This policy explains what personal data Atend processes, why, and the rights you have under the EU General Data Protection Regulation (GDPR). Atend is built on a simple principle: we record what youdid, never the content of your work.
1. Controller
ClarityBuilds Ltd, Centris Business Gateway, Level 4/W, Triq is-Salib tal-Imrieħel, Zone 3, Central Business District, Birkirkara CBD 3020, Malta. Email: info@claritybuilds.net. Given our size and the nature of our processing, we are not required to appoint a Data Protection Officer; privacy enquiries go to the address above.
2. What we process
- Account data: your name, email, workspace and team membership. Atend is passwordless: there is no password, and sign-in is handled by our identity provider (see Processors below).
- Captured activity metadata: idle/active state, the name (not contents) of the foreground application, whether a tracked agent or process was running, start/end times, and the project a block is attributed to. Outside the optional recap and browser-attribution features below, we do not collect keystrokes, screenshots, screen contents, document or message contents, full web addresses, a browsing-history log, webcam, microphone, or location.
- Browser attribution (optional, off by default): if you turn on browser attribution in the extension, Atend reads the host of the active browser tab only (for example
acme.com) so browser time can be attributed to the right client. The path, query and fragment of the address are discarded on your device before anything is sent, and your on-device private-domains list suppresses any domain you mark private (nothing is sent for it). Only the bare domain and the start/end times leave your machine, never the full URL, never page contents, and no browsing-history log is stored. It is off until you switch it on. - AI attending time (on supported AI chat sites): on the AI chat sites the extension supports, Atend records the site's host (for example
claude.ai) together with start/end times, so the time you spend attending a running AI assistant counts as worked time. This is metadata only: the host and timestamps, never the conversation content (that is the separate Recap feature below). - Recap (optional, active once you connect the extension): when the extension is connected on a supported AI chat site, text derived from your AI chats is used to generate short bullet-point summaries of what you got done. Secrets are stripped in your browser first, the text is sent to the configured AI provider only to produce the bullets, and only the bullet points you keep are stored, never the raw chat.
- Billing data: the company name, address, and VAT identification number we need to issue invoices. We invoice directly and receive payment by bank transfer. We do notcollect or store card details.
- Technical data: server logs, IP address, and device identifiers needed to run and secure the service.
3. Purposes & legal bases
- Providing the service (account, capture, classification, invoicing): performance of a contract, Art. 6(1)(b).
- Security, abuse prevention, and service improvement: legitimate interests, Art. 6(1)(f).
- Any marketing emails you opt into: your consent, Art. 6(1)(a), withdrawable at any time.
4. Processors & sub-processors
We use a limited set of processors under data-processing agreements:
- Hosting: Microsoft Azure, EU region (Germany West Central). Your data is stored in the EU.
- Identity & sign-in: Auth0 (operated by Okta), EU region, for passwordless email sign-in and Google sign-in. Your sign-in identity data (email, name, login events) is stored in the EU (Frankfurt): we deliberately chose the EU-region tenant so your identity data stays in Europe. As Auth0 is operated by a US company, some support and operational access may occur under its Data Processing Agreement, which relies on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Transactional email: IONOS (EU), for account emails such as welcome messages and team invites. (Passwordless sign-in emails are sent by our identity provider; see Identity & sign-in above.)
- Payments: we invoice directly; payment is received via our business bank. No card data passes through Atend.
- Analytics: Plausible Analytics (EU-hosted), a privacy-friendly, cookieless web analytics service. It measures aggregate usage (page views, referrers, and conversion events such as sign-ups) without cookies and without tracking or identifying you across sites.
- AI features (optional): when you use an AI feature (the recap summary, ✨ descriptions, or project suggestions) the relevant text is sent to an AI provider to generate the result. Depending on configuration this is OpenAI, Anthropic, or Google (or, if you bring your own key, the provider you choose). For the browser extension's recap, chat text is stripped of secrets in your browser first; only the resulting bullet points are stored. AI features are off by default.
We use no advertising trackers. Your core account and time data is hosted in the EU (Azure) and web analytics is processed in the EU (Plausible). The optional AI features are the exception: to generate summaries and descriptions, text is sent to the configured AI provider, which may process it outside the EU (e.g. in the United States). Where that provider is US-based, the transfer relies on the provider's EU-US Data Privacy Framework certification or, failing that, the EU Standard Contractual Clauses. If you do not use AI features, no such transfer takes place. We will keep this policy updated as our processors change.
5. Retention
We keep account and activity data for as long as your account is active, and delete or anonymise it within 30 days of account closure, except where longer retention is legally required (e.g. invoices, which Maltese law requires us to keep for the statutory period).
6. Your rights
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. You can export and delete your data from within the app at any time. You may also lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (IDPC).
7. Cookies
The application uses only the strictly necessary cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies.
8. Changes
We will post material changes here and, where appropriate, notify you by email. Contact: info@claritybuilds.net.