Privacy Policy · TillTime

Last updated: 15 October 2026

The short version. TillTime keeps your shop's Clover details, your team's names as Clover has them, and each clock-in, break and clock-out, so your hours and breaks are on record the way Irish and UK law ask. Each person makes their own PIN, kept only as a one-way scrambled code. No card details, no customer details, no tracking, no advertising, no cookies. We never sell or share any of it.

Who we are

TillTime is run by SAOIRSE SOFTWARE LIMITED, a company registered in Ireland (Company No. 819296), registered office Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9. Contact: support@saoirsesoftware.com.

Who decides about your team's data

Your business is the employer, so you decide about your team's data (you are the controller). We keep it for you, as your processor, under the Data Processing Terms at the end of our Terms of Service. If a member of your team asks us about their data, we pass the request to you and help you answer it.

What we keep, and why

What	Why	Legal basis (GDPR)
Your shop: its Clover merchant ID, business name, country (Ireland or UK), time zone and postcode (to tell which UK law applies: England and Wales, Scotland or Northern Ireland — or the one you pick in Settings), the keys Clover gives us to read your employee list and your sales (kept encrypted), and the choices you make in Settings (Sunday pay, public holiday benefit, pay period, leave year, the written notice of breaks and rest).	To link TillTime to your Clover account and count by the right law, in your local time.	Contract (Art. 6(1)(b))
Your team, as Clover has them: each person's Clover employee ID, name, nickname, the name they choose to show on the till (if any), role (admin, manager, employee) and whether they are the owner; and the working week you type for them (hours and days, fixed or varying).	So each person finds their name on the till, managers get the owner's side, and leave is counted on the right week. Updated every hour from Clover.	For you, as your processor
Each person's PIN, made by them on the till the first time, kept only as a one-way scrambled code — nobody, including us, can read it back — and a count of wrong tries (5 in a row lock it for 10 minutes).	So only that person can clock in as themselves.	For you, as your processor
The record of hours: each clock-in, break start, break end and clock-out, with the time our server received it, and for each shift the minutes worked, the minutes on break, and whether the break the law asks for was taken. Every correction a manager makes (what it was, what it became, who, when and why) — nothing is deleted. The days of annual leave a manager marks, with the hours of each and who marked them. The leave a person asks for on the till (the days and an optional note) and the manager's answer, with who and when.	It is the record of working time the law asks you to keep (Ireland: Organisation of Working Time Act 1997 s.25 and S.I. 473/2001; UK: Working Time Regulations 1998 reg.9 and 16B).	For you, as your processor — your legal obligation as employer (Art. 6(1)(c))
The written notice and what people report on the till: each time a person reads, on the till, the written notice of their breaks and rest (Ireland), and each time they say "I missed a break or rest" about one of their shifts — which one (a break, the 11 hours between working days, or the weekly rest) and the reason they type.	S.I. 473/2001 lets an employer with clocking-in skip a separate break record only if staff were told their breaks and rest in writing and could say, within a week, which one they missed and why — and those notes are kept.	For you, as your processor — your legal obligation as employer (Art. 6(1)(c))
Days off sick with a medical certificate, only if a manager marks them: the day, its hours and who marked it — no reason, no illness, no copy of the certificate. This is health data; you decide whether to mark it.	In Ireland a certified sick day counts as a day worked for annual leave, and one during annual leave gives that day back (OWT Act 1997 s.19); in the UK, leave keeps building while off sick (WTR 1998 reg.15C).	For you, as your processor — your obligations in employment law (Art. 6(1)(c) and Art. 9(2)(b))
The rota: the shifts planned for each person (day, start, finish, break, an optional note), when each week was published and by whom, and every change made after publishing (what it was, what it became, who, when). A shift someone gives away: who offered it, who took it, and the manager's answer (who, when).	So the team knows their hours ahead (in Ireland, at least 24 hours before the week: OWT Act 1997 s.17), and so lateness and missed shifts show by themselves.	For you, as your processor — your legal obligation as employer (Art. 6(1)(c))
Notes from a manager to the team: what the manager wrote, to whom (everyone or one person), who wrote it, when it ends or was taken down, and who tapped "Got it" and when.	So everyone sees what the manager needs them to know, and the manager sees who has read it.	For you, as your processor
Pay per hour, only if the owner or an admin types it: each person's hourly rate, from the day it was set, and who set it. Only the owner and admins see it — managers and the team never do. With no rate, the app estimates with the national minimum wage and keeps nothing.	To show what the rota and the hours cost, and to put the pay in the payroll file.	For you, as your processor
Your sales, one total a day: for each day, the net total of the payments taken on your Clover (after tax, tips and refunds) and how many there were — nothing about cards, customers or what was sold. Only the owner and admins see it. You can switch it off in Settings, and what was kept is deleted at once.	To show what the hours cost as a share of what the shop sells.	Contract (Art. 6(1)(b))
Tips, when you switch sharing on (off until you do): the choices you make (cash tips, card tips, split by hours or equally, each person's share, your own words to the team); the cash tips a person puts in the pot when they clock out, kept with that shift; and, if you switch card tips on, one total a day of the tips on your Clover's card payments (minus tips refunded) — nothing about cards or customers. From these, each day's pot and each person's part are worked out. Each person sees only their own part; managers see everyone's.	To share tips fairly and show each person what they got, as the Payment of Wages (Amendment) (Tips and Gratuities) Act 2022 (Ireland) and the Employment (Allocation of Tips) Act 2023 (UK) ask of employers.	For you, as your processor — your legal obligation as employer (Art. 6(1)(c))
A person's own email address, only if they turn emails on (off for everyone until then): the address they type themselves on their phone or the till, confirmed with a 6-digit code we email it; which emails they want (a reminder 1 hour before each shift, their rota when published or changed, the answers to their leave and swaps, and — for managers — the morning summary); and a list of the emails sent (what kind, when). Nobody else sees the address — not even the owner.	To send the reminders and answers the person asked for.	Consent, which they withdraw at any time with "Stop emails" (Art. 6(1)(a))
Clocking in from a phone, only if you switch it on (off until you do): the shop's spot (a point on the map you set standing in the shop), the distance that counts as "at the shop", and who set it and when. When a person taps Clock in, Break or Clock out on their own phone, the phone sends its position once, we compare it with the spot and drop it — we never store anyone's location, and nothing is checked between taps. The punch only records that it came from a phone. A tap from too far away is refused and nothing is kept.	To let staff clock in on their own phone without letting them do it from home.	For you, as your processor — your legitimate interest in an accurate record (Art. 6(1)(f)); tell your team before you switch it on
The morning summary: once a day, for the day before, the names and shift times of anyone whose break was missed, who reported a missed break or rest (and why), who is still clocked in after 12 hours, or who came in late or not at all for a shift on the rota.	So managers see it at the top of Team hours without searching the record.	For you, as your processor
Each linked device: a scrambled code of the key that tells us which shop a Clover device belongs to, and when it was last used.	So only your own devices can clock your team in and out.	Contract

