per month by Google and never naming who searched.
• Comments in the Marketing inbox. For a Facebook Page or an Instagram account connected in Marketing, we read the comments people leave on its posts, from Meta's notifications or by asking Meta about once an hour, so the organization can answer, hide, delete or like them in one place. Of each commenter we keep only what the inbox shows: Meta's id for them on that Page or account, their handle or display name, the text of the comment, any picture link Meta attached, and when. Nothing else about them. The organization's own notes about a commenter are kept with them, and who on the team the conversation was given to. The notices the inbox puts in the team's bell name the account, never the commenter or what they wrote. An owner or manager can delete everything kept about one commenter from the inbox at any time. Meta's notification is kept only until it has been read, and the record that it arrived for a week. All of it is deleted after the organization's retention, with the account or the brand, and when Meta tells us a person asked for their data to be deleted.
• Messages, reviews and mentions in the Marketing inbox. Once the platform has approved it for this service, the inbox also reads, in the same way and keeping the same few things: the direct messages people send to a connected Facebook Page or Instagram account (Meta's id for the person on that Page, which is not their Facebook id, their name or username, and what they wrote, never their email address); the Google reviews of a connected Business Profile location (the reviewer's name and picture as Google shows them, the stars and the text); the comments on a connected YouTube channel's videos and on a TikTok business account's videos; the direct messages people send to a connected X account (X's id for them, their name and username, what they wrote and any picture link X attached); the posts on X that mention a connected account; and the comments on a connected LinkedIn company page's posts and the posts that mention the page (LinkedIn's id for the person and what they wrote: LinkedIn shares no name with us). They are deleted by the same retention, with the account or the brand, and when the organization deletes everything kept about a person. Answers sent from the inbox are sent on the platform, as the account, with any picture, GIF or video the team attached from the brand's media library or by a link.
• The inbox's webhook. An owner or admin may ask for each new conversation to be sent to an address of their choosing, such as Zapier or Make. It then carries the network, the account, the brand, the person's name and handle, and the first 200 characters of what they wrote. That is the organization's choice, under its own responsibility for the person's data. What is waiting to be sent is kept only until it has been sent, or eight tries have failed, and is deleted with the conversation.
• Ad accounts you connect. When somebody in Marketing connects a Meta, Google or TikTok ad account to a brand, we keep that sign-in's token encrypted, and read the account's campaigns, ad sets and ads with what each spent and its daily totals of impressions, reach, clicks and conversions. These are the advertiser's own figures: nothing about who saw or clicked an ad is asked for or kept. Once the platform allows it, a campaign, ad set or ad can be switched on or off, its budget changed, or a campaign created from here, and we keep a record of each change and who made it. Taking an ad account off its brand, or the brand being deleted, deletes everything read for it.
• Competitors a brand follows. When somebody in Marketing adds a public Instagram, Facebook, Threads, YouTube, Bluesky or X account as a brand's competitor, we read once a day only what that network shows anybody: the account's name, picture and follower and post counts, and its recent posts with their public likes, comments, shares and views, keeping a post's text only as its first 280 characters. Nothing about who follows the account or who reacted is asked for or kept, and a private account cannot be read. Removing the competitor, or the brand being deleted, deletes everything read for it.
• Flows. When a brand switches on a flow, a comment on its Facebook Page or Instagram account that carries one of the flow's words is answered once, by a private message from the account and, if the flow says so, a public reply under the comment, both sent on the platform. Only once Meta has approved this service's messaging. For each answer we keep the comment's id on the network and whether the answer went, nothing about the person, for 90 days.
• Short links. A link a brand shortens, in a post or by hand, sends whoever opens it on to the address it was made for. We count each click on the brand's day and keep nothing else: no address, browser, referrer or cookie, and link previews and bots are not counted. Deleting the short link or the brand deletes its counts.
• Feeds and the Hashtag Tracker. A brand may give us a blog's RSS or Atom address, which we read every few hours to make posts from its new articles, keeping each article's title and link. When a brand follows a hashtag on Instagram, once Meta has approved it, we read the public posts Instagram lists for it during the days chosen: each post's id, link, kind, time, likes and comments, and the first 300 characters of its caption. Instagram does not tell us who posted them and we do not ask. Removing the feed, the hashtag or the brand deletes what was read for it.
• Website analytics. When a brand adds its website and pastes our script on it, each page view is counted on the brand's day: the page's address without its query or fragment, the site that sent the visitor, and the country our host reports. The script sets no cookie and stores nothing in the browser, and a browser that asks not to be tracked (Do Not Track or Global Privacy Control) is not counted. To tell one visitor from another for a single day we keep a code made from the site, the day, the visitor's IP address and browser description under a secret; the address and the description themselves are never kept, and the codes are deleted two days later, after which nothing links a visit to another. This is separate from the CRM's lead tracking. Removing the website or the brand deletes its counts.
• The marketing API, data feeds and webhooks. Your organization can choose to send Marketing's figures elsewhere: an owner or manager's API key can read brands, posts and their numbers, and new inbox conversations with the same fields the inbox's webhook sends; a data feed is a secret address giving one brand's numbers and posts, for Looker Studio or a spreadsheet; and an address an owner or admin adds receives each post sent from here when it goes out (its brand, network, account, title, link and labels, never a person). Only a key's or a feed's hash is kept, and each can be switched off.
• White label, Canva and Google Drive. An agency can put its own name, logo and colour on what its clients see, and its own domain on their links; to check the domain we ask it once for an address only this service answers. A company may connect its Canva account, whose access we keep encrypted, to bring its designs onto posts; a file picked from Google Drive is downloaded once with a permission Google gives that browser for that one file, which we do not keep.
• Ordinary server logs kept by our hosting provider, which include IP addresses and are used to keep the service up and to investigate abuse.

