This policy explains what personal data Tiny Team collects, why, who else handles it, how long we keep it and what your rights are. It is information for you, not a contract you have to accept.
The short version
- Tiny Team is a workspace for organizations. Your organization decides what it keeps about its people and job candidates, and we process that data on its behalf. If you are an employee or a candidate, ask your organization first.
- Some profile details are visible to everyone in your organization, including your name, email address, phone numbers, job title, date of birth, gender and nationality. Your organization's administrators assign the roles that decide who sees the rest.
- If your organization uses HR, everyone in it can see all time off in the team calendar, including the reason and any attachments, so don't put health details there unless your organization asks you to.
- Workspace data is stored with Amazon Web Services in Ireland. Images in Document Spaces pages are the exception: they are stored with Amazon Web Services in the USA.
- Modules are sold through Polar, our reseller and merchant of record. Polar handles your payment. We never see your card details.
- We only send the emails Tiny Team needs to work, such as sign-in links, invitations and time-off notices. We have no newsletter and send no marketing emails.
- When someone opens a short link made with Links, we count the click for the organization that made it, without cookies, and the click statistics never contain the IP address. Like every request, the click also appears in our server logs, which we keep for 30 days.
- On our website, Fathom counts visits without cookies, and we use no cookies that need your consent.
- We don't sell your data, we don't use it for advertising, and Tiny Team sends none of it to AI services.
- To see, correct, export or delete your data, or to object, email privacy@tinyteam.io.
Who we are
Tiny Team is run by Iaroslav Morgunov, a sole trader (empresário em nome individual) established in Portugal. "We" and "us" in this policy mean him. He is the controller of the personal data Tiny Team processes for its own purposes. For the data organizations keep in their workspaces, see "Your organization's data" below.
- Address: Rua Alfredo Keil 571, 4150-047 Porto, Portugal
- NIF (tax number): 310038588
- Privacy requests: privacy@tinyteam.io
- Support, refunds, content reports and everything else: support@tinyteam.io
- Phone: +351 924331054
We have not appointed a data protection officer, because the law does not require one for the kind of processing we do. Write to privacy@tinyteam.io instead.
What this policy covers
This policy applies when you:
- visit www.tinyteam.io, including our blog and free online tools
- create a Tiny Team workspace, accept an invitation to one, or use the Tiny Team app at app.tinyteam.io
- start a trial or buy a module for your organization
- apply for a job through a careers page or job link hosted on Tiny Team
- open a short link made with Tiny Team Links, on our shared short domain or on an organization's own domain
- receive emails from us, or write to us
Other companies' pages that we link to or that open from Tiny Team, such as Polar's checkout, Google sign-in, YouTube or the destination of a short link, have their own privacy policies.
Your organization's data
Organizations use Tiny Team to keep records about their people and job candidates: profiles, time off, pay history, bank details, reviews, notes, files, documents, short links, media and job applications. The organization decides what it stores, who in it can see what, and how long it keeps it. Much of this data comes from the organization rather than from you, for example when an administrator invites you or HR adds records about you. Some of it can be sensitive, such as bank details, pay, sick leave or a daily mood check-in, and organizations can add their own profile fields for anything else.
For this data, the organization is the controller, and we process it on its behalf and on its instructions. This means:
- We use it only to provide Tiny Team to that organization: to store it, show it to the right people, send the notifications that are part of Tiny Team, keep it secure, and help when the organization asks for support.
- We don't use it for our own purposes. We don't sell it, we don't use it for advertising, and Tiny Team doesn't send it to AI services.
- We don't look through workspaces. We look at a workspace's content only when the organization asks us for help, to investigate abuse or a security problem, or when the law requires it.
- The organization's own privacy notice explains why it uses your data and on what legal basis.
If you work for, or applied to, an organization that uses Tiny Team, contact that organization first about your data. If you write to us instead, we will pass your request on to the organization and help it answer you.
We are the controller for what we process for our own purposes: accounts and sign-in, purchases and trials, our emails, security and audit records, support, and our website.
Accounts and sign-in
Creating a workspace
Anyone can create a workspace at app.tinyteam.io with an email address or a Google account. The person who creates it becomes the organization's first administrator, with the Administrator, HR Manager, Manager and Team Member roles. During setup we ask for your first and last name, your job title and your organization's name. Each new account gets a random picture from our own set, which you can change.
