Legal
Privacy Policy
Effective July 27, 2026
FlatHours is a time tracking and invoicing service operated by Champlin Enterprises, LLC. This page explains what we collect, why we have it, who else touches it, and how to get it back or have it removed. It is written in the same plain words as the rest of the site.
The short version: we collect what the product needs to work, we do not sell it, we do not run advertising trackers, and you can export or delete your data at any time.
Who we are
Champlin Enterprises, LLC, 1449 S Michigan Ave, Ste 13946, Chicago, IL 60605, United States. For anything on this page, write to [email protected]. We are the data controller for your account, and a data processor for the client and time records you put into it.
What we collect
Your account
Your name, email address, and a one-way hash of your password (we never store the password itself). If you sign in with Google or Microsoft, we receive your name, email address and the provider's account identifier, and nothing else.
Your business details
Whatever you enter for your organization: business name, legal name, tax identification number, address, phone, logo and invoice preferences. This exists so your invoices and your client portal carry your identity rather than ours.
Your work
Clients and their contacts, projects, tasks, time entries, rates, invoices and payment records. You control all of it. Note that this includes personal information about your clients that you chose to enter, and you are responsible for having a lawful basis to do so.
Technical records
IP address, browser user agent and timestamps, kept in server logs for security and debugging. Sessions use a strictly necessary cookie and a cross-site request forgery token. There are no advertising or cross-site tracking cookies anywhere on this site.
Client portal activity
When you send an invoice, your client opens it through a private link. We record that the link was opened, roughly when, for how long, the screen size and how far the page was scrolled, plus a coarse location derived from the IP address. We show this to you, the sender, so you know an invoice landed. We do not build a profile of your client, and this data is never used for advertising.
What we never do
- •Sell or rent your personal information, or your clients'.
- •Share your data with advertising networks or data brokers.
- •Read your invoices or time entries, except when you ask support for help with a specific record.
- •Use your data to train machine learning models.
- •Touch the money your clients pay you (see below).
Payments
Your clients pay you through your own Stripe account, connected to FlatHours by you. Funds go directly from your client to you. We never hold them and we take no percentage of them. Card and bank details are entered into Stripe's own payment form and are stored by Stripe, never by us. Your subscription to FlatHours is also billed through Stripe.
Who else processes your data
We keep this list short on purpose, and we keep it current:
| Processor | What for |
|---|---|
| Stripe | Processing your clients' payments to you, and your own subscription. |
| Mailgun | Delivering invoice emails, invitations and account email. |
| Our hosting provider | Running the servers and database that hold your account. |
| Google, Microsoft | Only if you choose to sign in with them. Skip it and they receive nothing. |
How long we keep it
For as long as your account exists. If you stop paying you drop to the free plan and your history stays put, because holding data hostage to force a renewal is the behaviour this product was built to get away from. Ask us to delete your account and we remove your data within 30 days, except records we are legally required to keep (invoicing and tax records, typically seven years). Server logs roll off within 90 days.
Your rights
You can see everything we hold about you inside the app, and export your time and invoice history to CSV at any time without asking us. Beyond that you may ask us to correct something, send you a copy, or delete it. If you are in the UK, EU or EEA you have these rights under the GDPR, and you may complain to your local supervisory authority. If you are in California you have rights under the CCPA, including the right to know and the right to delete. We do not sell personal information, so there is nothing to opt out of. We will not treat you differently for exercising any of this.
Email [email protected] and we will respond within 30 days.
Security
Traffic is encrypted in transit. Passwords are hashed, never stored or logged in readable form. Each organization's records are isolated from every other organization's at the database query layer, and that isolation is covered by an automated test suite. No system is perfect: if we ever discover a breach affecting your data, we will tell you promptly and tell you what we know.
Where your data lives
On servers in the United States. If you are outside the US, using FlatHours means your data is transferred there.
Children
FlatHours is a business tool and is not intended for anyone under 16. We do not knowingly collect their information.
Changes
If we change anything material here, we will email account holders before it takes effect. The effective date at the top always tells you which version you are reading. We will not make a quiet change and hope you miss it.
Questions about any of this go to [email protected]. See also the Terms of Service.