TimeTracerTimeTracer

Data Processing Addendum

Last updated: July 8, 2026 · Version 2026-07-08

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Foundry01 LLC ("Foundry01," "Processor") and the organization customer that accepts the Terms ("Customer," "Controller"). It applies where Customer uses TimeTracer in organization mode and acts as a controller of personal data. By accepting the Terms of Service on behalf of an organization, Customer agrees to this DPA; no separate signature is required. A counter-signed copy is available on request at admin@foundry01.com. Where Customer and Foundry01 execute a signed MSA or data processing agreement, that agreement controls to the extent of any conflict.

1. Definitions

  • Applicable Data Protection Law — all privacy and data-protection laws applicable to the processing, including, where relevant, the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable U.S. state privacy laws.
  • Controller, Processor, Personal Data, Processing, Data Subject, Personal Data Breach — have the meanings given in the GDPR.
  • Customer Personal Data — personal data that Foundry01 processes on Customer's behalf under the Terms, described in Annex I.
  • Sub-processor — a third party engaged by Foundry01 to process Customer Personal Data.
  • Standard Contractual Clauses (SCCs) — the clauses approved by the European Commission (2021/914) and, for the UK, the UK International Data Transfer Addendum.

2. Roles and Scope

Customer is the Controller and Foundry01 is the Processor of Customer Personal Data. Foundry01 processes Customer Personal Data only to provide TimeTracer and only on Customer's documented instructions, which consist of the Terms of Service, this DPA, and Customer's use of the service's features. Foundry01 will not process Customer Personal Data for any other purpose, and does not sell it, use it for advertising or profiling, or use it to train AI models. If Foundry01 believes an instruction violates Applicable Data Protection Law, it will inform Customer.

3. Processor Obligations

Foundry01 will:

  • process Customer Personal Data only on documented instructions (Section 2);
  • ensure personnel authorized to process Customer Personal Data are bound by confidentiality and access it on a least-privilege basis;
  • implement the technical and organizational security measures in Annex II;
  • assist Customer, taking into account the nature of processing, with Customer's obligations regarding data-subject rights (Section 6), security, breach notification, and data protection impact assessments;
  • make available to Customer the information reasonably necessary to demonstrate compliance with this DPA.

4. Security

Foundry01 implements and maintains the technical and organizational measures described in Annex II to protect Customer Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage, appropriate to the risk.

5. Sub-processors

Customer provides general authorization for Foundry01 to engage the sub-processors listed at /subprocessors, which is the authoritative, maintained list. Foundry01:

  • imposes data-protection obligations on each sub-processor, through a written agreement, no less protective than those in this DPA (flow-down);
  • remains responsible to Customer for each sub-processor's performance;
  • gives Customer at least 30 days' advance notice before adding or replacing a sub-processor, during which Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service.

Calendar integrations that a user connects (such as Outlook) are sources TimeTracer reads from under the user's authorization, not sub-processors.

6. Data-Subject Requests

Taking into account the nature of the processing, Foundry01 will assist Customer by appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests to exercise their rights. If Foundry01 receives such a request directly, it will, unless legally prohibited, promptly forward it to Customer and not respond except on Customer's instructions. Foundry01 provides self-service export and deletion tools within TimeTracer that Customer may use to fulfill many requests directly.

7. Personal Data Breach

Foundry01 will notify Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and within 72 hours of confirming a reportable breach. The notice will describe the nature of the breach, the categories and approximate volume of data and data subjects affected (to the extent known), the likely consequences, and the measures taken or proposed, and will identify a contact for follow-up. Foundry01 will reasonably cooperate with Customer in the investigation and remediation.

8. Return and Deletion

During the term, Customer may export or request the return of Customer Personal Data at any time using in-product tools or by request. On termination or expiry of the Terms, Foundry01 will delete Customer Personal Data within 30 days, cascading across database records and stored files, except where retention is required by law. Security, audit, and consent logs are retained in pseudonymized form for up to 2 years as part of Foundry01's security program. Sub-processor-side deletion follows each sub-processor's agreement.

9. Audits and Compliance

Foundry01 will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR (subject to confidentiality). Given Foundry01's size and fully-managed cloud architecture, Foundry01 satisfies audit obligations by providing this information and responding to reasonable security questionnaires, rather than by on-site inspection, except where Applicable Data Protection Law requires otherwise.

10. International Transfers

Customer Personal Data is stored and processed in the United States. Foundry01 is not certified under the EU-U.S. Data Privacy Framework. Where Foundry01 processes personal data of data subjects in the EEA, the UK, or Switzerland, the Standard Contractual Clauses (with the UK Addendum as applicable) are incorporated into this DPA by reference and apply to that transfer, with Foundry01 as data importer and Customer as data exporter, together with a transfer impact assessment. Annex I and Annex II, together with the sub-processor list at /subprocessors (Section 5), supply the information required by the SCCs' annexes.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Applicable Data Protection Law does not permit such limitation.

12. Term

This DPA takes effect when Customer accepts the Terms of Service and continues for as long as Foundry01 processes Customer Personal Data, after which the return-and-deletion obligations in Section 8 apply.

13. Governing Law

This DPA is governed by the law stated in the Terms of Service, except that the Standard Contractual Clauses are governed as they specify.

Annex I — Details of Processing

  • Data exporter / Controller: the organization Customer.
  • Data importer / Processor: Foundry01 LLC, 642 N Madison Ave, Bloomington, IN 47404, admin@foundry01.com.
  • Categories of data subjects: Customer's members/employees who use TimeTracer, and third parties whose data appears incidentally (e.g., the email domain of external attendees on an imported calendar event).
  • Categories of personal data: account data (email, organization membership and role); time entries, notes, project/client and brand names, and rates; voice narration audio (transient, not stored) and the resulting transcript; imported calendar event details — titles, descriptions, times, and locations, with attendee data minimized to the email domain only; billing identifiers; and security/operational data (IP address, user-agent, authentication events, consent records, audit logs).
  • Special categories of data: none processed by design. Customer must not enter special-category data.
  • Nature and purpose of processing: to provide time tracking and its AI features (transcription, parsing, report generation), to enable organization time and project management, and to secure, bill, and support the service.
  • Duration: for the term of the Terms of Service, subject to the retention windows in Section 8 and the Privacy Policy.

Annex II — Technical and Organizational Measures

  • Encryption in transit: TLS 1.2 or higher.
  • Encryption at rest: AES-256, platform-managed (database, storage, backups, audit archive).
  • Token encryption: sensitive OAuth tokens are encrypted with AES-256-GCM before storage.
  • Access control and isolation: database Row-Level Security isolates data between users and organizations; least-privilege administrative access; multi-factor authentication required for privileged (superadmin) access.
  • Auditability: append-only, tamper-evident audit logs (updates, deletes, and truncation blocked at the database level); administrative access is logged.
  • Immutable retention: security, audit, and consent logs are copied daily to a write-once (Object Lock) archive retained 2 years with integrity hashing.
  • Resilience: managed database with 7-day point-in-time recovery; stored files independently backed up.
  • Monitoring: error monitoring with personal data scrubbed at source; rate limiting that fails closed; security alerting for anomalous activity.
  • Incident response: a documented incident-response plan with breach notification per Section 7.
  • Key management: platform-native secret managers and least-privilege access; no dedicated HSM at Foundry01's current scale.

For questions about this DPA, contact admin@foundry01.com.