Someone who leaves your Clover employee list is marked as gone, not deleted: their past hours must stay on record for as long as the law asks (below).

What we never do

We never keep cards, customers or what was sold — from your payments we keep only each day's total (above). TillTime makes no decisions about anyone on its own: it shows a missed break, a late start or a missing clock-in, and a manager decides what to do. TillTime asks Clover for your employee, merchant and payments details, read only. We never sell or share data, and we use no advertising or tracking.

Where the data lives, and who helps us

Provider	What they do for us
Supabase	The database and the server functions. Our project is hosted in the EU, in Ireland.
Clover (Fiserv)	Your employee list, shop details and payments come from your Clover account; Clover also bills your subscription.
Netlify	Hosts our website and the TillTime pages for computers and phones. Like any web host, it sees the address (IP) a page is opened from.
Hostinger	Our email (support@saoirsesoftware.com), which also sends the emails people turn on.

These providers are bound by their own data processing terms. Where one of them handles data outside the European Economic Area or the UK, that transfer is covered by the European Commission's Standard Contractual Clauses (and, for UK data, the UK Addendum to them).

How long we keep it

The record of hours is kept for as long as the law asks the employer to keep it: 3 years in Ireland (OWT Act 1997 s.25), and 6 years in the UK (annual leave records, WTR 1998 reg.16B — the longest UK duty). Older records are deleted — shifts with their corrections and notes from the till, leave and sick days, leave requests, the rota and shifts given away, notes to the team (counted from when they ended) with their reads, pay rates replaced by a newer one, and reads of the written notice (each person's newest read stays while they are on your team: it shows they were told).
The morning summaries are deleted after 30 days (the record itself stays, as above).
The daily sales totals are deleted after 400 days, or at once when you switch them off.
Tips: the cash put in at clock-out goes with its shift (as above); the daily card-tip totals are deleted after 3 years (the UK's tips record, Employment Rights Act 1996 s.27J).
Emails: the address goes the moment the person taps "Stop emails", or within minutes of them leaving your team; the list of emails sent goes after 30 days; a sign-up code is wiped as soon as it is sent or used.
The keys from Clover are deleted within an hour of you uninstalling TillTime.
Signing in on a computer (from the Clover dashboard) lasts 12 hours or until you sign out; we keep only a scrambled copy of the sign-in, and it goes when you uninstall.
A person's own phone (they scan a code on the till after their PIN): we ask nothing about them — no phone number, no email, no password. The phone keeps a key; we keep only a scrambled copy and when it was last used. It shows only that person's rota, hours and leave, and can't clock in. It stops working when they sign it out, a manager forgets it in Settings, they leave your team in Clover, you uninstall, or it goes unused for 6 months — and the key is deleted then. The code on the till works once, for 10 minutes.
When you uninstall, we keep your shop's record of hours for 60 days and send you a copy if you ask our support, then delete everything. Keeping the record after that is your duty as the employer. Download it before uninstalling, from Team hours → Report (on the till or on a computer): the PDF has every shift, break, leave and sick day, correction and note from the till; the payroll files have the hours (and, for the owner or an admin, the pay).

Our website

The website (tilltime.saoirsesoftware.com), including the leave calculator, sets no cookies and uses no tracking or advertising. The calculator works in your browser: what you type is not sent to us. We may count visits in total, without cookies and without telling who you are.

Your rights

You can ask to see, correct, copy or delete your personal data, to restrict or object to how it is used, or to take it elsewhere. If you work at a shop that uses TillTime, your employer decides about your data: ask them, or write to us and we pass it on and help them answer. If you are the shop, write to us directly. Our address is support@saoirsesoftware.com, and we answer within one month. You can also complain to the Data Protection Commission in Ireland (or, in the UK, the Information Commissioner's Office), though we would like the chance to put it right first.

Changes

If this policy changes, the date at the top changes too. If the change matters to you, we will tell you before it takes effect.