Privacy policy
Last updated 25.10.2026
1. Who we are
Idus is provided by Kahur Media OÜ (registry code 10704434, Vääna tn 12, Nõmme district, Tallinn, Harju county, Estonia), referred to below as "we" or "Idus". For any question about personal data, write to idus@kahur.ee. The company's general address is info@kahur.ee.
Idus is web-based software for time tracking and work management. It runs at idus.kahur.ee, as an app added to a phone's home screen and, in construction workspaces, also as a separate Android app.
This document explains which personal data we process, why, for how long and what your rights are. It follows the General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
2. Two roles: what we do ourselves and what we do for a customer
Idus is used by a company (the customer) that creates a workspace and invites its employees, managers and partners (the users). This gives rise to two roles.
- Kahur Media OÜ is the controller for your account, the public website, billing, support and analytics. Sections 3 to 5 describe this data.
- The customer is the controller and Kahur Media OÜ is the processor for everything inside a workspace: working time, locations, photos, chat, documents, the customer's own clients and partners. We process this data on the customer's instructions under the data processing agreement. Section 6 describes it.
If you are an employee and want to know why your employer records your working time or location with Idus, your employer is the first place to ask. We help the employer answer, and we answer you directly on anything that concerns your account.
3. Data for which we are the controller
3.1 Account
When you create and use an account we process: name, e-mail address, password (stored as a hash only), browser time zone, language and appearance preference, the two-factor authentication secret and recovery codes (if you turn it on), sign-in sessions (session id, last activity) and the records of changing and verifying an e-mail address.
If you sign in with a Google or Microsoft account, that service gives us your name, e-mail address and account id. We never see the password. Google and Microsoft process the sign-in under their own terms as independent controllers.
Legal basis: performance of a contract (GDPR article 6(1)(b)). Two-factor authentication and session management also rest on our legitimate interest in keeping accounts secure (point f).
3.2 Creating a workspace and membership
When a workspace is created we store its name, industry, country, time zone and currency, and who created it. When an invitation is sent we process the invitee's e-mail address and the inviter's name. A membership record holds the role and permissions.
Legal basis: performance of a contract.
3.3 Billing
A paid plan is paid through Stripe. We pass Stripe the customer's company name, billing address, e-mail address, VAT number and the chosen plan. We never see or store card details, only Stripe processes them. We keep the Stripe customer and subscription ids, the plan history and invoice data.
Legal basis: performance of a contract and the obligation under the Estonian Accounting Act to keep source documents for seven years (GDPR article 6(1)(c)).
3.4 Support and communication
When you write to idus@kahur.ee or in the in-app support chat, we process your name, contact details, the content of the message and its attachments in order to answer. Support chat messages are visible to our support operators.
Legal basis: performance of a contract and our legitimate interest in supporting the service.
3.5 Support access to workspaces
Our support operators see workspace metadata in the operator console (workspace name, plan status, member count, last activity, AI usage, consent answers). An operator enters a workspace's content (working time, photos, documents) only to resolve a fault or a support request. Operator actions are logged.
Legal basis: performance of a contract and the legitimate interest in keeping the service running.
3.6 Server logs and reliability
The web server records for every request the IP address, time, requested address, response code, browser user agent and referring page. We keep these logs for 14 days and use them to investigate faults and attacks. The application also keeps records of slow requests and sent notifications for 30 to 90 days.
Legal basis: legitimate interest in keeping the service secure and running.
3.7 Analytics and consent
On the public pages and in the app we ask for your consent before loading any analytics tool. Without consent no analytics script is loaded, no request goes to Google or PostHog and no cookie is set.
With consent we use:
- Google Analytics 4 (Google Ireland Ltd) to count page views. We send the page path without query parameters. The data is not used for advertising and Google signals are off.
- PostHog (PostHog Inc, EU servers in Frankfurt) to understand how the app is used, including session replays. PostHog receives only the internal ids of the user and the workspace and the workspace's industry, never a name or an e-mail address. Typed text, images, video and the map are masked in replays, and the content of network requests is not recorded.
