OrettaStart free

Oretta by HEHE.studio privacy policy (English)

Last updated 29 October 2026

1. Who is who

Oretta is time-tracking software for small studios. Two roles matter here.

  • Your studio (your employer or client) is the controller of what you enter into Oretta: time entries, projects, clients, rates, person costs. Oretta processes it on the studio's behalf as a processor, under a data processing agreement. Take questions about that data, including the rights in section 8, to your studio first. Oretta cannot act on requests about studio data without the studio's instruction.
  • HEHE.studio is the controller of the data needed to run accounts and billing: the email and name of the person who sets up or administers a studio, invoicing details, correspondence, security logs, and data about visitors to oretta.app.

Controller: Oretta by HEHE.studio, operated by HEHE.studio Marcin Michalak, a sole proprietorship registered in CEIDG, ul. Na Miasteczku 12C/255, 61-144 Poznań, Poland, VAT ID / NIP PL7773193269. Contact for data matters: contact@oretta.app. Data protection officer: none appointed.

2. What data and why

Data Why Legal basis (GDPR)
Email, name, role, account state; password hash (the password is stored and hashed by Supabase's login service) Account and sign-in For HEHE.studio as controller (a studio admin's account): Art. 6(1)(b), contract. For people added by a studio: the studio is the controller and sets the legal basis
Time entries (project, task, tags, description, start and stop), clients, projects, budgets, hourly rates Running the product: reports, budgets, export As above; the studio's side
Person costs (an hourly cost or, optionally, a monthly salary), entered only if the studio chooses to and visible only to studio admins Margin in reports As above. This is pay data: not an Art. 9 special category, but sensitive in practice
API tokens (personal, for Claude and the extension) Authenticating API clients As above
Studio logo, settings, the studio's Slack token (when an admin connects Slack) PDF reports with the logo, the daily Slack report As above
IP address, request headers, function and error logs Operation, security, diagnostics Art. 6(1)(f), our interest in security and stability
Browser signals on the signup page (Vercel BotID) Protecting the signup form from bots Art. 6(1)(f) GDPR (security of the service)
Invoicing details (including the NIP or EU VAT ID), payment history Billing, accounting Art. 6(1)(b) and (c), tax and accounting duties
Correspondence (emails to us) Replies, support Art. 6(1)(f)
Visit statistics for the public pages (DataFast, see below) Knowing which pages and traffic sources work Art. 6(1)(f), our interest in improving the site

What we do not collect: screenshots, recordings, activity tracking, location, idle detection. Oretta counts hours; it does not watch people. The studio app runs no analytics or advertising scripts; the public pages run only the cookieless analytics described below.

Website analytics. On the public pages (home, blog, changelog, sign-in, signup, legal pages) we count visits with DataFast in cookieless mode. It does not run in the studio app (/<studio>/… addresses) or on the email link page (/auth/confirm): events pass through our server (/api/events), which forwards only those from public pages to DataFast and removes a referrer that points into the app. DataFast receives the page address, referrer, browser, operating system, screen size, language, time zone and the IP address, from which it derives the country and a pseudonymous visitor ID (a hash of IP, browser, domain and a salt that rotates about every 24 hours, so visits on different days cannot be linked). The script sets no cookies and writes nothing to localStorage; it keeps the current session's ID in the tab's sessionStorage, which is cleared when the tab closes. Retention: 24 months, then we delete older data; sooner on request. Legal basis: Art. 6(1)(f) GDPR.

Signup protection (Vercel BotID). Only on the signup page (/signup), the Vercel BotID script checks in the browser that a person is sending the form: it collects technical browser and device signals and passes them with the submitted form to Vercel, which assesses whether it is a bot. The result is used only to accept or reject the signup. Legal basis: Art. 6(1)(f) GDPR (our interest in protecting the service from automated account creation).

The Chrome extension talks only to the studio's Oretta address (oretta.app by default; another address only if you allow it). The Trello button is off by default. Once enabled, and only on click, it reads the open card's title, board name and link; only the title reaches Oretta, as the entry description. The board name and link stay in the browser.

