Privacy Policy

This is an English translation of our Swedish privacy policy. If the two versions differ, the Swedish version applies.

You should be able to feel safe giving us your personal data. This privacy policy shows how we process personal data when you visit our website, contact us or use the DynamicTime service, and how you can use your rights.

Who is responsible for the processing of personal data?

DynamicTime AB, reg. no. 559515-6901, Forskargatan 3, 781 70 Borlänge, Sweden, is the controller for the processing described in this policy.

DynamicTime AB is part of the Hellman Dynamic group and owns and runs the DynamicTime service (app.dynamictime.se).

For questions about how we process personal data, contact us at support@dynamictime.se.

When DynamicTime is a processor

When a customer uses DynamicTime to process personal data about its employees, consultants or contacts, DynamicTime AB acts as a processor for the customer. That processing is not governed by this policy but by our data processing agreement (in Swedish), published on our website. The customer itself is the controller for that processing.

What personal data do we process?

As a controller, we usually process the following data:

• Name, title and company
• Email address, phone number and postal address
• Sign-in identifiers (Microsoft or Google account, or email address for a one-time code)
• Messages you send us, for example support requests and email
• Technical data when you use our website or service, such as IP address, browser, device information and logs for security and troubleshooting
• Billing and payment information linked to an agreement with a customer

Other personal data may also occur if it is sent to us, for example by email. Such data is assessed case by case and deleted as soon as possible if it is not needed for the purpose it came for.

What do we use the personal data for?

We process personal data in our business, for example to:

• Provide and maintain the DynamicTime service
• Verify identity at sign-in
• Manage customer agreements, billing and accounting
• Answer support requests and troubleshoot the service
• Tell you about updates, important changes to terms and operational information
• Do sales work and manage contacts with potential customers
• Send marketing where you have consented or where there is a legitimate interest
• Manage recruitment
• Meet legal obligations

Automated processing of customer data in the service is governed by separate rules in the data processing agreement. DynamicTime AB does not access an individual user's content without approval from that user in a support case.

Legal basis

We base the processing on performance of a contract, legitimate interest (for example sales contacts and support communication), legal obligation (for example accounting) or consent where given. You always have the right to object to processing based on legitimate interest.

Automated decision-making

Our processing as a controller does not include automated decisions with legal or similarly significant effects under Article 22 GDPR. The AI features in DynamicTime, which suggest time reports, are not binding and always need manual review by the user before they are used.

How is sensitive personal data handled?

DynamicTime AB does not knowingly collect sensitive personal data under GDPR (such as data on ethnic origin, religion, trade union membership, health, biometrics, sex life or sexual orientation). The DynamicTime service is not meant for such data, and the customer is responsible for not making such data available to the service.

If we still receive sensitive data by email or other channels, we delete it as soon as possible.

Who has access to the personal data?

We do not sell, rent or lease personal data, and we do not spread it without need. Data is shared only with:

• Staff at DynamicTime AB and other companies in the Hellman Dynamic group who need it for their work, on the principle of least privilege. For data from services you connect to DynamicTime, the promise that no person reads it routinely also applies (see below).
• Sub-processors and suppliers that process the data on our behalf (see below)
• Authorities when the law or a binding decision requires it
• AI apps that you have connected to your account yourself, and only the data described below

You can get a current list of sub-processors on request at support@dynamictime.se, under section 6.2 of the data processing agreement.

AI apps that you connect to DynamicTime yourself

As a user of DynamicTime, you can connect an AI app, for example Claude, Claude Code or ChatGPT, to your account. You start the connection in the AI app and approve it yourself in DynamicTime. Without your approval, the AI app gets no access.

When the connection is approved, the AI app can, when you ask it to, read:

• Your own time entries: date, project, activity, time and comment
• The projects and activities you can report time on, with the customer's name

The AI app can also, when you ask it to, log what you have worked on. A log entry has the name of the chat or session, a description of the work written by the AI app and a point in time. It has no start or end time. DynamicTime uses the log entry as a basis when your time report is built, in the same way as for example a sent email, and estimates the time from it.

The AI app cannot add, change or delete time entries in DynamicTime, and it never sees other users' data.

What the AI app logs is stored in DynamicTime as part of the basis for your time report. The name and description are never sent to our AI provider.