There is no analytics, no advertising and no third-party tracking on this site or in the console. No Google Analytics, no advertising pixel, no session recorder. The one exception is a YouTube video in a training lesson: nothing is loaded from YouTube until the member presses play, and then YouTube's own player runs under Google's privacy policy, as clause 5 describes. The cookie page lists every cookie the product sets: three that make signing in work, two used only while you connect a social account, one that remembers the language you chose, and one that remembers which brand you were looking at in Marketing.

5Who else touches it

We use a small number of providers to run the service. Each is bound to handle the data only as we instruct.

Customer data is stored in [data region — to be confirmed]. We do not sell personal data, and we do not share it with anybody else except where the law requires it — in which case we will tell the affected customer unless we are forbidden from doing so.

6How long it is kept

• Screenshots for as long as the organization's retention setting says — between seven days and a year, and ninety days unless they changed it. After that the image, its thumbnail and its record are deleted by a job that runs daily.
• Comments, messages, reviews and mentions in the Marketing inbox, and the notes kept on the people who wrote them, for as long as the organization's inbox retention says — between 30 days and two years, and 180 days unless they changed it. After that a job that runs hourly deletes them.
• Time, applications and activity for as long as the account is open. These are the record of work done and paid for.
• Sign-in sessions expire and are deleted. So are invitation links, password reset links and device pairing codes, all of which are short-lived and single-use.
• Everything else until the organization deletes it or closes the account. See clause 8.

7If you are the person being recorded

This section is for members rather than for the organization paying for the product.

You can see everything that is held about you. Your own screenshots, your own application history, your own activity levels and your own hours, in the same detail your manager sees them. There is no setting that hides a member's own data from them, and we will not build one.

You can see that recording is happening. The agent shows a tray icon whenever it is running and tells you how many screenshots each ten-minute slice holds.

Rights over that data — to correct it, to have it erased, to object to the processing — run against your employer, because they decided to collect it, not against us. Ask them first. If you cannot reach them, write to [contact address — to be confirmed] and we will help you identify who controls it and pass your request on.

8Getting your data out, and deleting it

An owner can delete records inside the organization at any time, and can download a pay run as a CSV file from the payroll page. There is not yet a one-click export of everything — saying otherwise would be easier to write and untrue. Ask us and we will send your organization's data in a machine-readable form within 30 days, at no charge.

Ask us to close an account and we will delete it and everything under it, including every stored screenshot, within 30 days — except anything we are required to keep for tax or accounting, which is the invoice record and nothing else.

Removing a member from an organization keeps the hours they worked, because those are a record of work that was done and paid for, and stops their machines from recording anything further.

9Keeping it safe

• Everything travels over HTTPS, and screenshots are held in a private bucket that is never publicly readable. An image is served only through a link that is signed for one viewer and expires within a minute.
• Each organization's rows are separated in the database itself, so a query that forgot its filter returns nothing rather than somebody else's data.
• Passwords are stored only as a scrypt hash. The desktop agent never holds your password — it is paired with a short-lived code and carries a device token that can be revoked on its own.
• The application connects to the database as a role that cannot bypass those separations, and cannot change the schema.

If a breach affects your data we will tell the affected organizations without undue delay, and say what happened rather than that "an incident occurred".

10Changes

If this policy changes in a way that affects what is collected or who can see it, we will tell account owners by email before it takes effect. The date at the top moves only when the words change.