Skip to content
WaClock

Last updated October 21, 2026

Privacy Policy

WaClock is a time clock for hourly crews in the US. It is operated from Israel ("WaClock", "we", "us"). This policy explains what we collect, why we collect it, where it is kept and what you can do about it.

Who this policy covers

Employers are the businesses that sign up for WaClock and the managers they invite. Workers are the employees whose hours are tracked. Visitors are people who use the waclock.com website, including its chat assistant. Ad leads are people who ask about WaClock through a lead form in one of our ads on Meta's apps. For worker data, the employer decides what is collected and why, and WaClock processes it on the employer's behalf as a service provider (a processor) under our agreement with the employer, as the California Consumer Privacy Act and similar laws describe. For employer account data, visitor data and ad leads, WaClock decides how it is used.

What we collect

  • Employer account details: company name, the name and email of each owner or manager, a password (stored only as a one-way hash), the US state and timezone used for overtime rules, and billing status. If an owner or manager gives a mobile number for WhatsApp or connects one there, we keep that number and the WhatsApp profile name shown with their messages.
  • Signup source: when the link someone follows to sign up carries it, the ad, campaign or page that brought the business to WaClock.
  • Sign in with Google: if an owner or manager chooses it, Google sends us their name and email address, and that person can sign in without a WaClock password. We send Google nothing, and we never see the Google password. WaClock keeps the profile picture link Google provides and shows it only inside the app. Showing it loads the picture from Google's servers. Using it is optional.
  • Worker details entered by the employer: name, mobile number, preferred language and, if the employer chooses, an hourly rate.
  • Time records: each clock-in and clock-out, its time and how it was made (such as WhatsApp or the clock link), corrections made by managers together with who made them and when, fixes workers make with the buttons on their WhatsApp card, times workers report themselves, and day labels such as sick, vacation or holiday.
  • Messages: the WhatsApp messages workers send to the WaClock number, the buttons they tap, and our replies and reminders. We keep them with the time records they produced, so each punch is processed exactly once and the employer can see how a punch was made.
  • Alert settings: the email addresses and WhatsApp numbers an employer chooses to receive alerts and the daily summary, with a name and language for each number, and when alerts are sent or paused.
  • Website chat: what visitors type into the chat assistant, as described in The AI chat assistant below.
  • Ad leads: if you fill in a lead form in one of our ads on Meta's apps, Meta sends us what you entered: your name, email address, phone number, company size and industry. We use it only to reply to your request. Meta's own terms and privacy policy apply to your use of its apps.
  • Payment details: handled by our payment processor. We never see or store full card numbers.
  • Technical data: IP address, browser type and error reports, used to keep the service secure and working.

What we do not collect

WaClock does not collect workers' location (it does not use GPS), biometrics such as fingerprints or face scans, Social Security numbers or bank details, and it does not monitor anything on a worker's phone. A punch records only the time and the channel used.

How we use it

  • To record time, build timesheets and calculate overtime for the employer.
  • To reply to workers' clock-in messages on WhatsApp, and to send the missed clock-out reminder unless the employer turns it off.
  • To send the alerts and the daily summary an employer turns on.
  • To run accounts, sign-in and billing, and to send service emails such as password resets, trial reminders, setup reminders and payment notices.
  • To let owners and managers sign up, sign in and add their crew on WhatsApp, and to send setup reminders by email, or on WhatsApp only inside a conversation they started in the last 24 hours, until setup is finished.
  • To answer questions through the website chat and by email.
  • To reply to people who ask about WaClock through a lead form in our ads.
  • To secure the service, prevent abuse and fix problems.
  • To meet legal obligations.

We do not sell personal information, and we do not use it for advertising.

Manager alerts and the daily summary

An employer can turn on alerts and a daily summary for its managers. On WhatsApp they go to the numbers the employer lists: a message when a worker clocks in or out or fixes a punch, and the daily summary. By email they go to the addresses the employer lists: a message when a worker clocks in or out or seems to have forgotten to clock out, and a copy of the daily summary if the employer wants one. Alerts contain the worker's name, the company name and the time of the punch or of the open shift. The daily summary contains how many people worked, their total hours, how many are still clocked in and how many need review. A WhatsApp number an employer lists gets nothing until the person agrees from that phone, by sending WaClock the ALERTS message and code the employer shares with them; we record when they agreed. They are part of the service the employer uses, not marketing. To stop receiving them, ask the account owner to remove your address or number, block the WaClock chat in WhatsApp, or write to support@waclock.com with the subject "unsubscribe alerts".

The AI chat assistant

The chat on waclock.com is an AI assistant, not a person. It answers questions about WaClock. It can be wrong, and it does not give legal, tax, payroll or employment advice. Using it is optional: you can always email support@waclock.com instead.