Signing in with an email link
When you sign up or sign in with your email address, we email you a sign-in link. If no account exists for that address yet, this creates a new workspace and account for it, even when the address was entered on the sign-in page, and we send a welcome email to it. The link works once and expires after 15 minutes. The sign-in page doesn't reveal whether an address already has an account.
Signing in with Google
On the sign-in and registration pages, your browser loads Google's sign-in script from accounts.google.com as soon as the page opens. If you choose Google, Google confirms your email address to us. We then store your email address, your Google account ID and the first and last name on your Google account. We don't store your Google profile picture. If an account with that email address already exists, we link it to your Google account. Google handles your Google account under its own privacy policy.
Invitations
Administrators and HR Managers can invite others by email, optionally adding their name, department and job title. We create a pending account straight away and send an invitation email that shows the organization's name as the sender. The invitation link stays valid until it is accepted or the pending account is deleted. An email address can belong to only one Tiny Team organization, so we don't send an invitation to an address that already has an account in another one.
Staying signed in
After you sign in, the app keeps a sign-in token in a cookie and in your browser's local storage (see "Cookies and similar technologies"). The token stays valid until you sign out, until an administrator deactivates or deletes your account, or until we revoke it. Signing out ends your sessions on our server on every device.
We also store your account's status, roles, time zone and app settings, and technical fields our sign-in system needs, such as when a sign-in link was sent. You can change your name and most of your profile yourself in My Profile.
Leaving an organization
There is no button to delete your own account. Administrators and HR Managers can deactivate a member, which blocks sign-in and ends all of that member's sessions while keeping their data. They can then delete the account. The last active administrator can't be removed.
Deleting a member removes their profile and the records linked to them: addresses, emergency contacts, bank details, pay history, time off and balances, notes about them and notes they wrote, reviews they took part in, timeline posts, comments and reactions, mood check-ins, equipment assignments, files and notifications. Job posts they created move to the administrator who deleted them. Files they added to the shared Media Library stay there, without their name. We email the person to tell them their account was deleted. To close a whole workspace, see "How long we keep data".
Using Tiny Team
Every workspace has shared tools (the Team directory and profiles, Inbox, organization settings and the Media Library). On top of them, an organization can activate modules: HR, Document Spaces and Links. This is what each part stores:
| Part | What it stores |
|---|---|
| Team and profiles | Name, email, work and personal phone, profile picture, job title, department, work location, manager, start, end and probation dates, employment type, date of birth, gender, nationality, time zone, public holiday country, addresses, emergency contacts, and any custom fields the organization adds |
| Inbox | Notifications for each member, such as time-off and review updates |
| Organization settings | Name, logo, about text, mission and values, departments, job titles, work locations and holidays |
| Media Library | Images and videos, with their names, captions, tags, size and who uploaded them |
| HR | Time-off requests (type, dates, reason and attachments), balances and adjustments; pay history; bank details; files and private HR notes on profiles; performance reviews; equipment and who has it; company timeline posts, comments, reactions and images; daily mood check-ins; job posts and candidates |
| Document Spaces | Spaces and pages, with their text, images and embedded YouTube videos |
| Links | Short links (destination, title, address, tags, expiry and an optional password), custom domains, QR codes and click statistics |
We also record usage against your organization's allowances (such as storage used, number of links and tracked clicks) and, for each module, when its trial started and ends and who started it. Public holidays come from Calendarific, which receives only a country code and a year, never personal data.
