Privacy notice
Last updated: October 2026
This notice explains how Tallyroll, trading as TimeNeatly ("TimeNeatly", "we") handles personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our role
For your account details (name, email, company name, billing) we are the data controller. For the timesheet data you upload about your staff, your company is the controller and we act as your data processor, handling it only on your instructions to calculate and export hours.
What we collect
- Account data: email address, company name, login details.
- Timesheet data: employee names, projects, dates and hours from the files you upload.
- Billing data: subscription status. Card payments are handled by our payment provider, Paddle; we never see your card number.
- Technical data: IP address, device and browser details and basic logs needed to keep the service secure.
- Support data: messages you send us through the contact form or email.
Why we use it (lawful basis)
- To provide the service you subscribe to — performance of a contract.
- To keep the service secure and prevent misuse — legitimate interests.
- To keep financial records — legal obligation.
AI processing
Some files and assistant questions are processed by an AI model to read timesheets, flag unusual hours and answer questions. Data is sent only for that task and is not used to train models. No automated decisions with legal effects are made — a person always approves pay periods.
Who we share it with
We share data with: service providers that run TimeNeatly (secure cloud hosting, email delivery and our AI provider); Paddle.com, our Merchant of Record, for the sale of subscriptions, payments, tax compliance and invoicing; professional advisers such as lawyers and accountants; and authorities where the law requires it. We never sell data. Where data leaves the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement.
Security
Data is encrypted in transit and at rest, and each company can only ever see its own records.
How long we keep it
We keep your data while your account is active. You can delete uploads at any time. When you close your account we delete your timesheet data within 30 days, except billing records we must keep for up to 6 years by law.
Your rights
You have the right to access, correct, delete, restrict or object to processing of your data, and to receive it in a portable format. Employees whose hours appear in timesheets should contact their employer first. To exercise a right, email hello@timeneatly.com. We respond within one month.
You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Cookies
We only use essential cookies and local storage needed to keep you signed in. We do not use advertising cookies.
Contact
Tallyroll, trading as TimeNeatly — hello@timeneatly.com