The data is sent to the AI app you chose. The AI app's provider processes it under its own terms and privacy policy, also when the processing takes place outside the EU/EEA. The provider is not a sub-processor of DynamicTime AB, and DynamicTime AB is not responsible for the provider's processing.

For the connection to work, we store which AI app you connected, when you approved it and the keys the AI app uses to reach your account. Keys that have expired or been revoked are deleted after fourteen days.

You can disconnect an AI app at any time under Apps in DynamicTime. The AI app then loses access at once, and what the AI app has logged is deleted. Your organization's administrator can also turn off AI apps for the whole organization.

Data from services you connect to DynamicTime

For transparency, this section describes what data DynamicTime reads when you connect an account at Google, Microsoft, Slack or another service. We do that processing as a processor for your employer, and it is governed by the data processing agreement. The promises in this section always apply.

You choose which services you connect and what DynamicTime may read. All access is read-only. DynamicTime never sends email, never changes your calendar and never deletes anything in the service.

Why does DynamicTime read the data?

DynamicTime reads the data for one purpose only: to see what you have worked on and suggest a time report for you. You always review the suggestions before the time report is sent. The data is not used for anything else.

Google

• Gmail: subject, sender, recipients, date, labels and attachment names of emails you have sent and received. The email body is read to match your keywords.
• Google Calendar: title, time, location, attendees and your response for events in your primary calendar. The description is read to match your keywords.
• Google Drive: file name, folder and when you created, edited or opened a file, and the names of shared drives. The contents of files are never read.
• Google Tasks: title, list and dates of your tasks. The notes are read to match your keywords.
• Google Chat: when you wrote, the name of the space, members and sender. Sender names are looked up with Google's contacts service. The message text is read to match your keywords.

DynamicTime's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft

• Outlook (email): subject, sender, recipients, date, categories and attachment names. The email body is read to match your keywords.
• Outlook (calendar): title, time, location, attendees and your response. The description is read to match your keywords.
• OneDrive and files in Teams: file name, folder and when you created, edited or opened a file. The contents of files are never read.
• Teams chat: when you wrote, the name of the chat, team or channel, and sender. The message text is read to match your keywords.
• Teams calls: time, length, call type and participants. The stored title is "Call with" followed by the participants' names or phone numbers. Needs approval by an administrator in your organization.
• Microsoft To Do and Planner: title, list and dates of your tasks. The description is read to match your keywords.
• OneNote: page title, notebook, section and when you changed the page. The page content is never read.

Slack

• Slack: your own messages and threads you take part in, in the public and private channels you are a member of, with the channel name and sender. Direct messages are never read. The message text is read to match your keywords.

Other services

From GitHub, Azure DevOps and Linear, DynamicTime reads the title, project, type, status and tags of issues, and the title, branch and repository of commits. The description of an issue is also fetched, but it is not used and not stored. From Azure DevOps, it also reads the title and path of wiki pages you have changed. From Canva, it reads the names and times of your designs and the time of comments. The browser extension sends the address, page title and time for the websites you have chosen yourself.

What is stored, and what is deleted at once?

DynamicTime stores only metadata about each event: title (for example a subject line, meeting title or file name), point in time, length, type and the details needed to pick the right project, for example number of participants, email domains, folder or channel name. Titles can contain names, for example in a meeting title or a Teams call. A word from a title, or the name of a chat sender, can be stored as a keyword suggestion, which you approve or remove yourself.

Content, meaning email bodies, descriptions of meetings and tasks, and chat messages, is read temporarily in DynamicTime when your time report is built. It is used only to look for your keywords, is not stored and is deleted right after the analysis.

Only you see your own events. Your manager or approver sees the time report, not the events behind it.

AI

To suggest the right project, DynamicTime uses external AI services. They get only metadata: titles, event type, times and the details described above, and what you write to the AI feature yourself. Content, such as email bodies and chat messages, is never sent to an AI service. Names of participants and senders are not sent either, nor are titles of calls and private chats. A title is sent as it is, so a name that someone wrote in a meeting title or subject line goes with it. The AI services may not use the data to train their models. Which AI services we use is shown in the list of sub-processors, which you can get on request at support@dynamictime.se. Your organization can turn off AI suggestions completely.

