Data Safety

1. Two different responsibilities

When your organization signs up, it decides which of its people to enrol, what to record about them and how long to keep it. That makes your organization the data controller. UseTimio stores and processes that data on your instruction, which makes us the data processor.

In practice: if you are a staff member or a church member and you want your record corrected or removed, ask your organization’s administrator first — they hold the controls. If they need our help to do it, we help them. The terms of that relationship are written out in our Data Processing Agreement.

2. Everything we collect

Rows marked “Yes” in the last column leave our systems to reach a service provider that performs that function for us. Every provider is named on the sub-processors page.

3. What we never do

• We do not sell personal data, and we never have.
• We do not rent or share member lists with advertisers, data brokers or marketing networks.
• We do not use your attendance records, member lists or message content to train AI models.
• We do not track anyone’s location between check-ins, or in the background.
• We do not mine your members’ personal data for our own analytics — product analytics are aggregate.
• We do not place advertising inside the product.

4. The two sensitive ones, in detail

Location

GPS check-in stays off unless an organization on a Premium or higher plan turns it on and defines approved sites. When it is on, the browser asks the person for permission, and a single coordinate pair is recorded at the moment they press check in or check out. There is no background tracking, no location history between events, and no movement trail. Declining the browser prompt means that check-in method is unavailable to that person — it does not hand us the location anyway.

Biometrics

Biometric check-in is built on WebAuthn, the standard behind passkeys. When someone registers, their phone or laptop generates a key pair inside its secure hardware. The device keeps the private key and the fingerprint or face data; we receive only the public key and a credential ID. We could not reconstruct anyone’s fingerprint from what we store, and a stolen copy of our database would not contain one. Removing the credential in the product, or deleting it on the device, ends the link.

5. Who can see the data inside your organization

UseTimio uses role-based access control, so seeing a record depends on the role an admin gave that account:

• Owner — full access to the organization, including billing and deletion.
• Organization admin — full operational access to members, attendance and reports.
• Managers and supervisors — access limited to the departments, locations or roles assigned to them.
• Members and staff — their own record and their own attendance history.

Affiliate dashboards are deliberately blinded: a referrer sees a masked name and a masked email for the people they referred — enough to verify a commission, and nothing more.

6. Who can see the data at UseTimio

Access to production data is restricted to the small number of staff who operate the platform, and is used only to keep the service running, investigate a fault, or answer a support request you raised. Support staff work from the ticket you opened; they do not browse customer records for any other reason. Where a fault can be diagnosed from logs or aggregate figures, that is what we use.

7. Where the data lives

• Application and database: hosted with managed cloud providers — Vercel for the application, MongoDB Atlas for the database — reached only over encrypted connections.
• Files: logos, images and payment proofs are stored in Cloudflare R2 object storage.
• Backups: the database is backed up daily, compressed, and written to object storage over an encrypted connection, with a rolling two-week window of restore points.
• Queues and jobs: scheduled work such as reminders and bulk sends passes through a managed Redis service, holding only what the job needs and only until it completes.

Because these are global cloud providers, data may be processed outside Nigeria. Those transfers rely on the providers’ standard contractual terms; see Compliance for how we treat cross-border transfers under the NDPA and the GDPR.

8. Where AI is involved

Two features call a third-party AI model: the assistant that drafts a bulk email or SMS for you, and the support chat on our website. Only the text you type into those features is sent, and only for that single request. Your attendance records, member lists and contact data are not sent to any AI model, and nothing sent is used to train one. If you would rather not use AI at all, write the message yourself — the feature is entirely optional.

9. How long we keep it

Attendance history is kept according to the organization’s plan. Account records, billing records and configuration are kept for as long as the account exists.

• Billing and payment records are kept for at least six years, as Nigerian tax and company law requires.
• Backups roll off after roughly fourteen days, so deleted data can persist in a backup until then.
• When an organization drops to the Free plan, members over the seat limit are deactivated, not deleted — their history returns intact when seats are added back.

10. What you can do about it

• Export: admins can export attendance, payroll and service records to CSV at any time on a paid plan.
• Correct: member records and attendance entries can be edited by an admin in the product.
• Delete a person: removing a member removes their record and their attendance history from the organization.
• Delete the organization: email info@usetimio.com from the owner’s address. We confirm the request, delete the workspace and its data within 30 days, and confirm in writing once it is done.
• Turn features off: GPS and biometric check-in can be disabled by an admin, which stops collection immediately.
• Marketing email: every non-transactional email carries an unsubscribe link. Security, billing and verification email cannot be switched off while an account is open.

11. If something goes wrong

If a security incident affects your data, we investigate, contain it, and notify affected organization owners without undue delay and within 72 hours of becoming aware — with what we know so far, what we are doing about it, and anything you need to do at your end. The full incident process is set out under Security Practices.

12. Children

UseTimio is sold to organizations for managing adult staff and members. Where an organization — a school, for example — records attendance for people under 18, that organization is responsible for obtaining whatever consent its law requires from a parent or guardian, and for restricting who in its workspace can see those records. We do not knowingly collect data directly from children.

13. Changes to this page

When what we collect or who we share it with changes, this page changes with it and the date at the top moves. For material changes we email organization owners before the change takes effect.