Who in your organization sees what
Your organization's administrators decide who gets which role, and roles decide what each member can see and do. These are the defaults:
| Data | Who can see it by default |
|---|---|
| Name, email, work and personal phone, profile picture, time zone, roles, job title, department, work location, start date, date of birth (including the year), gender and nationality | Everyone in the organization. Birthdays and work anniversaries in the next 7 days also appear on the HR dashboard. |
| Time off, approved and pending, including the type of leave, the reason and any attachments | Everyone in the organization, in the HR team calendar |
| Other employment details (such as manager, employment type, end and probation dates) and custom fields | The member, their direct manager and people with the Administrator, HR Manager or Manager role |
| Addresses and emergency contacts | The member, and people with the Administrator, HR Manager or Manager role |
| Pay history | The member, and people with the Administrator or HR Manager role |
| Bank details | The member, and people with the Administrator, HR Manager or Manager role, for every member of the organization |
| Files on a profile | People with the Administrator, HR Manager or Manager role |
| Private HR notes | People with the Administrator or HR Manager role only, not the member |
| Performance reviews | The person reviewed, the reviewer, the person's direct manager and people with the Administrator or HR Manager role |
| Daily mood check-in | In the app, only the member. Everyone sees today's totals for the whole organization, which in a very small team can make individual answers easy to guess. |
| Candidates | People with the Administrator, HR Manager, Manager or Recruiter role |
| Short links and their click statistics | Everyone in the organization with access to Links |
Your organization may set up roles differently; its administrators can tell you who has which role. Please don't write health details or other sensitive information in a time-off reason or attachment unless your organization asks you to.
Files and uploads
Files uploaded to profiles, time-off requests, candidates, timeline posts, equipment, the Media Library, organization logos and page covers are kept in private, encrypted storage with Amazon Web Services in Ireland. The app shows them through signed links that expire: after 15 minutes for Media Library previews and after 2 days for other files. Anyone who has such a link can open the file until it expires.
We keep files as they were uploaded. Photos can contain metadata, such as the place and time they were taken, and we don't remove it from the original file.
Images in Document Spaces pages are different. They are stored at a public web address, with Amazon Web Services in the USA. Anyone who has the address of such an image can open it without signing in, even if the page is a draft or only visible inside your organization. Removing an image from a page doesn't delete it: it stays at its address until the page is deleted. Please don't put confidential information in document images.
Public content
Some content is public by design:
- Careers page and job posts. When someone in the organization with access to hiring turns on the careers page, anyone can see the organization's name, logo, about text, mission and values, and its active public job posts with their title, description, department, location and employment type.
- Short links. Anyone who has a short link is sent on to its destination.
- Document images, as explained above.
Custom domains for Links
When an organization connects its own domain to Links, we request an HTTPS certificate for it from Amazon Web Services. As with every HTTPS certificate, the domain name is published in public Certificate Transparency logs. What we record when someone opens a short link is explained under "People who open short links".
Support access to your workspace
When your organization asks us for help, when we need to investigate abuse or a security problem, or when the law requires it, we can open a support session in your workspace as one of its members. A support session:
- needs a written reason, which we record
- lasts at most 30 minutes and can't be extended
- lets us see and do what that member can, with that member's roles, including making changes, unless we limit it to viewing only
- can't change the member's sign-in email address or password
- is logged: who opened it, for which member, why, when, and each page or action used, but not the content
Our admin tools also let us view and correct account details (such as names, contact details and employment fields), set up modules and allowances for an organization, and deactivate or delete accounts and organizations. We use them for the same reasons, and to carry out an organization's requests, such as a refund or closing its workspace.
How the app reaches you
The app is hosted on Vercel. Everything your browser sends to our servers, including your sign-in token and the data you open, passes through Vercel's network on its way to our servers at Amazon Web Services in Ireland. Every page of the app, including the sign-in, registration, careers and job pages, loads its fonts from Google Fonts, so Google receives your IP address and browser details. The app may also send Vercel page-speed measurements: the page address, the measured times and your type of connection. The app loads no advertising, analytics or chat scripts.
Our servers log each request to our API: the time, the address requested, the result, and technical details of the connection, which can include your IP address. Passwords, sign-in tokens and email addresses sent in requests are filtered out of the request entries, but the logs can still contain email addresses and names, for example when we queue an email to you or when you sign in with Google. We keep server logs for 30 days.
When our server runs into an error, it sends an error report to Sentry: what went wrong, where in our code, and details of the request it was handling. We set Sentry not to collect IP addresses or cookies, but a report can contain fragments of the data that was being processed. Sentry also receives performance samples from about 1 in 10 requests.
Job applicants
If you apply for a job through a careers page or job link hosted on Tiny Team, your application goes to the organization offering the job. That organization is the controller: it decides how it uses your application and how long it keeps it, and its privacy notice applies. We store your application and show it to the organization's hiring team for it.