Our promises

• Data from services you connect is used only to create time report suggestions for you.
• It is never used for advertising, never sold and never used for credit assessment.
• It is never used to train general AI models, neither by us nor by the AI services.
• No person at DynamicTime reads the data routinely. The exceptions are when you ask for help and approve it (for example in a support case or a screen share), when it is needed for security (for example to investigate abuse), when the law requires it, and when the data is aggregated and anonymized to run the service.

Disconnecting a service

You can disconnect a service at any time under Apps in DynamicTime. All events from the service and the keys DynamicTime used to reach it are then deleted at once. Keyword suggestions and the list of events you chose to ignore stay until you remove them, or until your account or your organization is deleted.

Disconnecting a service in DynamicTime does not revoke the access in the service itself. You do that here:

• Google: myaccount.google.com/connections
• Microsoft: myapps.microsoft.com (work or school account) or account.live.com/consent/Manage (personal account)
• Slack: under Apps in your Slack workspace

When the agreement with your organization ends, all data is deleted within thirty days, under the data processing agreement. Backups are deleted automatically within one year.

Where is personal data stored and processed?

Personal data is usually stored within the EU/EEA. The DynamicTime service runs in Microsoft Azure within the EU.

Calls to external AI services can mean a transfer outside the EU/EEA. Only metadata, such as titles and points in time, is sent to the AI services, never content such as email bodies or chat messages. For such transfers, the European Commission's standard contractual clauses or another valid transfer mechanism under Chapter V GDPR is used.

How long is personal data stored?

We keep personal data for as short a time as possible, normally as long as an agreement is in force or as long as a process to enter an agreement is going on. When the agreement ends, we delete or anonymize the data.

For customer data in the DynamicTime service, special retention periods apply under the data processing agreement (deletion within thirty days after the agreement ends). Deleted data can remain in encrypted backups for up to one year. The backups are used only to restore the service and are then deleted automatically. See also Data from services you connect to DynamicTime.

Personal data required by law, for example accounting records, is kept for the time the law requires.

How is your personal data protected?

We work under a management system certified to ISO 9001 (quality), ISO 14001 (environment) and ISO 27001 (information security), and use for example:

• Role-based access control (RBAC) on the principle of least privilege
• Multi-factor authentication (MFA) for administrative access
• Encryption of data in transit (TLS 1.2 or later) and at rest (AES-256)
• Logical separation between customer environments (multi-tenant)
• Logging of administrative access and critical operations
• Backups with geo-redundant storage within the EU/EEA
• A secure development process (Secure SDLC) with code review and separate environments
• Confidentiality undertakings and regular training of staff

The DynamicTime service uses strict data minimization. Only metadata about work events is stored permanently (titles, points in time, file names). Content in email, meeting and task descriptions and chat messages can be processed temporarily during the analysis to create time report suggestions, but is not stored and is deleted right after the analysis. The contents of files are never read. A user's own source data is visible only to that user.

Cookies and similar technologies

Our website and service use cookies. Information about which cookies we use and how you can control them is in our separate cookie policy on the website.

Personal data breaches

If a personal data breach affects data we process for a customer, we notify the customer without undue delay, and no later than forty-eight (48) hours after we became aware of the breach, under the data processing agreement.

Your rights

As a data subject, you have the right to:

• Get a copy of the personal data we process about you
• Have incorrect data corrected
• Have your data deleted, as far as this does not conflict with law or an agreement in force
• Restrict the processing or object to it
• Get your data in a structured, commonly used and machine-readable format (data portability)
• Withdraw consent you have given

Send your request to support@dynamictime.se. We normally answer such a request within one month.

If you are a DynamicTime user at a customer and your request is about data we process for the customer, please first contact your employer or the other customer that is the controller, since they control that processing.

Right to complain to a supervisory authority

If you think our processing of your personal data breaks data protection law, you have the right to file a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (imy.se).

Changes to this policy

We may update this privacy policy. The current version is always on our website. Earlier versions, with a summary of what changed, are under Earlier versions and changes (in Swedish). For important changes, we tell you by email or with a message in the service.

DynamicTime AB · Reg. no. 559515-6901 · Forskargatan 3, 781 70 Borlänge, Sweden · support@dynamictime.se