Privacy policy

This policy explains which personal data Melancer processes, why, on which legal basis, and for how long.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

MeetAgain UG (haftungsbeschränkt)
Urbanstrasse 96
10967 Berlin
Germany
Email: contact@meetagain.org
Contact form: https://meetagain.org/en/contact

We are not required by law to appoint a data protection officer.

2. What we process and why

2.1 Server log files

Every request to Melancer passes through our web server, which writes an access log. It records your IP address, the date and time, the requested address, the response status and size, and the request headers your browser sends, such as the browser type and the page you came from. We need it to run the site securely, to find errors and to fend off attacks.

When something goes wrong, the application also writes an error log: what failed and when, the address requested, and your user ID if you were signed in. An error message can contain the data being processed at that moment.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and stable service. Retention: both logs are deleted after 7 days.

2.2 Your account

For your account we store your name, your email address, a hash of your password (never the password itself), your language and your timezone. If you turn on two-factor sign-in, we also store its secret key and your recovery codes, both encrypted, and when you turned it on.

Legal basis: Art. 6(1)(b) GDPR, because we need this data to provide the service you signed up for. Retention: as long as your account exists. You can delete your account yourself, under Settings, Your data: it is erased at once, with all its data and files. Our backups can keep a copy for longer (section 2.10).

2.3 Business profile and invoice settings

If you fill in your business profile, we store what you enter there: your business name and address, your tax number and VAT ID, your default currency, your monthly income goal if you set one, and your logo if you upload one. These are your own business details, which Melancer uses for your invoices and reports. The income goal appears only on your own dashboard.

Your invoice settings hold your bank details (IBAN, BIC, account holder and bank), which are printed on your invoices, and your number pattern, payment terms, invoice language and invoice texts.

Your tax settings hold your default tax mode and VAT rate, whether your VAT is due on agreed or on received amounts (Soll or Ist), how often you file your VAT return, and for the DATEV export your chart of accounts, your tax advisor's advisor and client numbers, the start of your financial year and your account length. We also store the monthly exchange rates you enter, which convert amounts in other currencies to euros for your VAT figures.

Legal basis: Art. 6(1)(b) GDPR. Retention: until you change them, or until your account is erased.

2.4 Your work data

You can keep your clients, their projects and the time you work for them in Melancer. For a client, that is their name, contact person, email address, phone number, billing address, VAT ID, rate, debtor account for the DATEV export and your notes. For a project, it is its name, status, rates, budget and the address of your ticket system. For the time you track, it is when you worked, on which project, your description, the ticket reference, and whether the time is billable.

You can import your time from another time tracker's CSV export. We read the file once, while you upload it, and never store it. Until you confirm the preview, we keep the rows we read from it, and delete them after a day if you don't. For each import we keep a record of what it brought in: the tool, the file's name, your choices, which rows were skipped and why, and the clients and projects it created, so that you can undo it. The imported time is then work data like any other, and imported time your old tool had already invoiced is marked as billed elsewhere.

For an invoice, it is its lines, number, dates and totals, the payments you record, and a log of when it was issued, sent, paid or cancelled. When you issue an invoice, we store a copy of your business details and bank details and of your client's billing details as they are at that moment, so the invoice never changes afterwards. The issued invoice is also stored as a PDF file, with a checksum that shows it hasn't changed. The accounting export for your tax advisor is a file you download yourself, and we send it to nobody.

For an expense, it is the date and amount on your supplier's invoice, the supplier's name, your description, the category, the VAT and whether you deduct it as input tax, the client or project it was for, and the invoice line that billed it back. You can upload one receipt per expense, a PDF or an image, and we store that file as you uploaded it. What a receipt shows is whatever your supplier printed on it, which can name people; it is your own document and you decide what you upload. A receipt is served only through a short-lived signed link, and it is in both your accounting export and your data export.

An issued invoice can't be deleted, only cancelled, because tax law requires you to keep invoices unchanged. We keep your invoices and your receipts until your account is erased. The statutory retention duty is yours, not ours: download your invoices, or your whole data export, before you delete your account.

You decide what you store about your clients, and you are responsible for it as the controller. That includes descriptions and ticket references, which can name people. We process it on your behalf and only to provide Melancer to you. We don't use it for anything else. Nobody receives it apart from our hosting provider, our email provider for the emails you send to your clients (see sections 2.7 and 3), and whoever opens a report link you share (section 2.8).

Retention: until you delete it, or until your account is erased. Backups are covered in section 2.10.

2.5 Cookies

Melancer sets only these cookies:

All of them are technically necessary to provide the service you ask for (§ 25(2) no. 2 TDDDG), so we don't ask for your consent. The session itself is stored on our server together with your IP address and your browser's user agent, and it ends 2 hours after your last activity. Your Security settings list your sessions with their IP address and browser, and can sign out the others. The report pages you share with your clients (section 2.8) set no cookies and start no session.

Legal basis: Art. 6(1)(b) GDPR while you use your account, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in protecting our forms.

2.6 Account emails

We send you only the emails that belong to your account. They come from noreply@melancer.com and are delivered by Sweego (see section 3), which receives your email address and the content of the message. We send no newsletters and no advertising.

There are two kinds:

• The emails your account needs: the link to confirm your email address, and password reset links when you ask for one. A password reset link expires after 60 minutes. Legal basis: Art. 6(1)(b) GDPR.
• Notifications about your own work: a summary of your week every Monday, a note when one of your invoices passes its due date, and a note when a project reaches or passes its budget. They repeat figures from your work data (section 2.4) and name your projects, clients and invoices. We never write to your clients about this; sending a reminder stays yours to do. You choose which of them we send, and at which hour of your day, under Settings, Notifications, and switching one off stops it at once. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a tool that tells you what your account needs from you.

