Skip to main content
Claimora
Sign up

Terms and Conditions

By clicking the 'Accept' button, or signing our commercial terms, or completing the registration process and / or using Claimora, you agree to comply with these Terms and Conditions of Use (TyCu). If you are using Claimora's services on behalf of a company, you must have the authority to bind that company to these TyCu. If you do not accept these TyCu, you must not complete the registration process and you cannot access these services.

Interveners

PROVIDER

The company Fodoj GmbH, registered in the commercial register of the Local Court of Munich (Amtsgericht München) under HRB 248587, VAT ID DE324875035, represented by its managing director Kirill Shirinkin, with registered office at Prinzregentenstrasse 54, 80538 Munich, Germany (team@claimora.com, +49 89 54197048), owner of all the intellectual property rights of Claimora's services, including Claimora, as well as the Claimora brand, hereinafter designated as SUPPLIER.

CLIENT

The company registered in Claimora's services, hereinafter the CLIENT.

OBJECT

The purpose of this contract is to regulate the relations between the CLIENT and the SUPPLIER regarding the access and use of Claimora's services, as well as to establish the personal data protection policies in compliance with article 28 of the General Data Protection Regulation (RGPD).

The Claimora services contracted are intended for the SUPPLIER to make a time management solution available to the CLIENT for its staff.

Claimora provides services through a web platform, so it is essential to connect to the network to access it.

Claimora works in current versions of Chrome, Firefox, Microsoft Edge and Safari, on desktop and on mobile devices. There are no native mobile apps; on phones and tablets Claimora is used through the web browser. Where the customer has enabled this feature, users can also connect a compatible AI assistant to Claimora through MCP.

A — Access and use of Claimora services

A.1 The SUPPLIER undertakes to make Claimora's services available to the Client.

A.2 Access to Claimora services may be temporarily interrupted due to issues related to maintenance, technical incidents, evolution or modification of the platform and the like, which the CLIENT accepts as normal and waives all types of legal action or extrajudicial claim.

B — Contractual modifications

The SUPPLIER may make modifications to this contract, notifying the CUSTOMER at least 1 MONTH in advance of its entry into force. If the CLIENT wishes not to accept the conditions, they must notify the SUPPLIER in writing. In this case, the SUPPLIER may terminate the contract in advance and without any penalty. If the CLIENT does not communicate his disagreement and continues to use Claimora's services, it is understood that he accepts the proposed modifications.

C — Notifications

The CLIENT expressly accepts that all notifications, communications and information that may be necessary with the SUPPLIER related to this contract are carried out, whenever the law allows it, by written electronic means.

D — Restrictions and Confidentiality

D.1 The CLIENT and its registered personnel cannot access Claimora's services if the CLIENT is a competitor of the SUPPLIER in the market. It is understood that any company that manufactures, sells or distributes access control solutions or personnel time management at work of any kind (schedule compliance, production times or tasks, etc.) is a competitor.

D.2 The CLIENT and its registered personnel may not:

a) Incurring illicit, illegal or contrary actions to the provisions of this contract

b) Reverse engineer

c) Access Claimora's services to create a competitive product or service

d) Create a product that uses similar ideas, features or functions to Claimora

D.3 The CLIENT and its personnel registered in Claimora services undertake not to make any attempt to violate access levels, incorrect manipulation of data, attempt to access restricted areas of the PROVIDER platform, introduction of programs, viruses or any device that may produce or produce modifications or alterations in the platform or in the SUPPLIER's services

D.4 The CUSTOMER undertakes to respect the provisions of current data protection regulations, as well as to keep secret all the information regarding the SUPPLIER to which it has access, forcing itself to return any information or documentation belonging to the SUPPLIER. in his possession when the case of termination, resolution or termination of the contract.

E — Data protection (processing of personal data by the SUPPLIER as processor on behalf of the CLIENT as controller, under Article 28 GDPR)

E.1 Providing the Claimora services requires the SUPPLIER to process, on the CLIENT's behalf, personal data of the CLIENT's employees, external collaborators and other users. For this processing, the CLIENT is the controller and the SUPPLIER is the processor within the meaning of Article 4(7) and (8) of the General Data Protection Regulation (GDPR). The SUPPLIER undertakes to comply with the GDPR, applicable since 25 May 2018, and with all other applicable data protection legislation.

E.2 The CLIENT and the SUPPLIER freely agree to regulate the access and processing of data as detailed in this contract (in compliance with article 28 of the General Data Protection Regulation (RGPD)).