We also record your answer (accept or decline) in our database so that we can show consent was given: the answer, the time, the banner text version, a random device key, the browser user agent (up to 160 characters) and the signed-in user's id. We do not store the IP address. Consent can be withdrawn at any time under "Cookie settings" (in the public footer and the user menu). On withdrawal we delete the analytics cookies.
Legal basis: consent (GDPR article 6(1)(a)).
3.8 Notifications
If you turn on browser push notifications, we store the subscription address and keys your browser issues. The notification is delivered by your browser maker's push service (Google, Apple or Mozilla). E-mails are sent through the mail server of the Estonian provider Zone Media OÜ.
Legal basis: performance of a contract and your choice to receive notifications.
3.9 Public company background
Idus keeps facts about legal persons gathered from public registers (the Estonian Tax and Customs Board, the official gazette Ametlikud Teadaanded), such as tax debt and proceedings notices, so that users can see the background of their clients and partners. Where a register lists a sole proprietor, their name and registry code are personal data. We process them for the register's original purpose.
Legal basis: legitimate interest.
3.10 Map tiles
When the app shows a map, your browser loads the map images from OpenStreetMap's servers. The OpenStreetMap Foundation sees your IP address under its own terms. We never send location points to OpenStreetMap.
4. Cookies and device storage
| Name | Purpose | Lifetime | Basis |
|---|---|---|---|
| Session cookie | Keeps you signed in | 120 minutes of inactivity | Necessary |
XSRF-TOKEN |
Protects forms against forged requests | Session | Necessary |
| "Remember me" cookie | Keeps you signed in when you choose so | Up to 5 years | Necessary, your choice |
| Device storage (localStorage) | Consent answer, appearance preference, unsent drafts | Until cleared | Necessary |
_ga, _ga_* |
Google Analytics | Up to 2 years | Consent |
ph_* |
PostHog | Up to 1 year | Consent |
5. Who we share data with
We do not sell personal data and do not use it for advertising. We pass data only to the following providers, who process it on our behalf under a contract, or to independent controllers when you make that choice yourself.
| Provider | Role | Location | Purpose |
|---|---|---|---|
| Hetzner Online GmbH | Processor | Germany (Nuremberg) | Server hosting, database, files |
| Zone Media OÜ | Processor | Estonia | Sending e-mail, storing encrypted backups |
| Stripe Payments Europe Ltd | Processor (payments) | Ireland | Card payments, VAT calculation, invoices |
| Anthropic PBC | Processor | USA | Reading receipts, invoices and documents with AI (see 6.4) |
| PostHog Inc | Processor | EU (Frankfurt) | Usage analytics, with consent |
| Google Ireland Ltd | Processor | Ireland | Google Analytics, with consent |
| Google LLC, Microsoft Ireland | Independent controller | EU/USA | Signing in with a Google or Microsoft account, if you choose it |
| Google, Apple, Mozilla | Independent controller | EU/USA | Delivering browser push notifications |
| OpenStreetMap Foundation | Independent controller | EU/UK | Map images |
Where data leaves the European Union (Anthropic, and Google and Microsoft where applicable) we rely on the European Commission's standard contractual clauses or the provider's participation in the EU-U.S. Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
We may also disclose data where the law requires it or where it is necessary to protect our rights.
6. Data we process on a customer's behalf
Inside a workspace we process data on the customer's instructions. The customer decides what is collected and why, and is responsible for informing its employees. Recording an employee's working time is an employer's statutory duty (Estonian Employment Contracts Act § 28), which is usually also the legal basis for the processing.
6.1 Working time and location
An employee records the start of work, a break, a change of site and the end of work. For each such event the time is stored and, if the employer has turned location confirmation on, the phone's location (latitude, longitude and accuracy in metres). The web app never tracks location in the background: the location is read only at the moment of the event.
A construction workspace may also offer an Android app with an automatic clock. The employee turns it on themselves. The app registers virtual boundaries (geofences) around the employer's sites with the phone's operating system, and Idus learns only of a boundary crossing: arrival at or departure from a site, the time and the accuracy. No movement track is recorded or transmitted. The employee can turn it off and remove paired phones in the app's settings at any time.