Each notification is also kept in the app, under Notifications, with the figures it was built from. Those entries are deleted after 6 months, or when you delete your account.

2.7 Emails you send to your clients

When you send an invoice, a cancellation invoice or a payment reminder from Melancer, we send the email on your behalf. It comes from noreply@melancer.com under your business name, and replies go to your own email address. Sweego (see section 3) delivers it and receives the recipient's email address, the subject, your message and the attached invoice PDF. If you ask for a copy, it also goes to your email address.

We log each send on the invoice: when, to whom, and with which subject. The recipient is your client, so as with your other work data (section 2.4), you are the controller and we process it on your behalf.

Legal basis: Art. 6(1)(b) GDPR towards you. Retention: the log stays with the invoice, until your account is erased.

2.8 Reports you share

You can share a read-only report of your work for one client through a link. Anyone who has the link can open the report without signing in. It names your business and your client, and shows the part of your work data you chose for it: the hours per project, ticket and day and, if you switch them on, the value at your rates, the entries with their descriptions, and your projects' budgets.

For each link we store its settings: the client and projects it covers, its days, what it shows, its language, when it expires or was revoked, and when it was last opened. The link's address contains a random code, which we store only encrypted and look up by its hash.

If a link freezes finished periods, we also store each frozen period's report as it was shown: the names of your business and client at that moment, the hours, and the values, entries and budgets, including the ones the link doesn't show, so that switching one on later shows its frozen values. A frozen report never changes; a revision is stored next to it. Frozen reports are kept until you delete their link, or until your account is erased.

About the people who open a report, Melancer stores nothing: no IP address, no browser details and no count of visits. The report pages set no cookies and start no session. Like every request, a visit appears in the server log (section 2.1), including the link's address, and is deleted with it after 7 days. To slow down anyone trying codes at scale, we count the requests to report pages per IP address for one minute. The counter keeps the address only in hashed form and expires after that minute.

You decide what you share and with whom, so for the shared data you are the controller, as in section 2.4, and we process it on your behalf. Revoking a link stops it at once. Deleting it removes its settings and its frozen reports.

Legal basis: Art. 6(1)(b) GDPR towards you. For the server log and the request counter, Art. 6(1)(f) GDPR, our legitimate interest in a secure service. Retention: a link's settings and frozen reports are kept until you delete the link, or until your account is erased.

2.9 Password breach check

When you choose a new password, we check that it hasn't appeared in a known data breach, using the Pwned Passwords service of Have I Been Pwned. Our server computes the SHA-1 hash of the password and sends only the first 5 characters of that hash (k-anonymity), then compares the answer on our side. Your password, its full hash, your email address and your IP address never leave our server.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in protecting accounts against leaked passwords.

2.10 Backups

To protect against data loss we regularly back up the database and uploaded files, such as logos. The backups contain the data described in this section.

The backups are stored on our server in Germany and used only to recover from data loss.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in not losing your data. Retention: we keep the backups of the last 5 days, and the first backup of each month without a time limit. Data you delete, including an erased account, can therefore remain in a monthly backup.

2.11 Security log

So that you can see who used your account and how, we log the security-relevant actions on it: signing in and out, failed sign-ins, sign-ins paused after too many attempts, wrong two-factor codes and used recovery codes, changes to your password, email address and two-factor sign-in, signing out your other sessions, creating, revoking and deleting report links, creating and revoking API tokens, downloading the accounting export or your data export, and deleting clients and projects.

Each entry holds what happened and when, and the IP address and browser user agent of the request. Some entries add a detail: the old and new email address, the name of the client, project, report link or API token, or the export's period. A failed sign-in with your email address logs the IP address of whoever tried. Attempts on an email address without an account are not logged. Your Security settings show you the latest 50 entries.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping accounts secure. Retention: 12 months, or until your account is erased.

2.12 API tokens and the tools you connect

You can create personal access tokens, so that a script or an AI assistant you choose reaches your time data through our API or our MCP server. For each token we store the name you give it, what it may do, when it was created and when it was last used, and a hash of the token itself; the token is shown to you once and never stored in readable form. Requests made with a token are processed like your own use of the app.

Which tool you connect, and what it does with the data it reads from your account, is your choice. Data you send to that tool, such as your projects and tracked time sent to an AI assistant, is processed under that tool's terms and privacy policy, not ours. We send nothing to it on our own.

Legal basis: Art. 6(1)(b) GDPR, the performance of our contract with you. Retention: until you revoke the token, or until your account is erased.

3. Third-party services

These service providers process data on our behalf, under a data processing agreement (Art. 28 GDPR):

We use no analytics, no tracking and no advertising. Our pages load no fonts, scripts or other files from third parties: everything, including the font, is served from melancer.com itself. The password breach check (2.9) sends no personal data.

4. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data erased (Art. 17);
• have its processing restricted (Art. 18);
• receive your data in a structured, machine-readable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21).

Two of them you can exercise yourself, under Settings, Your data: download all your data as JSON files, with your logo and your invoice PDFs (Art. 20), and delete your account with everything in it (Art. 17).

For any of them, you can also email us at contact@meetagain.org. We answer within one month.

5. Right to lodge a complaint

You can complain to a data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany

6. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

7. Changes to this policy

We update this policy when Melancer changes what it processes. The date at the top shows the current version. If a change affects your account materially, we tell you by email.