E.3 To provide Claimora's services (working-time recording, vacation and sick-leave management, approvals, reports and notifications) and to measure their use in order to maintain and improve them, the SUPPLIER, as processor, is authorized to process on behalf of the CLIENT, as controller, the following personal data of the CLIENT's employees, external collaborators, HR staff and managers:

  • Employee identification data: first, middle and last name, e-mail address, preferred language, worker type (employee or external collaborator), assigned roles (manager, HR) and assigned manager.
  • Account data: password (stored only as a one-way hash), preferred language, account status (invited, onboarded, offboarded), confirmation, invitation and password-reset data and, if the user connects an AI assistant, the authorisations and access tokens of that connection.
  • Employment data: employment type (employee or external), assigned manager, contract name, start and end dates and whether the contract has been terminated, working hours per day, shift times, working days, time zone, annual vacation entitlement, the period after which late time entries require manager approval and, for externals, the maximum contracted hours.
  • Location and usage data: the approximate location derived from the IP address by our network provider Cloudflare (country, region, city, postal code, coordinates and time zone), together with the IP address. It is stored as the user's last location, updated only when the IP address changes, which HR can view and managers can view for their team, and with the start of each time entry and, when the entry is stopped with the clock, its end, which HR can view. The CLIENT can switch location tracking off in the company settings; nothing is then stored and the stored last location is cleared. The log of requests that the app used to keep (time, page, referrer, IP address, approximate location, browser and device) has been deleted from the SUPPLIER's database. Claimora does not use the device's GPS. For each page the app displays to a signed-in user, the SUPPLIER's servers send PostHog the page address and the previous page (without query strings, fragments or credentials), the referring domain, the browser and its version, the operating system, the device type, the internal name of the screen, the interface language and the country derived from the IP address by Cloudflare (left out when location tracking is switched off). These usage data are linked only to the user's numeric ID and the CLIENT's numeric ID and also include the user's employment type, roles and language; they never include the user's name, e-mail address or IP address. When the CLIENT signs up, an event recording the creation of its account is sent with the same identifiers and user details.
  • Working-time and absence data: start and end of each working day, breaks, approvals, corrections and annulments with their change history, vacation days, sick-leave days and the sick-leave notes or medical certificates that employees upload (health data under article 9 GDPR; in the app only the employee who uploaded them can open them). The processing operations are those necessary to provide Claimora's services: collection, hosting, display to authorised users according to their role, exports, e-mail notifications and, to measure the use of the services, the transmission of usage data to PostHog.

E.4 The data stored in Claimora services belong to the CLIENT as controller. For the purposes of article 28 GDPR, the SUPPLIER processes the personal data only on the CLIENT's documented instructions, which consist of providing Claimora's services as described in this contract and measuring their use to maintain and improve them, and does not use them for any other purpose. Authorised SUPPLIER administrators can technically read and modify customer data through internal administration and analysis tools and use this access only when it is needed to provide support requested by the CLIENT, to operate and secure the service or to comply with a legal obligation. The SUPPLIER does not communicate the data to third parties other than the subprocessors it uses to provide the service under E.7 c): Google Cloud (hosting, database and file storage in the EU region europe-west1), Cloudflare (network proxy in front of the application, which also provides the approximate location derived from the IP address), Mailgun (EU email delivery), hCaptcha (bot protection on the sign-up form), Stripe (payment processing) and PostHog (product analytics, EU cloud). If the SUPPLIER uses the data for another purpose, communicates them or uses them in breach of this contract, it will be considered a controller in respect of that processing and will be liable for the infringements it has committed.

E.5 The CLIENT, regarding the files containing personal data, declares that it complies with all the legally required requirements for their collection and treatment. Likewise, it states that it has adopted the technical and organizational measures necessary to guarantee the security of the personal data included in the files, established in the current regulations on the protection of personal data.