  • Who processes your messages: what you type passes through our website host, Vercel, in the United States and through the WaClock server in Vilnius, Lithuania, in the European Union, to an AI model that WaClock runs itself on a server in Israel, which produces the answer. No outside AI company receives your messages. The Subprocessors page lists the companies whose systems they pass through.
  • What we keep: when only the AI answers, WaClock does not store the conversation, on its servers or on the server that runs the AI model. Your browser holds it in the open page and forgets it when you close the page.
  • If you ask for a person: the conversation so far (up to the last 20 messages), the page you were on and anything you write after that are kept on our servers for up to 7 days and sent to the operator through Telegram, so a person can answer. If nobody is available, you can leave an email address, and the conversation is emailed to our support inbox so we can reply. The copies the operator receives in Telegram or by email are kept as long as needed to handle your request.
  • Your browser: to let a conversation with a person continue after a reload, the page keeps a session identifier in your browser's session storage. It is deleted when you close the tab.
  • Your IP address is used only to limit abuse of the chat. If you ask for a person, a scrambled (hashed) form of it is kept for up to one hour for that purpose and then deleted.
  • Please do not type passwords, Social Security numbers, health details or other sensitive information into the chat.

WhatsApp and mobile numbers

Workers' mobile numbers are used only to run clock-in on WhatsApp, as the WhatsApp Terms describe, and alert recipients' numbers only to send the alerts and summaries the employer turned on. Owners' and managers' numbers are used to sign them in, answer what they send, and send the alerts and setup reminders described here. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. WhatsApp messages travel through the WhatsApp Business Platform, which Meta runs for us as a service provider and which receives numbers and messages only to deliver them; WhatsApp's own terms and privacy policy also apply to your use of WhatsApp. Our business phone number is provided by Twilio, but WhatsApp messages do not pass through Twilio, and WaClock runs no text message (SMS) program.

Who processes data for us

We use these service providers to run WaClock and give each one only the information its service needs: Hostinger, Vercel, Meta (WhatsApp), Meta (lead ads), Twilio, Resend, ImprovMX, Email inbox provider, Telegram, Stripe, Google, Sentry. The Subprocessors page lists what each one does, the information it receives and where it processes it, with links to its own terms, and we update it before we add a new one.

We may also disclose information when the law requires it, to protect rights and safety, or as part of a sale or transfer of the business, in which case this policy continues to apply.

Notice at collection

This section lists each category of personal information we collect, where it comes from, why we collect it and how long we keep it.

  • Account identifiers: company name; the name and work email of each owner or manager; the mobile number an owner or manager enters at signup or connects on WhatsApp, and the WhatsApp profile name shown with their messages; and, for those who sign in with a password, the password stored only as a one-way hash. Source: the person who signs up and the managers they invite, Google when someone chooses Sign in with Google, and WhatsApp, when an owner signs up or connects WhatsApp there. Purpose: running the account, sign-in, security, service emails, sign-in links and alerts on WhatsApp, and billing. Kept: while the account is open; deleted or anonymized within 90 days after the employer asks us to delete the account, except what law requires us to keep.
  • Signup source: the ad, campaign or page that brought a business to sign up, from link parameters such as utm_source or a WhatsApp ad's id. Source: the link the person followed. Purpose: measuring which ads and pages work. Kept: while the account is open.
  • Worker identifiers: name, mobile number and preferred language. Source: the employer, and workers' own messages, including a request to join an employer's crew with its company code; a request that is declined or not approved within 14 days is deleted within 30 days. Purpose: matching each punch to the right worker and replying to clock-in messages. Kept: while the employer's account exists, including after a subscription ends so the employer can meet record-keeping laws; deleted or anonymized within 90 days after the employer asks us to delete the account.
  • Employment information: clock-in and clock-out times, the channel used, hours and overtime, manager corrections with who made them, fixes workers make with the buttons on their WhatsApp card, times workers report themselves, day labels such as sick or vacation, and an hourly rate if the employer enters one. Source: workers' punches and the employer. Purpose: building timesheets and calculating overtime for the employer. Kept: the same as worker identifiers.
  • Clock-in messages: the WhatsApp messages workers send to the WaClock number, the buttons they tap, and our replies and reminders. Source: workers. Purpose: recording each punch exactly once and showing the employer how a punch was made. Kept: with the time records they produced.
  • Alert recipients: the email addresses and WhatsApp numbers (with a name and language for each number) an employer lists to receive alerts and the daily summary, and the alert settings. Source: the employer. Purpose: sending the alerts and daily summaries the employer turned on. Kept: until the employer removes an address or number, or the account is deleted.
  • Commercial information: plan, number of active employees billed and subscription status. Source: the account and our payment processor. Purpose: billing. Kept: while the account is open, then as long as tax and accounting law requires.
  • Website chat messages: what a visitor types into the chat assistant and, if the visitor asks for a person, the conversation and any email address the visitor leaves. Source: website visitors. Purpose: answering the visitor's question. Kept: not stored by WaClock when only the AI answers, including on the server that runs the AI model; when handed to a person, up to 7 days on our servers, and the copies the operator receives in Telegram or by email for as long as needed to handle the request.
  • Ad leads: the name, email address, phone number, company size and industry a person enters in a lead form in one of WaClock's ads. Source: the person, through Meta's lead ads. Purpose: replying to the request. Kept: up to 12 months after we receive it, and the copies the operator receives in Telegram and on its self-hosted task board for as long as needed to handle the request; if the person signs up for WaClock, it is kept with the account.
  • Support emails: what you write to support@waclock.com and your email address. Source: the sender. Purpose: answering the request and keeping a record of it. Kept: for as long as needed to handle the request and keep a record of it.
  • Internet and device activity: IP address, browser type, pages requested and error reports. Source: your browser or phone, automatically. Purpose: keeping the service secure, limiting abuse and fixing problems. Kept: for a short period, because server logs rotate automatically and error reports expire at our error-monitoring provider.

