1.Data controller
The controller of the data collected directly by the platform is:
Legal entity name: NUXO LABS LLC
Tax / registration ID: EIN 42-3780133 — Florida limited liability company (Fla. Document No. L26000361728)
Contact email: soporte@nuxoagency.com
Website: https://nuxoagency.com
Multi-tenant model and processing roles
TIMEFLOW is a multi-tenant platform: each client organization (for example, a consultancy) has an environment with its data isolated from that of every other organization. In this model:
- The employer organization that engages TIMEFLOW acts as the controller of the personal data of its own employees, clients, and projects that it enters into the platform.
- NUXO acts as a processor, processing that data on behalf of and under the instructions of the employer organization, solely for the purpose of providing the platform's service.
If you are an employee or user and wish to exercise your rights over the data associated with your organization, we recommend that you first contact the person responsible at your company; however, you may also contact us at the address above and we will forward your request where appropriate.
2.Data we process
The platform processes only the data necessary to record work hours and calculate payments. The categories of personal data below reflect how the system actually works:
| Category | Specific data | Source |
|---|---|---|
| Identity and account | Email address, full name, role (administrator, manager, or employee), account status (active, invited, or inactive), and unique user identifier. | Created by the organization's administrator. |
| Authentication | Access credentials managed through the authentication provider (Google Firebase Authentication) and session tokens. The password is never stored on NUXO's systems: it is held by the authentication provider in encrypted form. | The user, when signing in or resetting their password. |
| Work activity | Dates worked, number of hours, description of the activity performed, associated client and project, activity type, and work weeks with their approval status (draft, submitted, approved, or rejected) and review comments. | Recorded by the employee and reviewed by their manager/administrator. |
| Financial data | Hourly rate applied, calculated amounts (hours × rate), and payment status (paid / pending), together with the history of who marked the payment and when. | Configured by the administrator and calculated by the platform. |
| Audit logs and communications | Audit logs of actions performed on the platform (what was changed, by whom, and when) and records of email notifications sent (recipient address and delivery status). | Generated automatically by the system. |
Data we do NOT process. TIMEFLOW does not collect or store bank details, account numbers, or payment card data, and does not process real monetary transactions: it only calculates and records the amount to be paid to each person. We also do not process "sensitive data" as defined by the FDBR (e.g., race or ethnicity, religion, health, sexual orientation, citizenship or immigration status, genetic or biometric data, or precise geolocation), nor identity documents, mailing addresses, or phone numbers.
3.Purposes of processing
Data is processed solely for the following purposes:
- To enable the recording of employees' work hours, associated with clients, projects, and activity types.
- To manage the review and approval workflow for work weeks.
- To calculate clearly the amount payable to each employee and to track its payment status.
- To generate reports of hours and billing, with the ability to export them to Excel and PDF formats.
- To send email notifications and reminders relating to submissions, approvals, and payments.
- To maintain the security, traceability, and auditability of the operations performed on the platform.
Data is not used for commercial profiling, advertising, or automated decisions that produce legal or similarly significant effects on individuals.
4.How and why we process data
NUXO processes personal data in accordance with the FDBR's principles of purpose limitation and data minimization: we limit collection to what is adequate, relevant, and reasonably necessary for the purposes disclosed above. Depending on the situation, that processing supports:
- Providing the service requested by the employer organization and its users—recording work time and calculating compensation.
- The employer's legitimate business operations, such as managing and reviewing work hours and billing its own clients.
- Compliance with legal obligations, including employment, tax, and recordkeeping requirements.
- The consent of the individual, where consent is applicable to a specific additional processing activity.
U.S. state privacy laws such as the FDBR do not require a "legal basis" in the sense used by some foreign frameworks; the points above describe why processing is necessary and how it stays within the disclosed purposes.
