Privacy Policy

SprintWatch.AI is operated by RANA Technologies Limited (company no. 08433262), England & Wales, which is the data controller for the personal data described in Section 2.

• Account data — your name, email address, and Entra External ID identifier, to authenticate you and operate your organization's workspace.
• Organization data — clients, projects, tickets, comments, and time entries your organization creates, plus role assignments and API keys.
• Approval & pay data — timesheet approvals, employee cost rates (visible only to Owner/Admin/Project Manager, and to each employee for their own rate), payment requests, and outstanding balances.
• AI conversation data — the text exchanged with the AI assistant, not the underlying database rows it drew on to answer — see Section 4 for the AI provider used.
• Push notification subscriptions — the Web Push endpoint and keys for devices you register, only if you opt in.
• Audit log — a record of sensitive actions across your organization (who did what, when), used for the activity feed, AI digests, and security auditing, retained for the life of the account.
• Billing data — handled by Stripe; we store your plan tier and usage counters, not your payment card details.

Ticket attachments, expense receipts, invoice PDFs, and avatars are stored in Azure Blob Storage, scoped to your organization and never publicly accessible. Financial records — expense receipts and invoices — are retained for 6 years after creation to meet standard UK recordkeeping requirements, even after your organization is deleted (see Section 5). Everything else is deleted when the entity it belongs to is deleted.

If a file you upload contains personal data about someone else — a client's contact details on an invoice, for example — RANA Technologies acts as a data processor on your organization's behalf as data controller for that information, under UK GDPR.

• Microsoft Azure — hosting, database, storage, and infrastructure.
• Microsoft Entra External ID — authentication.
• Azure OpenAI Service — natural-language time entry parsing, conversational Q&A, and digest generation. Retrieval is scoped by your organization's own permission system before anything reaches the model.
• Stripe — our own subscription billing, and, separately, your organization's own connected Stripe account if you choose to collect client payments through the Service.
• Web Push (VAPID) — push notification delivery, via your browser's own push service, not a separate analytics SDK.

Deleting your organization is a deliberate action with a minimum 30-day grace period before anything is destroyed, and you receive a full export of your data before deletion proceeds. Once deletion proceeds, most data is genuinely removed.

Financial records — expense receipts, invoices, and their line items — are the one exception: they move to an archived, access-restricted state and are retained for 6 years from creation to meet standard UK recordkeeping requirements, then permanently purged. Everything else is retained for the life of your account.

SprintWatch.AI does not use analytics or advertising cookies. Sign-in uses browser storage to hold your authentication session, which is strictly necessary for the Service to function — no cookie consent banner is shown because no non-essential cookies are set. If that changes, this page and a consent banner will be updated together.

Subject to applicable law, you can request access to, correction of, or deletion of your personal data, and can object to or restrict certain processing. Contact us using the details in Section 8. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

Questions about this policy or a data request: ranatechnologies.uk