The application form asks for your first and last name, your email address and your resume (PDF, DOC or DOCX, up to 25 MB). You can also add a phone number, your LinkedIn profile, a portfolio link and a cover letter. We store these in the organization's workspace, with your resume in private, encrypted storage, and record that you applied online and when. We don't email you about your application; the organization contacts you directly.
The organization's hiring team can then add its own information, such as your stage and status in its hiring process, notes, tags, files, salary expectations, availability and custom fields. Organizations can also add candidates themselves, for example from a referral or a job board. If an organization added you that way, it should tell you.
Tiny Team doesn't score, rank or reject candidates automatically. Applications are not deleted automatically: they stay until the organization deletes them. To see, correct or delete your application, contact the organization. If you can't reach it, write to privacy@tinyteam.io and we will help.
Careers and job pages are part of the app, so "How the app reaches you" and "Cookies and similar technologies" apply to them too.
People who open short links
Links lets organizations create short links and QR codes, on our shared short domain or on their own domain. When you open a short link or scan its QR code, your request passes through Amazon CloudFront to our server, which sends you on to the destination the organization chose. The organization that made the link is the controller of its click statistics; we produce them for it.
For each counted click we record:
- the time and which link it was
- the hostname of the site you came from, never its full address ("Direct" if there was none)
- your type of device (mobile, tablet or desktop) and browser family (for example Chrome or Safari)
- your country, as Amazon CloudFront determines it from your IP address
- a visitor code, calculated from your IP address and browser details with a key that is different for each organization and each day. It lets the organization estimate how many different visitors a link had on a given day. Because it changes every day and differs between organizations, it can't be used to recognise you on another day or across organizations.
We never store your IP address or full browser details with click data. Recognized bots, link previews and prefetches are not counted. Individual click records, including the visitor code, are deleted after 7 days. Daily summaries (counts by link, referrer, device, browser and country, and visitor estimates that don't contain the visitor codes) are kept for 12 months.
Like any web server, CloudFront and our server receive your IP address and browser details to deliver the redirect, and our server uses a daily code made from your IP address for a short time to limit repeated requests. Our server logs, kept for 30 days, record the request. Links sets no tracking cookies. Our redirect asks your browser not to tell the destination site which short link you used.
If a link has a password, you see a password page first. When you enter the correct password, we set a cookie for that link only, for 15 minutes, so you aren't asked again (see "Cookies and similar technologies").
The destination website is run by someone else and has its own privacy policy. To report a short link used for phishing, malware or other abuse, email support@tinyteam.io with the exact short link.
Buying a module
Only an organization's administrators can start trials and buy modules, in Modules & Billing in the app. Trials need no payment details.
Tiny Team modules are sold by Polar (Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA) as our reseller and merchant of record, through Polar's hosted checkout. Polar collects your payment details, billing address and tax information, charges you, handles VAT and sales tax, and sends you your receipt. Polar does this under its own Buyer Terms and Privacy Policy. We never see or store your card details.
When an administrator starts a checkout, we send Polar:
- the administrator's email address
- an identifier for the organization in Tiny Team
- the modules, their prices and the currency
- technical references that link the payment to the checkout in Tiny Team
Once Polar confirms the payment, we record the purchase. We store:
- the checkout and order references, the modules, the amounts and currency, the payment status and time, and the details we sent Polar, including the administrator's email address
- which modules the organization owns, and since when
- for trials: when each one started and ends, and who started it
We don't store the tax amount or Polar's payment notifications. Polar's dashboard also shows us each order with the details you gave Polar at checkout, such as your name and billing address.
We use this to give your organization access, answer support and refund requests, and keep business and accounting records. Refunds are processed through Polar; the rules are in our Terms of Service.
Emails we send
We only send emails that Tiny Team needs to work:
- sign-in links, and a welcome email when you create a workspace
- invitations to join an organization
- time-off notices: when a member requests time off, their direct manager and the organization's HR people get an email with the member's name, the type of leave, the dates, the number of days and the reason entered
- a notice to a member whose account an administrator has deleted
Invitations and time-off notices show the organization's name as the sender. We send all our emails through Cloudflare Email Sending, from addresses at tinyteam.io. Our emails contain no tracking pixels or tracked links. They do load a font from Google Fonts, so when your email app displays them, Google may receive your IP address.
