Processing, providers and retention
Last reviewed 4 October 2026
Document version: timepilot-product-2026-10-04
This notice supplements the service schedule and product privacy notice. It describes the processing authorised when a Company uses timepilot, without promising a particular infrastructure region, backup deadline or service level.
Company instructions and provider roles
The Company decides which employment records to upload, who can access them and how outputs are used. RE Technologies processes those records to deliver the requested workflow and may also hold limited account, security and legal records for its own administration. Providers act within the purposes and permissions described here; their independently operated services have their own notices.
- Supabase: authentication, Company membership, database and private document storage.
- Cloudflare: DNS, encrypted website delivery, application execution, document rendering, request security and optional AI Excel column mapping using headings only.
- OpenRouter and the configured AI model provider: image/PDF extraction using rendered pages and targeted crops. Model choice may change within the configured suitable tiers; a change must retain the required privacy routing controls.
- Resend and the business mail service: enabled transactional or inbound email and support correspondence, including recipient or sender information and relevant message content.
- Sentry and PostHog: limited error diagnostics and consent-gated analytics respectively, without payroll/document content in telemetry.
Processing limits
Access and processing are limited to providing, securing and supporting timepilot and meeting lawful obligations. Customer records are not licensed for advertising or unrelated model training. Confidentiality and access restrictions apply to authorised personnel. We use reasonable measures to assess contracted providers and assist with verified access, correction, deletion and security requests.
Before enabling a new AI provider for customer records, its routing, retention and processing-location information must be assessed. A provider change that materially changes this notice requires an updated notice. Customers requiring a specific country or contractual processing restriction must obtain written confirmation before uploading; this notice does not promise Australia-only processing.
Active records and Company closure
Company records support ongoing review, correction and audit while the Company remains active. Completed batches may move to a read-only archive; archiving does not mean deletion. Administrators should remove unnecessary information and request earlier deletion where appropriate.
On a verified Company closure, future Company access and new intake or extraction are disabled. A private document link already issued can remain valid for up to 60 seconds, and an already-dispatched provider request cannot be recalled. Closure does not erase documents already downloaded or sent to a downstream recipient.
The default retention period for retained Company content is two calendar years after closure, for controlled recovery, access requests and disputes. Earlier deletion can be requested where lawful; a documented legal hold can delay deletion. Retained content is restricted from normal product use. At the end of the applicable period we arrange removal of originals, previews, active and archived timesheets, exports and related processing/audit content. A deletion process and evidence of completion are required; this policy is not a claim of instantaneous erasure.
Separate records and backups
Deleting an individual's sign-in identity or removing membership does not close a Company or erase the Company's employment records. Minimal closure, security, acceptance or legal records may be retained only for a documented necessary purpose or legal obligation and reviewed when that purpose ends. Marketing leads follow the separate marketing notice, not the product retention period.
Backup and disaster-recovery copies age out under the applicable provider schedule. We do not promise immediate removal from every backup. Restored data must be subject to the recorded closure and deletion instructions before it returns to normal use. Holds must identify a reason and be reviewed; they are not permission for indefinite general retention.
Data return and statutory records
Before requesting closure, export the records your Company needs and retain the original documents required for its obligations. After closure, an authorised representative may request retained information through privacy@timepilot.au; access is subject to verification, other people's rights, technical availability and lawful restrictions.
Two years after Company closure is a timepilot retention policy, not a statement of the employer's record-keeping duties. Fair Work guidance generally requires time and wages records for seven years. Your payroll or record-management system must preserve the required records independently.