6.2 Photos, videos and voice messages
Photos, videos and voice messages taken on a site are stored in the workspace gallery. Files are never at a public address and are visible only to users with the right to see them. Photos may show people and carry location metadata. The employer is responsible for making sure employees know that photos are taken on site.
6.3 Chat, work and documents
Chat beside a work or a site, tasks, checklists, absences and holidays, working-time norms, shift plans, receipts, invoices, quotes, tender documents, bookkeeping entries and the contact details of the customer's own clients, suppliers and partners are workspace data and belong to the customer.
6.4 Artificial intelligence
Receipts, invoices and other documents in a workspace may be read by artificial intelligence (AI) to extract the date, amount and VAT. By default Idus uses its own account with the provider Anthropic: the document's image or PDF is sent to Anthropic's API and the answer comes back in a structured form. Under Anthropic's API terms, data sent through the API is not used to train models. A workspace owner may turn AI off or add their own AI provider key (Anthropic, OpenAI, Google Gemini, Mistral or a compatible service). With an own key the provider is the customer's own processor and there is no fallback to Idus's key.
A user may also connect their own AI client (for example Claude or ChatGPT) to Idus through the MCP interface. That is the user's own choice: the AI client receives exactly the data the user asks for, and the AI client's maker processes it under its own terms. The user can revoke the connection in settings at any time.
6.5 Partners
An employee of the customer's partner (for example a subcontractor) may record working time on the customer's site through a partner access, without becoming a workspace member. They see only their own time and the work assigned to them.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | Until the account is deleted |
| Workspace data | Until the customer ends the workspace or the contract, then 30 days, then deletion from live systems |
| Accounting source documents (our invoices to the customer, Stripe transactions) | 7 years (Estonian Accounting Act § 12) |
| Server logs | 14 days |
| Application reliability records | 30 to 90 days |
| Sign-in session | 120 minutes of inactivity |
| Android app pairing | Ends after 90 days without use |
| Consent answers | Until the account is deleted, as evidence |
| Backups | Encrypted. We keep 14 daily, 8 weekly and 6 monthly copies. Deleted data may persist in a backup for up to 6 months and disappears when that copy expires |
Deleting an account anonymises it. Your name, e-mail address, password, two-factor secrets, sessions, API keys, AI connections and partner accesses are deleted or made unusable. The time entries, comments and other records you made stay in the workspace under the neutral label "Deleted user", because they are part of the employer's working-time and accounting records (GDPR article 17(3)(b)). A workspace owner must transfer ownership to another member before deleting their account.
8. How we protect data
- Every connection is encrypted with TLS, with HSTS and a content security policy in force.
- Each workspace's data is separated from every other and visible only to that workspace's members according to their role.
- Files are never at a public address, each file opens only for a user with the right to it.
- Passwords are stored as hashes, API keys and mail server passwords encrypted. Two-factor authentication is available to everyone.
- A correction to working time never deletes the original entry, and the change log shows who changed what and when. The bookkeeping journal is append-only and hash-chained.
- Servers are in the European Union (Germany), backups are encrypted and stored in Estonia.
- Support operator access is limited and logged.
We notify the Estonian Data Protection Inspectorate of a breach that threatens your rights within 72 hours, and you where necessary.
9. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict processing, to object to processing based on legitimate interest, to receive the data you provided in a machine-readable form and to withdraw consent at any time (which does not affect earlier processing).
You can view and change your account data in the app's settings, where you can also delete the account. For anything else write to idus@kahur.ee. We answer within one month at the latest.
For workspace data (working time, locations, photos), address your request first to your employer, who is the controller of that data. We help fulfil the request when the employer asks us to.
If you believe we infringe your rights, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, Tallinn, info@aki.ee, www.aki.ee) or go to court.
10. Children
Idus is meant for companies and their employees. We do not knowingly offer the service to anyone under 13 or knowingly collect children's data.
11. Changes
When we change this policy we publish the new version on this page with its date. We announce a material change to signed-in users in the app or by e-mail at least 30 days before it takes effect.
12. Contact
Kahur Media OÜ, registry code 10704434, VAT no EE100710481, Vääna tn 12, Nõmme district, Tallinn, Harju county, Estonia. E-mail: idus@kahur.ee (service and data protection), info@kahur.ee (company).