E.6 Corresponds to the SUPPLIER

a) Treat the data only in accordance with the CLIENT's instructions as documented in this contract. If the SUPPLIER considers that any of the instructions infringes the RGPD or any other provision on data protection of the Union or of the Member States, the SUPPLIER will immediately inform the CLIENT.

b) Keep, in writing, a record of all categories of treatment activities carried out on behalf of the CLIENT, containing:

  • The name and contact details of the person in charge or managers and of each manager on behalf of whom the manager acts and, where appropriate, the representative of the manager or manager and the data protection officer.
  • The categories of treatments carried out on behalf of each person in charge.
  • Where appropriate, transfers of personal data to a third country or international organization, including the identification of said third country or international organization and, in the case of transfers indicated in article 49 section 1, second paragraph of the RGPD, the documentation of adequate warranties.
  • A general description of the technical and organizational security measures in accordance with the RGPD.

c) The SUPPLIER will notify the CLIENT without undue delay after becoming aware of any personal data breach affecting the CLIENT's data, providing all the information available so that the CLIENT can fulfil its obligations to notify the supervisory authority and to inform the data subjects (articles 33 and 34 GDPR).

d) Upon termination of the contract, the SUPPLIER will, at the CLIENT's choice, return or delete the personal data processed on the CLIENT's behalf and delete existing copies unless Union or Member State law requires their retention. After requesting company closure, the CLIENT has 30 days to download the company export ZIP from HR, confirm receipt and report missing files or data to team@claimora.com. The export respects the requester's permissions and does not grant access to other people's medical supporting documents. At the end of those 30 days, access to the account and its integrations, including the ZIP download, is blocked; this does not delete data or change sick leave records. Erasure and the handling of copies require a separate review of the CLIENT's instructions and retention obligations; they do not run automatically when access is blocked. The SUPPLIER will document the data and copies that must be retained, the reason and the next review, and will not use them for other purposes. Subscription non-renewal is checked separately where applicable.

E.7 Corresponds to the CLIENT:

a) The CLIENT must adopt the necessary technical and organizational measures to guarantee the security of personal data and avoid its alteration, loss, treatment or unauthorized access, taking into account the state of technology, the nature of the data. stored and the risks to which they are exposed, whether they come from human action or from the physical or natural environment.

b) It is the responsibility of the Client (i) to keep a record of registration activities; (ii) carry out an evaluation of the impact on the protection of personal data of the processing operations to be carried out by the person in charge; (iii) carry out the corresponding prior consultations; (iv) ensure, previously and throughout the treatment, compliance with the RGPD by the person in charge; (v) supervise the treatment, including the performance of inspections and audits; and, (vi) sign with the clients who are going to use Claimora's services, the mandatory contract where the SUPPLIER is informed of the subcontracting of the services mentioned in this contract.

c) The CLIENT gives the SUPPLIER general authorisation to engage the following subprocessors: Google Cloud (application hosting, database, file storage, task queue and logs; the application, database and task queue run in the europe-west1 region, Belgium), Cloudflare (network proxy in front of the application, which also provides the approximate location derived from the IP address), Mailgun (e-mail delivery, EU region), Stripe (subscription payment processing), hCaptcha (bot protection on the sign-up form), and PostHog (product analytics; PostHog, Inc. is a US company and the SUPPLIER's project is hosted in PostHog's EU cloud; it receives the usage data described in E.3 from the SUPPLIER's servers, never the users' IP addresses). The SUPPLIER will inform the CLIENT in advance of any intended addition or replacement of subprocessors, giving the CLIENT the opportunity to object. Where a subprocessor processes personal data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

d) The SUPPLIER will enter into a contract with each subprocessor that imposes on it the same data protection obligations as this contract imposes on the SUPPLIER (Article 28(4) GDPR). The SUPPLIER will inform the CLIENT in advance of any intended addition or replacement of a subprocessor, giving the CLIENT the opportunity to object to such changes (Article 28(2) GDPR). Apart from the subprocessors listed in E.7 c), the SUPPLIER will not disclose the personal data processed on the CLIENT's behalf to third parties unless required to do so by Union or Member State law.

e) The CUSTOMER will duly attend to the notifications that, where appropriate, it receives from the SUPPLIER regarding data processing; in particular, those related to subcontracting of the treatment, security violations and instructions given by THE CLIENT that, in the opinion of the SUPPLIER, infringe the data protection regulations.

f) The SUPPLIER will assist the CLIENT in responding to the exercise of rights. When the affected persons exercise before the SUPPLIER the rights of access, rectification, deletion, opposition, limitation of the treatment and / or data portability, the SUPPLIER will notify this fact to the CLIENT as soon as possible. It will be the responsibility of the CLIENT to respond to the affected party, although the SUPPLIER will be obliged to collaborate and provide as much information as the CLIENT requires to meet the request.