We have no newsletter and don't send marketing emails. Polar sends you receipts and other emails about your payment.
Our website
Hosting
Our website, www.tinyteam.io, runs on Vercel. Like any web server, it receives your IP address, your browser and device details (the "user agent"), the page you request and the page you came from. Vercel uses this to deliver pages and protect the site from abuse, and keeps request logs for a short time.
Images in our blog are served from files.screensnap.pro, storage on Cloudflare that we also use for ScreenSnap Pro, another product we run. It receives the same kind of technical data. Our fonts are served from our own website.
The website has no forms or sign-up of its own and sets no cookies. The prices it shows come from our own server and carry no data about you.
Visitor statistics with Fathom
We count visits with Fathom Analytics for every visitor, without asking first. Fathom puts no cookies on your device and doesn't build a profile of you.
Fathom receives your IP address and browser details, the address of the page you view (including campaign tags such as utm_source if the link you followed had them), the site you came from and how long you stay on the page. According to Fathom, it uses your IP address only briefly, to recognise a visit with an identifier that changes every day. We only see totals: pages, referrers, countries, browsers and device types. According to Fathom, visits from the EU are processed on its servers in the EU.
We rely on our legitimate interest in knowing how many people visit which pages.
Embedded YouTube videos
Some blog posts contain a YouTube video. When such a page loads, your browser fetches the video's preview image from Google's server (i.ytimg.com), which gives Google your IP address, browser details and the name of our website. The YouTube player itself loads only when you click play, from youtube-nocookie.com. From that point Google may set cookies or similar storage in your browser, under Google's own privacy policy.
Free online tools
Our free tools, such as the salary, paycheck and PTO calculators, run entirely in your browser. What you enter is never sent to us or to anyone else, and files you export are created on your device.
Support and reports
When you email support@tinyteam.io or privacy@tinyteam.io, we receive whatever you send: usually your name, email address, message and any attachments, and sometimes details of your organization or a purchase. Our mailboxes are hosted by Proton (Proton AG, Switzerland). We use this to answer you and keep a record of what we agreed. If we need to look into your workspace to help, we may open a support session (see "Support access to your workspace").
Reports of illegal content. If you report a short link, a job post, a document image or other content hosted on Tiny Team, we use your report to review that content. We tell the organization concerned what we decided and why, but we don't give it your name or email address unless the law requires it or you agree. How to report is explained in our Terms of Service.
Purposes and legal bases
| Purpose | Main data | Legal basis |
|---|---|---|
| Creating and running workspaces and accounts, and signing you in | Email, name, Google account ID, roles, sign-in tokens | Contract (Art. 6(1)(b) GDPR) |
| Storing and processing the content of workspaces, including job applications and short-link click statistics | What the organization keeps in Tiny Team | We act on the organization's instructions (Art. 28 GDPR). The organization relies on its own legal basis |
| Trials, selling modules through Polar and keeping purchase records | Administrator's email, organization ID, order details | Contract |
| Sign-in, welcome, invitation and account emails | Email, name, organization name | Contract |
| Time-off notices by email | Requester's name, type of leave, dates, reason | On the organization's instructions |
| Keeping Tiny Team secure: sessions, rate limits, server logs, records of support sessions | IP address, request logs, audit records | Legitimate interests: keeping the service, accounts and data secure |
| Delivering the app and our emails, including fonts (Google Fonts) and page-speed measurements (Vercel) | IP address, browser details, page address, measured times, connection type | Legitimate interests: delivering a working, fast app and readable emails |
| Error reports (Sentry) | Error details | Legitimate interests: finding and fixing bugs |
| Support, including support sessions | Your messages; the workspace data we see in a session | Contract, and legitimate interests: keeping a record of what we agreed. For workspace data we look at because the organization asked for help, the organization's instructions. When we investigate abuse or a security problem, our legitimate interest in keeping Tiny Team and its users safe. When the law requires it, legal obligation (Art. 6(1)(c)) |
| Handling reports of illegal content | The report, the content reported | Legal obligation under the EU Digital Services Act (Art. 6(1)(c)), and legitimate interests: keeping Tiny Team free of abuse |
| Delivering and protecting the website | IP address, browser details, request logs | Legitimate interests: running a working, secure website |
| Visitor statistics (Fathom) | Pages, referrers, campaign tags | Legitimate interests: knowing which pages are read |
| Accounting, tax and other legal duties | Order and purchase records | Legal obligation (Art. 6(1)(c)) |
| Establishing or defending legal claims | Relevant records | Legitimate interests |
"Contract" means our contract with you. When you use Tiny Team as an administrator or member of an organization, our contract is usually with the organization, so for you we rely instead on our and your organization's legitimate interest in providing the workspace it set up (Art. 6(1)(f)).
