Privacy policy

T&C Technologies LTD ("we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Momentumpro platform ("Service"). It complements our Terms of service.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Israeli Privacy Protection Law 5741-1981, including Amendment 13.

1. Roles

For the personal data of employees of our Customers, our Customers (the organizations subscribing to Momentumpro) are the data controllers and we act as the data processor. The Customer determines what data is collected, how long it's retained, and the lawful basis for processing.

For personal data we collect directly from website visitors and account administrators (e.g. through our marketing site, contact form, or billing portal), we are the data controller.

2. Information we collect

From visitors and prospective customers

• Contact information you submit via our contact, demo or signup forms (name, email, organization, phone, message);
• Technical data automatically collected from your browser (IP address, user agent, page-view timestamps);
• Campaign data, if you accept analytics or marketing cookies: how you reached us (for example the ad campaign, search engine or website that referred you, and ad click identifiers such as Google’s gclid or Meta’s fbclid), stored with the workspace you create so we can tell which campaigns bring customers;
• Newsletter data, if you subscribe: your email, when and from which page you subscribed and confirmed, and the IP address used (proof of consent);
• Cookie data as described in our Cookie policy.

From Customers and their Users

• Account credentials (email, hashed password, two-factor secrets where enabled);
• Profile data the User chooses to add (name, phone, avatar, language preference);
• Authentication metadata (login timestamps, IP, device type, browser);
• Audit-log data (records of changes Users make to data within the Service);
• Content uploaded by the Customer (employee records, documents, vendor data, etc. — entirely controlled by the Customer);
• Billing data for paying Customers (company name, billing address, tax ID, last 4 of payment card via our payment processor — we never store full card numbers).

3. How we use information

• Provide the Service: authenticate Users, store and serve Customer Content, deliver notifications, process payments;
• Communicate: respond to support requests, send service updates, security alerts, billing notices, and (with consent) product newsletters;
• Improve the Service: analyze usage trends in aggregate (no individual profiling), debug, prevent fraud and abuse;
• Run the Mia assistant: what you type or say to Mia is sent to OpenAI’s API to generate the answer (and, for voice, to transcribe your speech and produce the spoken reply). OpenAI processes it as our sub-processor and, under its API terms, does not use it to train models. Conversations are stored on our servers in Germany and may be reviewed by authorized Momentumpro staff to fix errors and improve answers, mainly conversations a User has flagged with the feedback buttons. They are never shared with advertisers. Customers can ask us to exclude their organization’s conversations from review by writing to support@momentumpro.pro;
• Measure our advertising: only with your consent, see section 5A;
• Comply with legal obligations: tax records, court orders, regulatory requirements.

We do not sell personal data or use Customer Content to train machine-learning models. Customer Content (the data inside your workspace) is never shared with advertising platforms.

4. Legal bases for processing (GDPR)

• Contract: processing necessary to deliver the Service to which you've subscribed;
• Legitimate interest: securing the Service, preventing abuse, improving features (balanced against your rights);
• Consent: marketing communications, optional cookies, where required by law;
• Legal obligation: tax records, anti-fraud measures, responding to lawful requests.

5. Sharing, disclosure and sub-processors

We share personal data only with:

• Sub-processors who help us run the Service, listed below. Each is bound by a data-processing agreement or equivalent terms.
• Customers: authentication metadata and User activity are visible within the Customer’s own workspace. Data is never shared between customers.
• Integrations a Customer turns on (for example Google Workspace, Microsoft 365, Zoom or Slack): data flows to them only because the Customer or User connected them.
• Legal authorities when required by law or court order. We notify the affected Customer unless the law forbids it.
• Successor entities in a merger, acquisition or asset sale, under a policy at least as protective as this one.

We update this list when sub-processors change. Questions: support@momentumpro.pro.

5A. Advertising measurement

We advertise Momentumpro on Google, Meta (Facebook and Instagram) and LinkedIn. To know which ads lead to sign-ups and demo requests, our website and signup pages can use the Google tag (Google Analytics and Google Ads, through Google Tag Manager), the Meta Pixel and the LinkedIn Insight Tag.

• Only with your consent. These tags do not load until you accept analytics or marketing cookies in our cookie banner. We use Google Consent Mode, which defaults to “denied”.
• What they receive: the pages you view, the ad you clicked (click identifiers), your browser and device, your IP address, and events such as “started signup”, “created a workspace” or “requested a demo”. For a completed signup we may send a hashed (irreversibly scrambled) copy of the owner’s email so the ad platform can match the conversion. We never send your workspace content.
• Who controls it: Google, Meta and LinkedIn may use this data under their own privacy policies, including to measure and optimize ads.
• Your choice: you can withdraw consent at any time with the “Cookie settings” link at the bottom of every page. We then stop loading the tags and delete our own campaign cookies.

6. International transfers

The Service and all customer databases are hosted in Germany (EU). Some sub-processors listed above are in the United States or other countries. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses approved by the European Commission.

7. Data retention

• Active subscription: we retain Customer Content for the duration of your subscription;
• After cancellation: Customer Content is retained for 30 days (allowing recovery), then permanently deleted. Backups purged within 90 days;
• Activity logs: retention depends on the plan (shown on our pricing page);
• Campaign data on a workspace: kept as long as the workspace exists;
• Newsletter: until you unsubscribe, then only the record of your consent and opt-out for up to 3 years;
• Billing records: retained for 7 years for tax and accounting compliance;
• Support correspondence: 3 years.