5.Recipients and service providers
To provide the service, NUXO relies on a small number of vendors that act as processors and that access data only to the extent necessary to perform their functions:
| Provider / Service | Purpose | Data involved |
|---|---|---|
| Google Firebase / Google Cloud | User authentication and secure management of credentials and passwords. | Email address, user identifier, and access credentials. |
| Email provider (SMTP) | Delivery of transactional notifications and reminders by email. This may be the server configured by the organization itself or NUXO's default server. | Recipient's email address and the content of the notification. |
| Hosting provider (server / VPS) | Infrastructure on which the application runs and the database resides. | All platform data, stored securely. |
We do not share your data for commercial purposes. NUXO does not "sell" personal data and does not process it for "targeted advertising" or share it for such purposes, as those terms are used under the FDBR. The platform uses no payment gateways and no analytics or advertising trackers. Data is disclosed to government or law-enforcement authorities only where there is a legal obligation to do so.
6.Where your data is processed
Personal data is processed and stored in the United States. Some of the providers listed above (in particular Google's authentication service) may process data in data centers located in the United States or in other countries where they operate.
If a client organization or its users are located outside the United States, they understand and agree that their data will be transferred to and processed in the United States, and that U.S. law will govern that processing. NUXO requires its providers to maintain appropriate technical and organizational safeguards for the data they handle on our behalf.
7.Data retention
Personal data is retained while the organization's account remains active and for as long as it is necessary to provide the service. Once the relationship ends, data will be retained for the periods required by applicable U.S. employment, tax, and recordkeeping laws—for example, payroll-record retention under the Fair Labor Standards Act (FLSA), IRS/tax recordkeeping, and applicable Florida wage-and-hour rules 07/07/2028—after which it will be securely deleted or anonymized.
Each organization has its own database, isolated from the rest, which ensures that its data is not mixed with that of other organizations throughout the entire lifecycle.
8.Your consumer rights
Under the Florida Digital Bill of Rights (Fla. Stat. § 501.705), and subject to its conditions and exceptions, a consumer whose personal data is processed may exercise the following rights:
- Access / confirmation: confirm whether we are processing your personal data and access that data.
- Correction: correct inaccurate or incomplete personal data.
- Deletion: request deletion of personal data you provided or that we obtained about you.
- Data portability: obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.
- Opt out of the processing of personal data for targeted advertising, the sale of personal data, or certain profiling in furtherance of decisions that produce legal or similarly significant effects. As noted above, NUXO does not engage in these activities.
You will not be discriminated against for exercising these rights. To submit a request, write to soporte@nuxoagency.com, indicating the right you wish to exercise. We will verify your identity and respond within 45 days (extendable once by an additional 45 days where reasonably necessary). If we decline your request, you may appeal that decision by replying to our response; if the appeal is denied, we will provide a method to contact the Florida Attorney General.
If you believe your data has not been handled properly, you may submit a complaint to the Florida Attorney General (Department of Legal Affairs), which enforces the FDBR.
10.Security measures
NUXO applies appropriate technical and organizational measures to protect data against unauthorized access, loss, or alteration, including:
- Encrypted communications using HTTPS/TLS.
- Hardened HTTP security headers on the server.
- Authentication based on tokens (JWT) with expiration.
- Rate limiting of requests to protect against abuse.
- Per-organization data isolation, with a separate database for each client.
- TLS encryption for outgoing email.
- Role-based access control (administrator, manager, and employee).
11.Minors
TIMEFLOW is a professional tool intended for organizations and their workers. The platform is not directed to children, and we do not knowingly collect personal data from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). Consistent with the FDBR, we do not knowingly process the personal data of a known child for targeted advertising, sale, or profiling. If we learn that we have inadvertently collected such data, we will delete it.
12.Changes to this policy
This Privacy Policy may be updated to reflect legal, technical, or operational changes. Any material change will be communicated through the platform or by email, and the current version will be identified by the last-updated date shown at the top of the document.
13.Contact
For any questions relating to this policy or to the processing of your personal data, you may contact:
Governing law. This policy and any dispute relating to the processing of personal data described here are governed by the laws of the State of Florida and applicable U.S. federal law, without regard to conflict-of-laws principles.