Privacy policy

Last updated: 20 October 2026

This policy explains which personal data [COMPANY NAME] ("officedash", "we") processes when you use officedash, why, how long we keep it and how you can have it deleted. We follow the EU General Data Protection Regulation (GDPR). For your own account we are the controller. For the data your organisation puts into officedash about its people, your organisation is the controller and we process that data on its behalf.

Your account

What we keep: Your name, your email address and your company name. Your password is stored only as a one-way hash, never as plain text. While you are signed in, we keep a session record with its expiry date, your IP address and your browser's name.
Why: To create your account, sign you in, keep the account secure and contact you about it. The legal basis is the contract with you (GDPR article 6(1)(b)).
How long: As long as your account exists. A session ends when you sign out or after 7 days without use. Email verification and password reset links stop working after a short time.
How to delete it: Delete your workspace yourself in the app under Settings → Account → Delete workspace. It is deleted at once, together with your account and all of the workspace's data, and a running subscription is cancelled. If you can't sign in, email us at hello@officedash.app from the address on the account and we delete it for you.

Emails we send

What we keep: Your email address and the content of the email: the link to verify your address or to reset your password.
Why: To check that the address is yours, and to let you back in when you forget your password. We send these emails through Resend (Resend, Inc.), which processes your email address on our behalf as a processor.
How long: We don't keep a copy of the emails. Resend keeps delivery records for a limited time, under its own retention rules.
How to delete it: Deleting your account stops all emails. To have Resend's delivery records removed sooner, email us at hello@officedash.app.

People data from HoorayHR

What we keep: Only for a workspace that connected HoorayHR: the names, photos, birthdays, work anniversaries, start dates and absences of the people in your organisation, as far as the TV shows them. The credentials of the HoorayHR connection are stored encrypted.
Why: To show on your office TV who is in, who is away, who is new and whose birthday it is, as your organisation asked us to. Your organisation is the controller of this data; we process it on its behalf.
How long: We fetch the people data when the TV needs it and don't store it beyond what the TV shows at that moment. The encrypted credentials are kept until the connection is removed.
How to delete it: Disconnect HoorayHR on the Integrations page in the app: the credentials are deleted and no more people data is fetched. People data itself is managed in HoorayHR.

Spotlight photos and kudos

What we keep: The photos and texts your team adds to a spotlight, and kudos: the names of the sender and the receiver and the message. This includes kudos sent from a phone at /kudos, after scanning the code on the TV.
Why: To show them on your office TV, which is what your organisation uses officedash for.
How long: Until someone in your workspace deletes them, or the workspace is deleted. The TV shows kudos only for a limited number of days.
How to delete it: Delete a spotlight, or hide or delete a kudo, in the app. Anyone named in a spotlight or a kudo can also ask us at hello@officedash.app.

Locations and the map

What we keep: The name and coordinates of your office locations. When you pick a location on the map, your browser loads the map tiles directly from OpenStreetMap, which sees your IP address, as any website you visit does.
Why: To show the right weather, time and people for each office, and to let you pick a location on a map. OpenStreetMap's tile servers are run by the OpenStreetMap Foundation, under its own privacy policy.
How long: Locations are kept until you delete them or the workspace. We don't control how long OpenStreetMap keeps its server logs.
How to delete it: Delete a location in the app. If you don't want OpenStreetMap to see your IP address, type the coordinates instead of using the map.

Weather

What we keep: Only the coordinates of your office locations, nothing about people.
Why: Our server asks Open-Meteo for the forecast at those coordinates, to show the weather on the TV. Your browser doesn't contact Open-Meteo, and no personal data is sent.
How long: Forecasts are not stored with any personal data.
How to delete it: There is no personal data to delete. Deleting a location stops the forecasts for it.

Payments

What we keep: When you pay for a subscription, you enter your card or bank details on Stripe's payment page. They go to Stripe directly and never touch officedash servers. From Stripe we receive only what billing needs: your plan, the payment status, and the billing name, address and VAT number for the invoice.
Why: To charge for your subscription and keep the invoices, as the contract and tax law require. Stripe processes the payment under its own privacy policy.
How long: Invoices and billing records for 7 years, as Dutch tax law requires.
How to delete it: Billing records we must keep by law can't be deleted earlier. Everything else is deleted with your account.

Server logs

What we keep: Technical records of requests and errors: the time, the address requested, the response and error messages. They can include your IP address. They never include passwords or session tokens.
Why: To keep officedash secure and working, and to find and fix errors. This is our legitimate interest (GDPR article 6(1)(f)).
How long: At most 30 days, after which they are deleted.
How to delete it: Logs are deleted automatically. To have them removed sooner, email us at hello@officedash.app.

Hosting and backups

What we keep: officedash runs on a virtual server rented from Hostinger International Ltd. (Cyprus), in a data centre in the EU. The data described in this policy is stored there. Every night a copy of the database is backed up to object storage of Hetzner Online GmbH (Germany), in Germany.
Why: To run officedash and to be able to restore your data after a failure. Hostinger and Hetzner process the data only on our instructions, as our processors under their data processing agreements. This is part of providing the service (GDPR article 6(1)(b)) and our legitimate interest in not losing data (article 6(1)(f)).
How long: The live database keeps data as long as each section above says. The nightly backups are kept for 14 days. Hostinger also makes weekly backups of the whole server, which it keeps under its own retention period.
How to delete it: Data you delete in officedash leaves the live database at once, and the backups when they expire: after 14 days for the nightly backups. For questions, email us at hello@officedash.app.

Cookies and local storage

What we keep: Only functional cookies: a session cookie that keeps you signed in, and a cookie that remembers your language. The TV setup page saves its settings in your browser's local storage. There are no tracking, analytics or advertising cookies.
Why: They are needed for the features you use, which is why there is no cookie banner.
How long: The session cookie until you sign out or the session ends; the language cookie for up to a year; local storage until you clear it.
How to delete it: Sign out, or clear the cookies and site data for officedash in your browser.

Your rights

Under the GDPR you can ask us to show, correct or delete your personal data, to give it to you in a portable format, and to restrict or stop processing it. Email us at hello@officedash.app; we answer within one month. If the request is about people data your organisation manages, we pass it on to your organisation, which decides.

You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Contact

[COMPANY NAME] is responsible for this policy. Send questions about privacy to hello@officedash.app. Our address and registration details are in the imprint.