Claude (MCP). Oretta sends nothing to Anthropic. If you connect your own Claude client to Oretta with a personal token, the data you ask for goes to your Claude client at your request and falls under Anthropic's terms with you. The token gives access within your role.

3. Who receives the data

Processors are named on the subprocessor list: Vercel (including BotID on the signup page), Supabase, Cloudflare R2, GitHub Actions, DataFast for the public pages only; Slack only when a studio connects it. We do not sell data and do not use it for advertising or for training models. We may disclose data to authorities where the law requires it.

4. Where the data is

Database: Supabase, Ireland (eu-west-1). Application functions: Vercel, Dublin (dub1). Backups: Cloudflare R2, encrypted before upload. The studio database is stored in the EU. Data may leave the EEA in these places: Vercel's content network and logs are global, so IP addresses and headers may pass through servers outside the EU; visit statistics for the public pages are processed by DataFast (Singapore, infrastructure mostly in the US); the backup job runs on GitHub (Actions) machines with no pinned region, where the database dump sits in memory before it is encrypted; Slack, if a studio connects it, runs under the studio's own contract.

Transfers outside the EEA. Where a vendor processes data outside the EEA, its data processing agreement (DPA) describes this transfer mechanism:

  • Vercel: the DPA incorporates the 2021 SCCs (decision 2021/914) for EEA transfers; it does not rely on the Data Privacy Framework.
  • Supabase: the DPA incorporates the SCCs (module two, controller to processor).
  • Cloudflare: the DPA incorporates the SCCs; Cloudflare is also certified under the EU-US Data Privacy Framework.
  • Slack (only when a studio connects it; this is the studio's own contract with Slack): SCCs and the DPF, per Slack's page.
  • DataFast (public-page statistics only): JustShipIt Pte. Ltd., Singapore; infrastructure "mostly outside the EU, including in the United States". The DPA incorporates no SCCs of its own and relies on its subprocessors' compliance, "including GDPR Standard Contractual Clauses where relevant".

Sources and access dates: see "Sources".

5. How long

  • Studio data: until the contract ends, then per the data processing agreement (export, deletion). An account can be deactivated ("active" unticked), which keeps that person's history in reports. We delete a studio or a person on request within 30 days.
  • Backups: the 8 newest weekly dumps (about 8 weeks) in R2 and Supabase's daily backups for 7 days. Deleted data leaves the backups within that time.
  • Logs: up to 30 days; Vercel and Supabase may delete them sooner, per their plan settings.
  • Visit statistics (DataFast): 24 months.
  • Correspondence: 3 years from the last message.
  • Billing records: 5 years from the end of the tax year (tax and accounting law).

6. Cookies

Only necessary or functional cookies; no analytics or advertising cookies (the public-page analytics is cookieless, see section 2):

Cookie Purpose Lifetime
Sign-in session (set by Supabase's login service; name starts with sb-) Keeping you signed in per Supabase session settings
lang Remembers language (PL/EN), set when you choose 1 year
theme Remembers light or dark theme, set when you choose 1 year
Slack OAuth state Protects the Slack connection flow, admins only 10 minutes

The signup page also runs the Vercel BotID script (section 2), which reads browser signals only to protect the form.

7. Security

Data access is separated in the database itself (Row Level Security): each studio sees only its own data, a person sees their own entries, a team lead the team's, and only admins see rates and costs. API tokens are stored in the database as a SHA-256 hash. Backups are encrypted (age) before upload. Connections use HTTPS. We hold no security certification (such as ISO 27001 or SOC 2) and do not claim one.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR), and, where we rely on consent, to withdraw it. Right to object. You may object at any time to processing based on our legitimate interest (visit statistics, security, correspondence) by writing to contact@oretta.app.

A studio admin can download all of the studio's data as one ZIP of CSV files (Export in the app). You may complain to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, Warsaw. We take no solely automated decisions, including profiling.

9. Changes

We tell studio admins by email about material changes. The current version is at oretta.app/privacy; we send earlier versions on request to contact@oretta.app.

Sources (accessed 2026-10-27)

v1.7.0