Privacy Policy

1. Who We Are

TimmyHR is a product of Intelura Ltd, a company registered in England and Wales whose address is 24 Rochester Street, Chatham, ME4 6RP, England, United Kingdom (“we”, “us”, “our”). When we provide TimmyHR to organisations (our “Customers”), we act as a data processor with respect to the personal data of their employees (“End Users”). For data collected directly from Customers (admins, billing contacts), we act as a data controller.

2. Data We Collect

2.1 Customer account data (controller)

• Name, work email address, and job title of account administrators
• Company name, size, and industry
• Billing information, processed by Stripe (we do not store card details)
• Usage data: login timestamps and the actions recorded in the audit trail
• Communications with our support team

2.2 Employee data processed on behalf of Customers (processor)

When Customers use TimmyHR, they upload and manage employee data including:

• Full name, job title, department, and employment dates
• Contact information (work email, phone number)
• Payroll data: salary, deductions, pay history, bank details
• Attendance records: check-in/out timestamps, leave records, absence records
• Check-in location: when a Customer sets up office locations, an employee checking in as working from the office is asked by their browser to share the device's location once, at that moment. If they allow it, the location and its distance from the nearest office are stored with that check-in so the Customer's HR team can see check-ins away from the office. It is never tracked continuously, never asked for remote check-ins, and declining does not stop anyone checking in.
• Performance data: goals, 1:1 notes, survey responses, review records
• Profile photos and other information employees choose to add
• Documents uploaded to the platform

We process this data solely to provide TimmyHR services as directed by the Customer. Customers are responsible for their own legal basis for processing their employees' data.

2.3 Technical data (all users)

• IP address, browser type, and device information
• Cookies and similar technologies (see Section 8)
• Error reports sent to our error-monitoring provider, from which we redact sensitive fields (such as pay, bank details and message content) before they leave our servers

2.4 Timmy Chat and Timmy AI content (processor)

When a Customer uses Timmy Chat, we process what its people post there:

• Messages, replies, reactions, files, link previews, canvases, lists, announcements and reports of messages
• Voice and video clips and, where transcription is on, the transcript of a clip that has been sent
• Live audio in huddles. TimmyHR does not record huddles
• If the Customer uses Timmy AI: summaries, translations, notes, reply suggestions, helpdesk answers and sentiment figures generated from that content

2.5 Website enquiries, job applications and the newsletter (controller)

• Contact and demo forms. If you use the contact or demo form, we receive the details you enter (your name, work email address, company, team size, country, phone number and message, depending on the form). We use them to reply to you and to arrange a demo.
• Job applications. If you apply for a role through our website, we receive the details you enter (your name, email address, an optional link to your CV or profile, and your note). We use them only to consider your application and to reply to you.
• Newsletter. If you give us your email address in the website footer, we use it only to send you TimmyHR news. Each news email carries an unsubscribe link, and you can also ask us to remove your address at any time by emailing admin@intelura.com.

These details reach us through Resend, our email provider (see section 5), either as an email to our team or, for the newsletter, as an entry on a mailing list held by Resend. The website itself stores none of them.

3. How We Use Your Data

3.1 To provide and improve TimmyHR

• Create and manage your account
• Process payroll, attendance, and HR workflows
• Send transactional emails (password resets, replies to contact enquiries, and Timmy Chat invitations and email digests)
• Provide customer support
• Monitor platform performance and fix issues
• Develop new features (using aggregated, anonymised usage data only)

3.2 For billing and legal compliance

• Process subscription payments
• Issue invoices and financial records
• Comply with applicable tax and accounting law
• Respond to legal requests from courts or regulators

3.3 For communications

• Product update announcements (opt-out available at any time)
• Security alerts and important service notices (these cannot be opted out of)
• Responses to your support requests

We never use HR or employee data for advertising, profiling, or sale to third parties.

4. Legal Basis for Processing (GDPR)

For EU/UK users, our legal bases for processing personal data are:

• Contract performance: Processing necessary to provide TimmyHR services under our Terms of Service
• Legitimate interests: Security monitoring, fraud prevention, product improvement using anonymised data
• Legal obligation: Compliance with tax, accounting, and employment law requirements
• Consent: Marketing communications (you can withdraw consent at any time)

For employee data processed as a data processor on behalf of Customers, the Customer is responsible for establishing and documenting their own legal basis under applicable employment and data protection law.

5. Data Sharing and Sub-Processors

We use the third parties below to operate TimmyHR. Each processes personal data on our instructions, for the purpose given. Changes to this list are changes to this policy and are handled as described in Section 12.

