Privacy Policy
Last updated: 15 August 2026
This Privacy Policy explains what personal data TEDGE Time Tracker collects, why we collect it, who we share it with, and what rights you have.
1. Who we are
Mostafa Mohamed Safwat Ibrahim Shalaby, a sole proprietorship trading as tedge
Commercial Register No. 29807 (Ismailia Chamber of Commerce)
Tax Registration No. 775786969
20 Block C, Ring Road, Sheikh Zayed, Ismailia Third, Ismailia, Arab Republic of Egypt
Email: info@tedgeltd.com
2. Two different roles
It matters which role we are in when your data is processed.
We are the controller for data about the customer organisation itself and the person who signs up — for example the account holder's email address, billing details and support correspondence. We decide why and how that data is used.
We are the processor for the working data inside a customer's workspace — the members, their time entries, timesheets and project assignments. The customer organisation is the controller of that data. It decides who is invited, what is recorded and how long it is kept. We only process it on the customer's instructions.
If you are an employee, contractor or member of an organisation using TEDGE Time Tracker and you have questions about your own time records, please contact your employer first. They control that data. We will assist them in responding to you.
3. What we collect
Account data. Your email address, password (stored only as a cryptographic hash, never in readable form), and full name if you provide one.
Workspace data. The company name, timezone and week start day; the projects, clients and tasks you create; the members you invite and the role and engagement type assigned to them.
Time and timesheet data. Time entries including start time, end time, duration, description, and the project and task they relate to; whether each entry came from the timer or was entered manually; weekly timesheets, their status, submission and review timestamps, and any review notes written by a manager.
Invitation data. The email address, role and engagement type of people you invite, along with the invitation token and its status.
Technical data. Standard server logs generated when you use the Service, including IP address, browser type and timestamps. These are produced by our hosting and database providers as part of normal operation.
What we do not collect. We do not use tracking cookies or third party advertising or analytics trackers. We do not monitor keystrokes, take screenshots, capture screen activity, track location, or access your device camera or microphone. The Service records only the time entries that you or your members deliberately create.
4. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, authenticating logins | Performance of a contract |
| Providing time tracking, timesheets, approvals and reporting | Performance of a contract |
| Sending invitation, password reset and account emails | Performance of a contract |
| Billing and keeping tax and accounting records | Legal obligation; performance of a contract |
| Responding to support requests | Legitimate interests — running and supporting the Service |
| Keeping the Service secure and investigating abuse | Legitimate interests — protecting the Service and its users |
The legal bases above are those under the UK and EU GDPR, which apply where our customers or their members are in the UK or the European Economic Area. We apply the same standards to all customers regardless of location.
We do not sell personal data. We do not use personal data to train machine learning models. We do not use your data for advertising.
5. Who we share it with
We use a small number of service providers ("sub-processors") to run the Service. Each is bound by contract to protect the data and to process it only on our instructions.
| Provider | What they do | Where data is held |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union (Ireland) |
| Vercel | Application hosting and content delivery | Global edge network |
| Resend | Sending transactional email (invitations, password resets) | European Union (Ireland) |
We will update this list before adding a new sub-processor that handles personal data.
We may also disclose personal data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims. If we receive a legally binding request for a customer's data, we will notify that customer unless we are legally prohibited from doing so.
6. International transfers
We are based in Egypt, and our sub-processors operate internationally. This means personal data may be transferred outside the country where you are located, including outside the UK and the European Economic Area.
Where data is transferred out of the UK or EEA, we rely on appropriate safeguards, including Standard Contractual Clauses in our agreements with sub-processors. You can request further information about these safeguards at info@tedgeltd.com.
7. How long we keep it
We keep Customer Data for as long as the customer's account is active.
After an account is terminated, we make the data available for export for 30 days, then delete it within a further 60 days from our live systems. Backups are overwritten on a rolling basis and any residual copies are removed within 90 days of deletion.
We keep billing and tax records for as long as Egyptian tax law requires, currently five years, even after an account closes.
A customer may ask us to delete their workspace and its data earlier by contacting info@tedgeltd.com.
8. Security
We protect data with:
encryption in transit using TLS, and encryption at rest at the database layer
passwords stored only as salted cryptographic hashes
row level security in the database, so each query is restricted to the workspaces the signed-in user actually belongs to
role based permissions enforced both in the interface and on the server
access to production systems limited to those who need it
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the affected customer without undue delay and in any event within 72 hours of becoming aware of it, and will notify regulators where required.
9. Your rights
Where the UK or EU GDPR applies, you have the right to:
access the personal data we hold about you
rectify data that is inaccurate or incomplete
erase your data in certain circumstances
restrict or object to processing in certain circumstances
data portability — receive your data in a structured, machine-readable format
withdraw consent where we rely on consent, without affecting processing already carried out
complain to a data protection authority
To exercise any of these, email info@tedgeltd.com. We will respond within one month. We may ask you to verify your identity first.
If your data is inside a customer's workspace, we are the processor. In that case we will forward your request to the customer organisation, which is the controller, and support them in responding.
If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk). If you are in the EEA you may complain to your national supervisory authority.
10. Cookies
We use only strictly necessary cookies. These keep you signed in and remember which company workspace you are currently viewing. They are required for the Service to function and cannot be switched off.
We do not use analytics, advertising or tracking cookies, so we do not display a cookie consent banner.
11. Children
The Service is for use by businesses and their workers. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy. If a change materially affects how we handle personal data, we will notify account holders by email or through the Service at least 30 days before it takes effect. The date at the top shows when this policy was last revised.
13. Contact
Questions, requests or complaints about privacy: info@tedgeltd.com