Where we rely on legitimate interests, you can object (see "Your rights"). Nothing we do relies on your consent.
Who receives your data
Inside your organization, colleagues see data according to their roles (see "Who in your organization sees what"). Outside it, we use the service providers below. They process data on our behalf or, where noted, also for their own purposes under their own policies. We don't sell your personal data to anyone.
| Provider | What they do for us | Where |
|---|---|---|
| Amazon Web Services | Our servers, database, private file storage, job queue and server logs; storage for Document Spaces images; Amazon CloudFront for short-link redirects and document images; HTTPS certificates for custom domains | Ireland (EU); Document Spaces images in the USA; CloudFront worldwide; certificates in the USA |
| Vercel Inc. | Hosting our website and the app, carrying the app's traffic to our servers | USA, global network |
| Cloudflare, Inc. | Sending our emails; storage for our blog images | USA, global network |
| Polar Software, Inc. | Reseller and merchant of record: checkout, payment, tax and receipts. Also acts under its own policies. | USA |
| Sentry (Functional Software, Inc.) | Error reports from our server | EU region (Germany) |
| Fathom Analytics (Conva Ventures Inc.) | Cookieless website statistics | Canada; EU visitors processed in the EU |
| Sign-in with Google, fonts in the app and in our emails, YouTube previews and players. Google acts under its own privacy policy. | USA and global network | |
| Proton AG | Our email mailboxes | Switzerland |
We also share data when the law requires it (for example with tax authorities or courts), with the authorities when we report illegal content or a threat to someone's life or safety, with professional advisers such as an accountant or lawyer who are bound by confidentiality, or to establish or defend legal claims.
International transfers
Our servers, database, private file storage and server logs are in the EU, with Amazon Web Services in Ireland. Images in Document Spaces pages are the exception: they are stored with Amazon Web Services in the USA. Error reports are stored in Sentry's EU region; Sentry is a US company and may access them from there. Some providers are based outside the European Economic Area, or deliver data through worldwide networks:
- Switzerland and Canada (Proton, Fathom): the European Commission has decided that these countries protect personal data adequately.
- United States: we rely on the EU-US Data Privacy Framework where the provider is certified under it (at the time of writing: Amazon Web Services, Cloudflare, Google, Sentry and Vercel). Polar is not certified, so we rely on the Standard Contractual Clauses approved by the European Commission, which are part of its data processing terms.
- Worldwide networks: Vercel (for the website and the app), Amazon CloudFront (for short links and document images) and Cloudflare (for our blog images) deliver traffic through the location nearest to you, which can be outside the EU. The certificates for custom short-link domains are managed in Amazon Web Services' US region and contain only domain names.
Email privacy@tinyteam.io if you want a copy of these safeguards.
