Privacy policy

Who is responsible

Klokka is run by Prasannjeet Singh (sole trader, enskild firma), organisation number 891010-6973, Väderkvarnsbacken 163, 352 56 Växjö, Sweden. Klokka has two roles. For your account, meaning your name, email address and settings, the controller is Prasannjeet Singh (sole trader).

For the hours an employer logs about their employees, the employer is the controller and Klokka is the processor. We process that data only to provide the service to the employer, under the data processing clause in the terms.

Send questions about your data to hej@klokka.se. Who we are is on the about page.

What we store

This is everything Klokka keeps:

• Account: name, email address, language, light or dark mode and notification settings. Sign-in is handled by Klokka's own sign-in service (Logto), which stores your password hashed. Klokka's database holds no passwords.
• Business: name, currency, time zone and settings.
• Hours: hours per day per employee, notes, flags with their messages, locked months and the history of every change (who, what and when).
• Hourly rate, if the employer has turned pay on and set a rate for the employee.
• Notifications: a push notification token for each phone where you are signed in to the Android app.
• Email: addresses for invitations and for weekly digests you chose to receive.

Why the data is processed

Account data is processed to provide the service you signed up for (contract). Security and operations, such as logs and backups, rest on legitimate interest.

Employees' hours are processed on the employer's behalf. The legal basis for them is the employer's, for example the employment contract or the duty under the Working Hours Act to record on-call time, overtime and additional hours.

Where the data is stored

Everything is stored on servers at NetCup in Germany, inside the EU, and backups on our own server in Sweden. Sign-in runs on the same servers, in our own installation of Logto, not with an outside sign-in provider.

Two services sit outside the EU and EEA. Email is sent through Migadu, a company in Switzerland, which the European Commission recognises as giving adequate protection to personal data. Push notifications are delivered through Expo and Google Firebase Cloud Messaging in the US, relying on the EU-US Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses. A push notification contains only the notification text and the phone's token.

Who else processes data

Klokka uses a few sub-processors, only for what is listed here. If the list changes, we say so on this page before the change applies.

• NetCup (Germany): servers and database.
• Migadu (Switzerland): sending email, such as invitations and weekly digests.
• Expo (US) and Google Firebase Cloud Messaging (US): delivering push notifications to the Android app. They receive only the notification text and the phone's token.

Cookies and browser storage

The klokka.se website has no analytics, no tracking and no tracking cookies. It only stores your choice of light or dark mode in your browser.

The web app uses one cookie for sign-in and a few for your choices: language, light or dark mode and the business you last opened. They are needed for the app to work.

How long data is kept

Data is kept for as long as the account or the business exists. Nothing is deleted automatically.

The database is backed up every day to our own server in Sweden, over an encrypted connection. Backups are kept for a limited period and then replaced by newer ones, so deleted data also disappears from them after a while.

The app cannot delete an account or a business yet. Email hej@klokka.se and we will delete it for you. We answer without undue delay and at the latest within one month.

Your rights

You have the right to know what data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to get it in a readable format. An employer can export the hours of any month as a CSV file.

Are you an employee asking about hours your employer logged? Ask your employer first, as they are responsible for that data. The employer can then ask us for help.

If you think we handle your data wrongly, you can complain to the Swedish data protection authority, IMY.

Changes

If this policy changes, we update this page and the date below. Larger changes are announced on the website before they apply.

Last changed 30 September 2026.