Draft, for management to approve
Privacy
How ShortBooker handles information about people. Short and plain on purpose.
Who is responsible
Shortcut Oslo AS [confirm legal name and contact] is responsible for the personal data in ShortBooker.
What we store
- Your account: name and email from Google. We never see your Google password.
- Bookings and schedules: who is booked where, on which project, and when.
- Reported hours: what you worked on and for how long.
- Vacation, sick leave and leave. This is private: colleagues only see “Away”, with no reason.
- Tasks you have, or have given to others.
- Client contacts: names, work email and phone of people at our clients.
Why
Planning, time reporting, invoicing and personnel administration. The legal bases:
- Contract and employment: planning your work and recording your hours and leave.
- Legal obligation: bookkeeping, and following up sick leave.
- Legitimate interest: planning rooms and people so projects run smoothly.
Who can see what
| User | Super user | Admin | |
|---|---|---|---|
| Bookings, projects, calendar | Yes (no prices) | Yes | Yes |
| Your own hours | Yes | Yes | Yes |
| Other people's hours | No | Yes | Yes |
| Vacation (approved or requested) | Colleagues see it | Colleagues see it | Yes |
| Sick leave, sick child, leave | Only you (others see "Away") | Only you (others see "Away") | Yes |
| Personnel overview | Own only | Own only | Yes |
| Prices, quotes, invoices | No | Yes | Yes |
| History (audit log) | No | No | Yes |
Your hours are visible to you, to whoever reported them, and to super users and admins. These rules are enforced in the database, not only on screen.
Clients can be sent a link to a project's post plan, which opens without a login. It shows the phases and weeks, never prices. It only shows the names of the people working on each phase if we turn that on for that link, and links can expire, have a password and be switched off.
Where it's stored
- Database: Supabase, in the EU (Stockholm, Sweden).
- Hosting: Railway [confirm region].
- Login: Google.
How long
[proposed, confirm]
- History (audit log): 24 months.
- Finance records: 5 years (bokføringsloven).
- Sick leave details: 36 months.
- Inactive contacts: 36 months.
Your rights
- Access: see everything we hold about you with the button below.
- Correction: fix it yourself where you can, or ask an admin.
- Erasure: ask an admin. Some records must be kept by law, such as bookkeeping.
- Objection: tell an admin if you object to how your data is used.
- Complaint: you can complain to Datatilsynet, the Norwegian data protection authority.
You get a JSON file with your own data. You need to be signed in. Prices are not included.
Cookies
Only the cookies that keep you logged in. No tracking, no advertising, no analytics.
Contact
Ask an admin, or write to [privacy contact email].