How long we keep data
| Data | How long |
|---|---|
| Accounts (email, name, Google account ID, roles) | As long as the account exists. Deactivated accounts are kept until an administrator deletes them. |
| Workspace content: profiles, HR records, documents, media, links and job applications | Until the organization deletes it or asks us to close the workspace. There is currently no automatic deletion, including for inactive workspaces and for modules whose trial has ended. |
| Deleted members | Their profile and linked records are deleted straight away (see "Leaving an organization"), apart from the copies and records listed below |
| Images in Document Spaces pages | Until the page is deleted, even if you remove the image from the page. Until then they stay reachable at their public address. They are also deleted when the account of the person who uploaded them is deleted. |
| Deleted or replaced files | Previous versions stay in our storage for 30 days, then are removed |
| Media Library Trash | 30 days, then the files are removed. A record of the file's name, caption, tags and uploader stays in the workspace. |
| Links in Trash | 30 days, then the destination, title, password and tags are removed. The short address itself is kept so that it is never reused. |
| Short-link click records | Individual clicks with the daily visitor code: 7 days. Daily summaries and monthly counts: 12 months. |
| Sign-in links | 15 minutes, and they work only once |
| Invitations | Until accepted, or until the pending account is deleted |
| Sign-in tokens | Until you sign out or your account is deactivated or deleted. A record of old tokens (which account, and when each was issued and revoked) is currently kept with no automatic deletion. |
| Records of support sessions | Kept with no automatic deletion, also after the member's account is deleted, so that every support access stays accountable |
| Purchase and trial records | Kept with no automatic deletion, as the record of what each organization bought. Accounting records as long as Portuguese tax and accounting law requires (up to 10 years). |
| Server logs | 30 days |
| Job queue backups | 1 day |
| Failed background jobs (for example an email that could not be sent) | In our job queue while they are retried, and for up to 6 months after they last fail, including details such as the recipient's email address |
| Error reports (Sentry) | Up to 90 days |
| Website request logs (Vercel) | A short time, at most 30 days |
| Fathom | Anonymous totals, kept while we use Fathom |
| Support emails | In our mailbox, with no automatic deletion. Ask us and we will delete them unless we need them for a legal claim or legal duty. |
Closing a workspace. There is no button to close a workspace or export its data yet. An organization's administrator can email support@tinyteam.io to ask for an export of the organization's data in a common machine-readable format (such as CSV or JSON), to close the workspace, or both. We do this within 30 days. Closing deletes the workspace and its data. We keep only the accounting and tax records the law requires (up to 10 years), the records of what the organization bought and of our support sessions in its workspace, which we keep so that purchases and staff access stay accountable, and copies in backups and logs, which are removed as those copies expire.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it
- correct data that is wrong or incomplete
- delete your data (the "right to be forgotten")
- restrict how we use your data, for example while we check a complaint
- data portability: receive the data you gave us in a common machine-readable format, or have it sent to another company
You can see and correct much of your own profile yourself in My Profile, including your name, phone numbers, date of birth, gender, nationality, time zone, picture, addresses and emergency contacts. If your organization uses HR, you can also manage your bank details and see your own time off and pay history there. Some data, such as private HR notes, is visible only to your organization's HR people. For a full copy of what your organization keeps about you, or to have it corrected or deleted, ask your organization; we help it answer.
Your right to object
You can object at any time, on grounds relating to your particular situation, to any processing we base on our legitimate interests, including visitor statistics, page-speed measurements, error reports and security logs. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish or defend legal claims.
How to make a request
Email privacy@tinyteam.io. To make sure the data is yours, please write from the email address of your Tiny Team account, or tell us how else we can confirm who you are. For data an organization keeps in its workspace, we act on that organization's instructions, so we will pass your request on to it, usually through its administrators, and help it respond.
We will reply within one month. If a request is complex, we may extend this by up to two more months and will tell you why. Requests are free unless they are clearly unfounded or excessive. Some data can't be deleted straight away, for example records we must keep for tax purposes. If we can't do what you ask, we will tell you why.
Complaints
You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the data protection authority in the EU country where you live or work. We would appreciate the chance to sort it out with you first.
Cookies and similar technologies
We set no advertising or tracking cookies, and none of the cookies or storage items we set ourselves need your consent, so there is no cookie banner. The ones listed below sign you in, keep a protected link unlocked or remember a choice you made in the app. Services we use, such as Google sign-in and YouTube, can also read or set their own, as described below.
On our website
Our website sets no cookies and stores nothing in your browser. Fathom uses no cookies; its script only checks your browser for one local storage item (blockFathomTracking), which exists only if a site owner has excluded their own visits. If you play a YouTube video, Google may set cookies (see "Embedded YouTube videos").
In the app
| Name | Type | What it does | How long |
|---|---|---|---|
| access_token | Cookie | Keeps you signed in | Up to 360 days. Signing out makes it invalid. |
| access_token | Local storage | A copy of the same sign-in token | Until you sign out |
| tinyteam:active-module:v1 (followed by an ID) | Local storage | Remembers which module you last opened | Until you clear your site data |
| sidebar_state | Cookie | Remembers whether the sidebar is open | 7 days |
The sign-in cookie is set for app.tinyteam.io and can also be set for tinyteam.io and its subdomains; our website doesn't read it.
