Privacy Notice

SEC.01 // OVERVIEW

Clocked ("we," "us") takes your privacy seriously. This Notice explains what data we collect when you use clocked.live, how we use it, and what rights you have over it. We do not sell your personal data.

SEC.02 // WHAT WE COLLECT

We collect only what we need to deliver the Service:

• Face image
  The photo you submit for analysis. Stored in a private, access-controlled storage bucket. Accessible only via a time-limited signed URL issued per request.
• IP hash (rate limiting)
  A one-way cryptographic hash of your IP address, used solely to enforce our rate limit (5 scans per 15 minutes). The original IP address is never stored.
• Technical data
  Standard server logs (browser type, device type, referring URL). Used for stability and security monitoring only.
• Payment data
  Handled entirely by Paddle, our payment processor. Clocked never receives, stores, or processes your payment card details.

SEC.03 // HOW WE USE YOUR DATA

• Report generation
  Your photo is sent to our AI processing pipeline for feature extraction and text generation. The image is used solely for this purpose. We do not use your likeness for advertising, model training, or profiling.
• Report delivery
  Your report is stored in our database linked to a UUID. You access it via a unique URL. We do not create accounts or link reports to identity beyond the UUID.
• Rate limiting & security
  IP hashes are used to prevent abuse and protect service availability.

SEC.04 // THIRD-PARTY PROCESSORS

We use the following sub-processors to deliver the Service:

• Supabase
  Database and file storage. Stores reports and images in an access-controlled environment. Data may be stored in the US and EU.
• AI processing services
  Your image and derived analysis data are processed by AI services for feature extraction and text generation. These services process your data on our behalf only and are contractually prohibited from retaining or using it beyond the scope of our API requests.
• Paddle.com Market Ltd
  Payment processing and merchant-of-record. Paddle collects and processes payment data independently under their own Privacy Policy. See paddle.com/legal/privacy.
• Vercel
  Hosting and edge infrastructure. Standard server logs are processed by Vercel. See Vercel's privacy policy for details.

SEC.05 // DATA RETENTION

Reports and associated face images are retained for up to 90 days from the date of creation, after which they are automatically deleted. IP hashes are retained in accordance with our rate-limiting window (15 minutes).

You may request deletion of your report at any time by emailing hello@clocked.live with your report reference number (the first 8 characters of your report URL). We will delete your image and report within 5 business days.

SEC.06 // YOUR RIGHTS

Depending on your jurisdiction, you may have the right to: access your personal data, request correction or deletion, request a copy in a portable format, and object to certain processing. To exercise any of these rights, contact us at hello@clocked.live.

EU and UK residents have additional rights under GDPR and UK GDPR, including the right to lodge a complaint with a supervisory authority.

SEC.07 // COOKIES

Clocked uses only technically necessary cookies for session management and rate limiting. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. If we add analytics in the future, this notice will be updated and consent obtained where required.

SEC.08 // CHILDREN

Clocked is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected such data, we will delete it promptly.

SEC.09 // CHANGES TO THIS NOTICE

We may update this Privacy Notice periodically. The effective date at the top of this page reflects the most recent revision. Material changes will be announced on the Service.

SEC.10 // CONTACT

For privacy-related enquiries, to request data deletion, or to exercise your rights: hello@clocked.live