8. Your rights

Under GDPR and Israeli law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your personal data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, commonly used format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with your local supervisory authority (in Israel: PPA — Privacy Protection Authority).

For Customer Users: most of these rights are exercised through your Customer's HR or admin team, since they control your account. Use the in-app Privacy Centre to download your data or request deletion.

For account administrators and direct customers: contact support@momentumpro.pro and we'll respond within 30 days.

9. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Per-tenant database isolation;
• Hashed and salted password storage (bcrypt);
• Role-based access controls and least-privilege principles;
• Regular automated backups;
• Activity logging and security monitoring;
• Regular security reviews.

No system is perfectly secure. In the unlikely event of a breach affecting your personal data, we will notify you and the relevant supervisory authorities within 72 hours of becoming aware, as required by law.

10. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we've inadvertently collected such data, please contact us and we'll delete it.

11. Cookies & tracking

See our separate Cookie policy.

12. Momentumpro mobile app

The Momentumpro mobile app for Android and iOS (package pro.momentumpro.app) is an additional way for Users to access their organization's Momentumpro tenant. The data practices described above apply to the mobile app, with the following mobile-specific clarifications.

12.1 Data the mobile app collects

• Account credentials & session tokens. Email and password are submitted only to your organization's Momentumpro server over TLS. We store the resulting session token in the device's secure storage (Android Keystore / iOS Keychain). Passwords are never stored on the device.
• Profile information you choose to provide in the in-app profile editor (display name, phone, address). Sent to your organization's server.
• Approximate and precise location, only when you tap "Clock in" or "Clock out", and only if your organization has enabled location-stamped attendance. The single GPS reading is attached to the punch record and sent to your organization's server. The app does not collect background location and does not track movement between punches.
• Camera and photo library access, only when you tap a feature that uses the camera (e.g. "Snap receipt" for expenses, "Upload document"). Captured images are uploaded to your organization's server. No images are sent anywhere else.
• Biometric authentication data (fingerprint or FaceID). Biometric matching happens entirely on your device's secure enclave; biometric templates never leave the device and are never transmitted to us or to any third party. The app receives only a yes/no result.
• Push notification token (Firebase Cloud Messaging). Registered with Google's FCM service and stored on your organization's server so we can deliver notifications about approvals, tickets, attendance reminders, and announcements. You can revoke this at any time by signing out or disabling notifications in your device settings.
• Device and app metadata sent with each request: app version, OS version, device model, language preference. Used for compatibility and debugging.
• Crash and error reports via Sentry. Includes the stack trace, breadcrumbs (in-app navigation events), and device model. We strip identifiers and access tokens from these reports before transmission.
• Locally cached data: a copy of recently viewed items (announcements, tickets, payslips, documents you've opened) is kept on the device to speed up subsequent opens and to support offline read. The offline clock-in queue stores pending punches until network is available. All of this is removed when you sign out, uninstall the app, or clear app data.

12.2 Data the mobile app does NOT collect

• Contacts, call logs, SMS, or photos beyond what you explicitly capture or pick.
• Microphone audio, except while you are talking to Mia in a voice conversation: then your speech is streamed to Mia and transcribed by OpenAI (see section 3). The app does not listen at any other time.
• Advertising identifiers — the app contains no third-party advertising SDKs and shows no ads.
• Browsing history outside the app.
• Background location, step count, or any continuous sensor data.

12.3 Third parties the app talks to

• Your organization's Momentumpro server (typically {your-org}.momentumpro.pro) — for all business data.
• Google Firebase Cloud Messaging — to deliver push notifications. Subject to Google's privacy policy.
• Sentry (Functional Software, Inc.) — for crash and error reporting only. We have a data-processing agreement in place.
• Mia (mia.momentumpro.pro) and OpenAI — when you use the Mia assistant, as described in section 3.

The mobile app does not contain advertising tags and does not share data with advertisers, data brokers or analytics vendors beyond crash reporting.

12.4 Permissions and how to revoke them

The app requests Android and iOS runtime permissions only when a feature that requires them is used. You can revoke any permission at any time from your device settings (Android: Settings → Apps → Momentumpro → Permissions; iOS: Settings → Momentumpro). Revoking a permission disables the matching feature but does not delete already-stored data.

12.5 Account & data deletion from the mobile app

You can sign out at any time from the in-app profile sheet. Signing out clears the session token, the offline punch queue, and locally cached data from the device.

To delete your account and associated personal data: open the in-app profile sheet → "Privacy & data" → "Request account deletion". This sends a request to your organization's administrator (your employer controls the account). If you no longer have access to the app, you can also email support@momentumpro.pro with your organization's name and registered email, and we will forward your request to the organization's administrator and confirm completion within 30 days.

Note: because the Service is operated for organizations (your employer), individual account deletion typically requires the organization's confirmation. Tax, audit, and legal-hold records may be retained after deletion as described in section 7 above.

12.6 Children

The mobile app is intended for use by employees, contractors, and authorized personnel of organizations that have subscribed to the Service. It is not directed to and is not intended for use by children under 16.

13. Updates to this policy

We may update this Privacy Policy occasionally. Material changes will be communicated via email and an in-app notice at least 30 days before taking effect.

14. Contact

Privacy questions or requests: support@momentumpro.pro
Postal: T&C Technologies LTD · Hizma St 7, Beit Hanina, Jerusalem, Israel

If anything in this document is unclear, email us at support@momentumpro.pro and we’ll explain.

Operated by T&C Technologies LTD · Hizma St 7, Beit Hanina, Jerusalem, Israel · Company reg. 516092582