Other services the app uses:
- Google sign-in, on the sign-in and registration pages: Google's script loads when the page opens. Google may read and set its own cookies, and may set a cookie on app.tinyteam.io that remembers the state of its sign-in prompt.
- Google Fonts, on every page: no cookies that we know of, but Google receives your IP address.
- YouTube videos in Document Spaces pages and job posts load the YouTube player as soon as you open the page, which gives Google your IP address and browser details. Depending on how the video was added, the player comes from youtube-nocookie.com or from youtube.com, and once it has loaded Google may set cookies or similar storage in your browser, even before you press play.
- Polar's checkout on polar.sh sets its own cookies.
On short links
| Name | Type | What it does | How long |
|---|---|---|---|
| tinyteam_link_unlock | Cookie | Remembers that you entered the correct password for a protected link. It applies to that link only and contains no personal data. | 15 minutes |
Short links set no other cookies, and click statistics use none.
You can delete cookies and site data in your browser settings at any time. If you delete the sign-in cookie and token, you will need to sign in again.
What you have to give us
To create or join a workspace, you need an email address or a Google account. Without one, we can't create your account. Your organization may ask you for other profile details; that is between you and your organization.
To buy a module, Polar needs the administrator's email address and payment and billing details. Without them you can't buy.
To apply for a job through a careers page, the form needs your name, email address and resume. The organization decides what else it asks for in its hiring process.
Visiting our website or opening a short link needs nothing from you beyond the technical data described above, which every connection on the internet involves.
Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects for you. Tiny Team doesn't score or rank candidates or employees. Time-off requests are approved by a person; someone with approval rights can approve a request in the same step as filing it. Scheduled tasks do bookkeeping, such as adding and carrying over leave days, starting review cycles an organization has planned, and removing expired data. Where an organization has asked us to, a scheduled task also moves its candidates to another of its hiring statuses, such as its archive, a set number of months after they were added. It doesn't delete or contact anyone. Recognising bots on short links is automatic, but it only decides whether a click is counted.
Children
Tiny Team and our website are not directed at children under 16. To create a workspace or buy a module you must be at least 18. Organizations are responsible for the data they keep about young employees or applicants. If you believe a child has given us personal data, email privacy@tinyteam.io and we will delete it.
Security
- All connections to our website, the app, our API and short links use HTTPS (TLS). Plain HTTP requests are redirected to HTTPS.
- Our server works out your organization from your sign-in, not from what your browser sends, and is built to limit each request to that organization's data. Inside your organization, access follows the roles your administrators assign, except where "Who in your organization sees what" says otherwise.
- Uploaded files are kept in private storage that is encrypted at rest and shown only through signed links that expire, except document images (see "Files and uploads").
- Our job queue is encrypted at rest and in transit.
- Sign-in links work once and expire after 15 minutes. Deactivating or deleting a member ends all their sessions, and signing out ends yours on every device.
- Short-link passwords are stored only as secure hashes, and short-link clicks only with daily changing visitor codes.
- We limit how many requests can be made in a short time, to protect the service, short links and link passwords from abuse.
- Support sessions need a reason, end after 30 minutes and are logged. Our own admin sessions expire after 12 hours.
- Tiny Team runs on infrastructure we also use for our other products. Each record belongs to one product and one organization.
No system is perfectly secure. Records in our database, including bank details and pay history, are protected by access controls rather than by separate encryption of each field. Your sign-in token is stored in your browser, so sign out when you use a shared computer. If a security incident affects personal data in an organization's workspace, we tell that organization's administrators without undue delay and give them the information they need to notify their supervisory authority and the people affected. If an incident affects personal data we control, such as accounts, purchase records or our server logs, we notify the CNPD and, where the risk to you is high, we tell you, as the law requires.
Changes to this policy
When we change how we handle personal data, we update this policy and the date at the top. If a change significantly affects data we already hold, we will announce it on our website and email organization administrators before it takes effect.
Contact
- Iaroslav Morgunov (Tiny Team), Rua Alfredo Keil 571, 4150-047 Porto, Portugal
- Privacy: privacy@tinyteam.io
- Support: support@tinyteam.io
- Phone: +351 924331054
Our Terms of Service explain the rules for using Tiny Team.