Legal

Privacy Policy

Last updated: 25 June 2026

This Privacy Policy explains how VibaCloud ("we", "us", "our") collects, uses, shares and protects your information when you use our timesheet application. We have written it to be as plain and honest as we can. The short version is that we only collect what we need to run the service for you, we do not sell your data, and you stay in control of it.

Who we are

VibaCloud is a timesheet tool that imports events from your Microsoft (Outlook) or Google calendar and turns them into draft timesheets you can review, edit and submit. For the purposes of data protection law, VibaCloud is the data controller for the personal information described in this policy. If you have any questions, you can reach us through our contact page.

Information we collect

Account details — when you sign in with Microsoft or Google we receive your email address, your display name and a stable identifier for your account. We use this to create and recognise your VibaCloud account. You can connect both a Microsoft and a Google account to the same login, in which case we store the link between them.
Calendar data — when you run an import we read the events you choose to bring in, including their titles, dates, times, durations and category colours. We use this only to build your draft timesheets. We do not read your mailbox content, contacts or calendars beyond what is needed to perform an import you have asked for.
Timesheet data — the organisations, projects, tasks, hours, rates and entries you create or edit within the app, including submitted timesheets and their totals.
Authentication tokens — to connect to Microsoft and Google on your behalf we store access and refresh tokens issued by those providers. These are kept so you do not have to sign in again every time, and they can be revoked at any point by disconnecting the provider.
Usage and technical data — basic logs such as sign-in events, errors and diagnostic information needed to keep the service secure, available and working correctly.

How we use your information

We use your information to:

provide, operate and maintain the service;
create your account and keep you signed in;
import your calendar events and build draft timesheets from them;
let you manage projects, rates and submitted timesheets;
keep the service secure and diagnose problems; and
meet our legal and regulatory obligations.

We do not sell your personal data, and we do not use your calendar or timesheet content for advertising.

Legal bases for processing

Where data protection law such as the UK GDPR applies, we rely on the following legal bases. We process your account, calendar and timesheet data to perform the contract of providing the service to you. We process technical and security data on the basis of our legitimate interest in keeping the service safe and reliable. Where we ever rely on consent, for example to send a newsletter you have asked for, you can withdraw it at any time.

Third-party services

To deliver the service we share limited information with providers who act on our behalf:

Microsoft and Google handle sign-in and provide the calendar data you import. Your use of their accounts is also governed by their own privacy policies.
Hosting and infrastructure providers store and run the application and its database on our behalf under appropriate data protection terms.

We only share what these providers need to perform their function, and we do not authorise them to use your data for their own purposes.

Google user data (Limited Use)

VibaCloud's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means we only access the Google Calendar events you choose to import, we use that data solely to build the draft timesheets you have asked for, and we do not sell it, transfer it to others except as needed to provide the service, use it for advertising, or allow humans to read it except where you explicitly permit it, where required for security or to comply with the law, or in aggregated, anonymised form for internal operations.

Data storage and security

Your data is stored in a secured database and access is scoped to your account. We take reasonable technical and organisational measures to protect it against unauthorised access, alteration or loss, including restricted access, encrypted connections and securely held authentication tokens. No online service can be guaranteed to be completely secure, but we work to keep the risk as low as we reasonably can.

How long we keep your data

We keep your account, calendar and timesheet data for as long as your account is active so the service works as you expect. If you ask us to delete your account, we remove your personal data within a reasonable period, except where we are required to retain certain records to meet legal obligations. Diagnostic logs are kept only as long as they are useful for security and troubleshooting.

International transfers

Your data may be processed in countries outside the one in which you live. Where that happens, we take steps to ensure it continues to receive an appropriate level of protection, for example through the safeguards required by applicable data protection law.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, and to receive a copy of it in a portable format. You can disconnect a calendar provider at any time from your account settings, which revokes our access to it. To exercise any of these rights, or to request deletion of your account and associated data, please contact us. You also have the right to complain to your local data protection authority.

Cookies

We use essential cookies to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.

Children's privacy

VibaCloud is a workplace timesheet tool intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time to reflect changes to the service or the law. When we do, we will revise the "Last updated" date above, and significant changes will be made clear within the service. Continued use after an update means you accept the revised policy.

Contact

Questions about this policy, or want to exercise your rights? Reach us via the contact page.