Legal

Privacy Policy

Last updated: 1 August 2026

This Privacy Policy explains how VibaCloud ("we", "us", "our") collects, uses, shares and protects your information when you use our timesheet application. We have written it to be as plain and honest as we can. The short version is that we only collect what we need to run the service for you, we do not sell your data, and you stay in control of it.

Who we are

VibaCloud is a timesheet tool that imports events from your Microsoft (Outlook) or Google calendar and turns them into draft timesheets you can review, edit and submit. For the purposes of data protection law, VibaCloud is the data controller for the personal information described in this policy, except where you use VibaCloud as part of a team set up by your employer or client. In that case they decide what is shared and what they do with it, and we act on their choices. See Teams and shared workspaces below. If you have any questions, you can reach us through our contact page.

Information we collect

Account details: when you sign in with Microsoft or Google we receive your email address, your display name and a stable identifier for your account. We use this to create and recognise your VibaCloud account. You can connect both a Microsoft and a Google account to the same login, in which case we store the link between them.
Calendar data: when you run an import we read the events you choose to bring in, including their titles, dates, times, durations and category colours. We use this only to build your draft timesheets. We do not read your mailbox content, contacts or calendars beyond what is needed to perform an import you have asked for.
Timesheet data: the organisations, projects, tasks, hours, rates and entries you create or edit within the app, including submitted timesheets and their totals.
Authentication tokens: to connect to Microsoft and Google on your behalf we store access and refresh tokens issued by those providers. These are kept so you do not have to sign in again every time, and they can be revoked at any point by disconnecting the provider.
Usage and technical data: basic logs such as sign-in events, errors and diagnostic information needed to keep the service secure, available and working correctly.

How we use your information

We use your information to:

provide, operate and maintain the service;
create your account and keep you signed in;
import your calendar events and build draft timesheets from them;
let you manage projects, rates and submitted timesheets;
keep the service secure and diagnose problems; and
meet our legal and regulatory obligations.

We do not sell your personal data, and we do not use your calendar or timesheet content for advertising.

Teams and shared workspaces

VibaCloud can be used on your own or as part of a team, which is how firms use it. Joining a team changes who can see your work, so it is worth being precise about it.

A team is created by someone at your organisation, who becomes its administrator. They choose which clients are shared with the team and they invite people by email address. An invite can only be accepted by an account whose email address matches the one it was sent to.

Once you are in a team, its administrators can see the work you record against the team's shared clients:

Your submitted work: the dates, hours, descriptions, projects, tasks, rates and values of entries you have tagged to a shared client, along with the totals, charts and spreadsheet exports built from them.
Your submission activity: whether you have started, drafted, submitted or had a week approved, and when you submitted it.
Amounts you have invoiced for the team's work, as figures. Administrators do not see the invoices themselves, your clients' contact details, or anything you have invoiced outside the team.
Your name and email address, so they can tell whose work is whose.

Administrators can also approve a week you have submitted, or send it back to you with a comment asking for changes.

Two limits on this are built into the product itself rather than left to policy:

Work on your own clients stays private. If a client is not shared with the team, neither that work nor the fact that it exists appears anywhere an administrator can reach. The totals they see are recalculated from the team's share alone, so your private hours are not disclosed as a number either.
Only from the day you joined. Weeks you submitted before joining stay yours and are not visible to the team, even if the client is shared with it later. Submitting a week while you are a member is the act that shares it.

Your organisation decides who is in the team, which clients are shared and what it does with the figures it can see. We provide the tool and act on those choices, so questions about why your employer or client is collecting this information, how they use it, or how long they keep it are for them to answer rather than us. If you leave a team, your account and your own timesheets stay with you, and work that was already approved remains part of that organisation's records.

If you are the one running a team, our Data Processing Agreement is the terms on which we handle your team's data for you. It covers what we do with it, the sub-processors involved, how we help you if one of your people exercises their rights, and what happens to the data when you stop using the service.

Legal bases for processing

Where data protection law such as the UK GDPR applies, we rely on the following legal bases. We process your account, calendar and timesheet data to perform the contract of providing the service to you. We process technical and security data on the basis of our legitimate interest in keeping the service safe and reliable. Where we ever rely on consent, for example to send a newsletter you have asked for, you can withdraw it at any time.

Where you use VibaCloud as part of a team, the organisation that set it up is responsible for having a lawful basis for asking you to record your time and for seeing the work described above. If you are unsure why your employer or client is doing this, ask them first, and contact us if you still need help.

Third-party services

To deliver the service we share limited information with providers who act on our behalf:

Microsoft and Google handle sign-in and provide the calendar data you import. Your use of their accounts is also governed by their own privacy policies.
Hosting and infrastructure providers store and run the application and its database on our behalf under appropriate data protection terms.
Mailjet (Sinch) delivers the email we send on your behalf, which includes invoices and payment reminders to your clients, team invites, team notifications about timesheets being submitted, approved or sent back, and password reset links. To do that it handles the recipient's email address and the contents of the message, including the invoice PDF where one is attached. Note that this means your own clients' names, billing email addresses and invoice details pass through Mailjet, even though they are not VibaCloud users themselves. Some of our internal email is sent through our own mail server instead.
Cloudflare Turnstile checks that a person rather than an automated script is filling in the form when you create an account or request a password reset link. It receives your IP address and basic information about your browser in order to make that decision. We use it to stop automated abuse of those two forms, not to track you.

We only share what these providers need to perform their function, and we do not authorise them to use your data for their own purposes. If we add or change a provider that handles your personal information, we will update this list.

Google user data (Limited Use)

VibaCloud's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means we only access the Google Calendar events you choose to import, we use that data solely to build the draft timesheets you have asked for, and we do not sell it, transfer it to others except as needed to provide the service, use it for advertising, or allow humans to read it except where you explicitly permit it, where required for security or to comply with the law, or in aggregated, anonymised form for internal operations.

Data storage and security

Your data is stored in a secured database and access is scoped to your account. We take reasonable technical and organisational measures to protect it against unauthorised access, alteration or loss, including restricted access, encrypted connections and securely held authentication tokens. No online service can be guaranteed to be completely secure, but we work to keep the risk as low as we reasonably can.

How long we keep your data

We keep your account, calendar and timesheet data for as long as your account is active so the service works as you expect. If you ask us to delete your account, we remove your personal data within a reasonable period, except where we are required to retain certain records to meet legal obligations. Diagnostic logs are kept only as long as they are useful for security and troubleshooting.

International transfers

Your data may be processed in countries outside the one in which you live. Where that happens, we take steps to ensure it continues to receive an appropriate level of protection, for example through the safeguards required by applicable data protection law.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, and to receive a copy of it in a portable format. You can disconnect a calendar provider at any time from your account settings, which revokes our access to it. To exercise any of these rights, or to request deletion of your account and associated data, please contact us. You also have the right to complain to your local data protection authority.

Cookies

We use essential cookies to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.

Children's privacy

VibaCloud is a workplace timesheet tool intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time to reflect changes to the service or the law. When we do, we will revise the "Last updated" date above, and significant changes will be made clear within the service. Continued use after an update means you accept the revised policy.

Contact

Questions about this policy, or want to exercise your rights? Reach us via the contact page.