We do not sell or share personal information. We do not sell any of the categories above, we do not share them for cross-context behavioral advertising, and we have not done either in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. We disclose personal information to the service providers on the Subprocessors page only so they can provide their services to us.

Sensitive personal information. The only sensitive personal information we collect is the email and password account users sign in with. We use it only to let them sign in and to protect the account, and for no other purpose.

Cookies, tracking and Do Not Track

The public website sets no cookies. When you sign in to the web app, WaClock sets one essential cookie that keeps you signed in; it cannot be read by page scripts and is sent only to WaClock. If you choose Sign in with Google, WaClock also sets a short-lived security cookie (an_gs) that prevents forged sign-in requests; it lasts at most 10 minutes and is deleted once you are signed in. Google sets its own cookies on its sign-in page, under Google's privacy policy. We use no analytics, no advertising cookies and no tracking pixels, and our fonts are served from our own website, so no third party collects information about your activity across other websites through WaClock. The chat assistant uses your browser's session storage only as described above, and if you change settings in the accessibility menu, your browser remembers them in its local storage on your device; they are never sent to us. In the web app, when you download an ADP payroll import file, your browser also keeps the ADP company code, pay frequency and double-time earnings code you entered in its local storage (under the name waclock-adp-import), so the form is filled in next time; WaClock receives them only with the download they are used for. If you reach the signup page from a link that carries campaign details (such as utm_source) or fills in the form, your browser keeps them, but never your email address, in this tab's session storage (under the name waclock-lead) for up to 24 hours, so they survive signing up with Google; WaClock receives them only with your signup, and they are deleted when the tab closes. Because we do not track you, there is nothing for a Do Not Track or Global Privacy Control signal to switch off: WaClock works the same whether or not your browser sends one, and we show no cookie banner because no optional cookies exist to accept or refuse.

How long we keep data

We keep account data and time records while the employer's account is open, because employers rely on them for payroll and wage-law records. After a subscription ends, the account owner can still view and export its records.

Employers are responsible for keeping time records for as long as their state requires, for example three years under federal and California rules and six years in New York, so they should export their records before asking us to delete an account. When an employer asks us to delete its account, we delete or anonymize its data within 90 days, except what we must keep longer for legal, tax or accounting reasons. The Notice at collection gives the period for each category.

Security

Data travels over encrypted connections, passwords are stored as one-way hashes, and access to production systems is limited to the people who run the service. No system is perfectly secure, and we will notify affected users of a breach as the law requires.

Your choices and rights

  • Workers: block the WaClock chat in WhatsApp at any time to stop messages, and clock in with your personal clock link instead. To see, correct or delete your time records, ask your employer. You can also write to us and we will pass the request to your employer and help them answer it.
  • Employers: you can view and correct your data in the app, export timesheets and payroll files, download a full copy of your company's data (account owner, from the Reports page), and ask us to delete your account.
  • Alert recipients: ask the account owner to remove your address or number, block the WaClock chat in WhatsApp, or write to us with the subject "unsubscribe alerts".
  • California residents: you have the right to know what personal information we hold about you, to ask us to correct or delete it, and not to be retaliated against for using these rights, including as an employee. We do not sell or share personal information as those terms are defined in California law. You can use an authorized agent to make a request for you; we may ask the agent for your signed permission.

Send requests to support@waclock.com. We answer within 45 days. Before we act on a request, we confirm who you are, usually by replying to the email address on the account or by asking you for details that match our records.

Where data is stored and processed

The WaClock service and its database run on a server operated by Hostinger in Vilnius, Lithuania, in the European Union. This is temporary: we plan to move them to a dedicated server in the United States and will update this policy when we do. The waclock.com website is hosted by Vercel in the United States. The AI model behind the website chat runs on a server in Israel that WaClock runs itself; chat messages are processed there to produce an answer and are not stored. Some of our service providers process data in other countries, as the Subprocessors page shows. WaClock is operated from Israel, so the person who runs the service accesses data from there. Wherever the data is, we protect it as this policy describes.

Children

WaClock is a workplace tool for businesses. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to support@waclock.com and we will delete it.

Accessibility

If you have trouble reading this policy, see our accessibility statement or email us and we will send it in a format that works for you.

Changes

If we change this policy we will update the date at the top. If a change is significant, we will tell employers by email before it takes effect.

Contact

WaClock. Email support@waclock.com.