Privacy Policy

1. Who we are
2. Our role: customer data vs. our own data
3. What the TeamLens agent captures
4. Other data we collect
5. Why we use it
6. Legal basis
7. Who we share it with
8. Where data is stored
9. How long we keep it
10. Your rights
11. Grievance officer
12. Security
13. Children
14. Changes

1. Who we are

TeamLens is a workforce-visibility product (time tracking, activity, screenshots, timesheets, leave and reports) made by Stirring Minds Services Private Limited (CIN U93090DL2017PTC318023), 2nd Floor, 2-A/3, Kundan Mansion, Asaf Ali Road, New Delhi - 110002, India ("TeamLens", "we", "us"). This policy covers teamlens.ai, the TeamLens web app (app.teamlens.ai), the TeamLens desktop agents for macOS, Windows and Linux, the mobile apps, the API, the CLI and MCP access. Questions: info@teamlens.ai.

2. Our role: customer data vs. our own data

Data about the people a customer monitors. When an organisation (an employer or team, "the customer") uses TeamLens to record the work of its employees or contractors, the customer decides what is recorded and why. For that data the customer is the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU/UK GDPR. We are the customer's data processor: we process it only on the customer's instructions, under our Terms and Data Processing Agreement. If you are an employee and want to see, correct or delete data your employer records through TeamLens, ask your employer first; we will help them answer you, and you can also write to us.

Our own data. For account holders' sign-up and login details, billing contacts, support conversations, emails you send us and visits to teamlens.ai, we are the data fiduciary / controller.

3. What the TeamLens agent captures

The desktop agent is visible while it runs. Before recording starts, the person being recorded is shown a notice listing exactly what their organisation's settings capture, and their acknowledgement is recorded with the time and the notice version. Depending on those settings, the agent and apps capture:

• Work sessions: clock-in and clock-out times, breaks, idle and active time.
• App and website use: which applications and websites are used, and for how long.
• Activity levels: counts of keystrokes and mouse movement. TeamLens does not record which keys are pressed.
• Screenshots of the screen at intervals, optionally blurred before anyone views them.
• Optional, only if the organisation switches them on: screen recordings; a live view of the screen; reading text visible on screen; and, in the mobile app, location sharing for attendance, which the employee turns on themselves.
• AI summaries: unless the organisation turns this off, screenshots are sent to an AI model run by a sub-processor (see section 7), which describes what was being worked on and extracts some visible text. The description and text are stored.
• Device and app details needed to run the agent: device name, operating system, agent version and diagnostic logs.

Apps an organisation excludes are not recorded. People who are recorded can see what is held about them, and who can view it, from their own profile.

4. Other data we collect

• Account data: name, work email, role, organisation, password (stored only as a one-way hash) and optional two-factor authentication settings. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Billing data: plan, number of users, billing contact and country, tax details (such as a GSTIN) and invoices. Card and payment details are collected by our payment provider, which acts as merchant of record; we never see full card numbers.
• Support data: what you write to us by email or in the support chat.
• Website data: basic server and security logs (IP address, browser, pages requested) kept by our hosting and network providers.

5. Why we use it

• To provide TeamLens to the customer: dashboards, timesheets, attendance, leave, payroll exports, reports and AI summaries.
• To run accounts, sign-in and security (for example detecting abuse and rate-limiting logins).
• To bill customers and meet tax and accounting duties.
• To answer support requests and send service emails (sign-up, invitations, password resets, billing notices).
• To keep the service reliable and to fix bugs.

We do not sell personal data, use it for advertising, or use customer workspace data to train AI models.

6. Legal basis

India (DPDP Act). For our own data we rely on your consent (given when you sign up or contact us) and on legitimate uses permitted by section 7 of the DPDP Act, such as compliance with law. For monitoring data, the customer, as data fiduciary, determines the lawful ground, for example employment-related legitimate use under section 7(i), and is responsible for giving its people notice.

EU / UK (GDPR). For our own data we rely on performance of a contract (running your account), legitimate interests (security, service improvement, answering enquiries), legal obligation (tax, accounting) and, where required, consent. For monitoring data the customer, as controller, chooses and documents the lawful basis and any data protection impact assessment.

7. Who we share it with

We share personal data only with the service providers we use to run TeamLens (our sub-processors), when the law requires it, or to protect people and the service. The current list of sub-processors, what each does and where, is published in our DPA. In short: our server host (Hetzner, Finland), our network and AI-inference provider (Cloudflare), our email provider (Resend), our payment provider (Dodo Payments), Google (Google sign-in and map look-ups) and the host of our self-hosted support chat (Hostinger, India).

8. Where data is stored and transfers

The TeamLens app, its databases and screenshot storage run on a dedicated server in a data centre in Helsinki, Finland (EU). Some providers listed above process data in other countries, including India and the United States. Where the GDPR applies we rely on the EU Standard Contractual Clauses or another lawful transfer mechanism. Under the DPDP Act, transfers outside India are permitted except to countries the Government of India restricts.

9. How long we keep it

• Screenshots and screen recordings: deleted automatically after 30 days by default. Organisation admins can change this window.
• Work sessions, app and website use, and activity levels: kept while the customer's workspace exists, until the customer deletes them, so timesheets and payroll stay auditable.
• Account data: kept while the account is active, then deleted or anonymised after closure, except what we must keep by law.
• Billing records: kept for as long as Indian tax and company law requires (generally 8 years).
• Backups: database backups are overwritten on a rolling schedule, so deleted data leaves our backups within a limited period.

When a customer closes its workspace, we delete its workspace data as set out in the DPA.

10. Your rights

Depending on where you are, you can ask to: access a summary of your personal data and how it's processed; correct, complete or update it; erase it; withdraw consent (this doesn't affect processing that has already happened); nominate someone to exercise your rights if you die or become incapacitated (DPDP Act); and, under the GDPR, restrict or object to processing and receive a portable copy.

Email info@teamlens.ai from the address on your account. We reply within 30 days. If your request is about data your employer records through TeamLens, we will pass it to your employer and help them respond. If you're not satisfied, you can complain to the Data Protection Board of India (once it accepts complaints) or to your local data protection authority in the EU/UK. Under the DPDP Act, please contact our grievance officer first.

11. Grievance officer

Grievance Officer (DPDP Act 2023 / IT Rules 2011)
Stirring Minds Services Private Limited
2nd Floor, 2-A/3, Kundan Mansion, Asaf Ali Road, New Delhi - 110002, India
Email: info@teamlens.ai (subject: "Grievance")
We acknowledge grievances within 48 hours and resolve them within 30 days.

12. Security

We describe what protects data today, and what isn't in place yet, on our Security page. If we have a personal data breach, we notify affected customers without undue delay, report to CERT-In within 6 hours as Indian law requires, and notify the Data Protection Board and affected people as the DPDP Act requires.

13. Children

TeamLens is a workplace product for adults. It is not meant for anyone under 18, and customers must not use it to monitor children.

14. Changes

If we change this policy in a way that matters, we will update the date at the top and tell account holders by email or in the app before the change takes effect.