• Neon - database hosting. Stores account and employee data, including Timmy Chat content and files
• Vercel - application hosting and delivery
• Stripe - subscription billing and payment. Card details go to Stripe and never reach our servers
• Resend - email delivery for password resets, website enquiries, job applications and Timmy Chat invitations and digests, and the newsletter mailing list
• Google - optional sign-in with Google (OAuth)
• UploadThing - storage of images that users upload, such as news-feed pictures
• Sentry - error monitoring, with sensitive fields redacted before reports leave our servers
• Ably - real-time signals for Timmy Chat: that a message was posted, edited or deleted (identifiers only, not the message text), and typing indicators
• LiveKit - live audio for Timmy Chat huddles
• Anthropic - Timmy AI text generation: summaries, translations, notes, reply suggestions, helpdesk answers and sentiment. Used only for a Customer that has the feature on
• Voyage AI - embeddings that power search by meaning, for a Customer that has it on
• Deepgram - transcription of Timmy Chat clips that have been sent, for a Customer that has transcription on

5.1 How Timmy Chat and Timmy AI use these providers

• Content is sent to a provider only to carry out a request: a summary or translation a user asks for, indexing a message for search by meaning, or transcribing a clip after its message has been sent. An unsent clip is not transcribed.
• Timmy AI works from content the person asking could already read. Content from a conversation they cannot see is not sent.
• Timmy AI is off until a Customer administrator turns it on, and the same setting turns every feature off again.
• We do not use Customer content to train AI models. Where a provider offers a setting that stops it using content to improve its own models, we turn that setting on.
• Summaries are cached briefly so a repeated request does not call the provider again, and cached summaries are removed nightly.
• The HR helpdesk answers an employee's questions about their own leave balance, recent payslips, attendance and company policy. The figures needed for that question are sent to Anthropic, and it can look up only the person asking.
• Engagement and sentiment analysis is off unless an administrator turns it on. It reads messages in channels with enough participants to keep it anonymous, never direct messages, and produces aggregate figures only, nothing per person. The result is not stored.

We do not sell, rent, or share personal data with advertisers, data brokers, or marketing platforms.

We may disclose data if required by law, court order, or to protect the rights, property, or safety of Intelura, our customers, or the public. We will notify affected parties where legally permitted to do so.

6. Data Retention

• Active accounts: Data is retained for the duration of the subscription
• After cancellation: Customer data is retained for 30 days, then permanently deleted unless you request earlier deletion or extended retention for legal compliance purposes
• Payroll records: We recommend Customers retain payroll records for at least 6 years per UK HMRC requirements. Before cancelling, Customers can export employee, attendance and rewards data to CSV from the app, and may ask us for other data
• Backups: Our database provider keeps backups for a limited period. Data deleted from live systems can remain in those backups until they expire
• Timmy Chat: Messages and files are kept until the Customer deletes them or, on the Enterprise plan, a retention policy the Customer has set removes them. On the Core plan, history older than 90 days is hidden from view, not deleted. A legal hold pauses deletion. When a retention policy runs, or an administrator erases a person's chat content, the message text is replaced with a placeholder and what hangs off it is removed: edit history, attachments, clips and transcripts, search embeddings and AI summaries. Moderation reports keep a snapshot of what was reported until HR removes the report. Canvases and lists are shared working documents and are not removed by a person's erasure
• Anonymised analytics: Aggregated, anonymised usage data may be retained indefinitely

7. Your Rights (GDPR & UK GDPR)

If you are in the EU or UK, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (subject to legal retention obligations)
• Right to restriction: Request that we restrict processing of your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, email admin@intelura.com. We will respond within 30 days. If you are an employee whose data is held by a Customer organisation, please contact your employer (the Customer) directly - they are the data controller for your employment data.

You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

8. Cookies

TimmyHR uses cookies and similar technologies for the following purposes:

• Strictly necessary: Session management and authentication - these cannot be disabled
• Functional: Remembering your preferences (e.g., language, display settings)

We do not use advertising, tracking or analytics cookies. You can manage non-essential cookies through your browser settings. Note that disabling functional cookies may affect your experience using TimmyHR.

9. Data Security

We implement industry-standard security measures to protect personal data:

• Data encrypted in transit using TLS
• Stored data encrypted at rest by our hosting and database providers
• Access controls: role-based permissions, least-privilege principle
• Periodic internal security reviews of the application
• Authentication with Google or a password, optional two-factor authentication, and sessions that expire after 30 days
• An audit trail of user, payroll and Timmy Chat administration actions, on the Pro and Enterprise plans

In the event of a personal data breach that poses a risk to individuals, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR.

10. International Data Transfers

TimmyHR may process data using infrastructure and sub-processors in countries outside the EEA or UK. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission and UK International Data Transfer Agreements (IDTAs) where required.

11. Children's Data

TimmyHR is a B2B platform intended for use by individuals aged 18 and over in a professional employment context. We do not knowingly collect personal data from individuals under 18. If you become aware that a minor has provided us with personal data, please contact us at admin@intelura.com.

If we discover we have collected personal data from someone under 18, we will permanently delete it from our systems and those of our sub-processors, without delay.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email to account administrators and a prominent notice within TimmyHR. Continued use of TimmyHR after the effective date constitutes acceptance of the updated policy.

The date at the top of this page always reflects when this policy was last updated.

13. Contact Us

For privacy questions, data subject requests, or to report a concern:

• Email: admin@intelura.com
• Post: Intelura Ltd, 24 Rochester Street, Chatham, ME4 6RP, England, United Kingdom
• Response time: We aim to respond to all privacy requests within 5 business days and to all statutory requests within the legally required timeframe (typically 30 days)