F — Accommodation of Claimora Services

F.1 The information entered in Claimora's services is hosted on Google Cloud (the "HOSTING PROVIDER") in data centres located in the European Union: the application runs on Cloud Run and background jobs on Cloud Tasks in the europe-west1 region (Belgium), the database on Cloud SQL for PostgreSQL, and uploaded attachments are stored in a private Cloud Storage bucket that is accessible only through time-limited signed links.

F.2 The HOSTING PROVIDER is Google Cloud, which the SUPPLIER engages to host the Claimora services in its europe-west1 region (Belgium, European Union). Google Cloud acts as a sub-processor of the SUPPLIER for this hosting. In accordance with Article 28(4) GDPR, the SUPPLIER remains fully liable to the CLIENT for the performance of its sub-processors' data protection obligations.

F.3 The application, its database and the files uploaded to Claimora are hosted within the European Union (Google Cloud, region europe-west1). Traffic to Claimora passes through Cloudflare's global network, and its product analytics provider PostHog (a US company; the SUPPLIER's project is hosted in PostHog's EU cloud) may process limited technical and usage data outside the European Union; any such transfer is made only with the safeguards required by Chapter V of the RGPD.

F.4 Access and Audit

F.4.1 The SUPPLIER will provide credentials and access codes to the personnel registered by the CLIENT.

F.4.2 The SUPPLIER records the requests made to the Claimora web application in its server logs and keeps a change history (what changed, when and, since 16 October 2026, which user made the change) of employees' working-time records. Database queries made by SUPPLIER staff through the internal analysis tool are also logged. Other accesses and actions are not currently covered by an audit log.

F.4.3 The CLIENT and its registered personnel are responsible for keeping their credentials secret. In no case will the SUPPLIER be responsible for data modified, deleted, extracted or viewed by accessing Claimora with said credentials.

F.4.4 SUPPLIER personnel access the Claimora application only with individual, personal user accounts that hold the administrator role, and these accounts stop working as soon as they are deactivated. Whether through the application or the underlying infrastructure, SUPPLIER personnel will access customer data only to the extent necessary to develop, operate and support the Claimora services.

F.5 Assignment

The Purpose of this contract is personal. The SUPPLIER may, after complying with all the requirements contemplated in the current regulations, as well as prior communication to the CLIENT, assign ownership of the same without the need to obtain express consent from the CLIENT, without prejudice to the right to terminate the contract within the 10 days following receipt of the assignment notification.

G — Intellectual Property and Industrial Property

G.1 The SUPPLIER (and its licensors where applicable) is the owner of all rights and interests, including all those related to intellectual property rights in the technology, content, platform and services of the SUPPLIER and of any suggestion, idea, request for improvement, comment, recommendation or any other information that registered users or any other related party have offered through Claimora's services and its associated services and components.

G.2 The name of Fodoj GmbH, Claimora, the logo of Fodoj GmbH, and the logo of Claimora are trademarks of the SUPPLIER or third parties and no right or license is granted for their use.

H — Responsibility

H.1 To access Claimora's services, one-person authentication systems are provided, both for administrators and registered users of the CLIENT.

H.2 The Client is responsible for all damages that may occur to himself, to third parties or to the SUPPLIER himself and that have been derived from his lack of secrecy regarding access and / or authentication data, both of administrators as registered users by the CLIENT himself.

H.4 Neither party, individually, shall have any responsibility for the obligations of said party for indirect, special, consequential, punitive, exemplary or incidental damages, including damages for business interruption of the other party or losses.

H.3 The responsibility of each of the parties that arises as a result of this contract and in relation to it (for any effect and any type of claim) will not exceed the payments received by the SUPPLIER during the 12 months following said obligation or liability (as applicable).

H.5 The existence of more than one claim or cause of action shall not extend the limits of this section J. The SUPPLIER shall not be subject to any equitable remedy in favor of the CLIENT such as judicial redress, specific compliance or judicial administration.

I — Confidentiality

The SUPPLIER must maintain due professional secrecy regarding the personal data to which it has access and demand the same level of commitment in writing from any person within its organization who participates in any phase of the processing of personal data, both during their relationship professional with the CLIENT, as once it has been completed for any reason.

J — Integrity of the Contract and Safeguard Clause

J.1 Each of the stipulations of this contract must be interpreted separately and independently of the others. If any of them become invalid, illegal or unenforceable by virtue of any legal norm or were declared null or ineffective by any court or administrative authority, the nullity or ineffectiveness of the same will not affect the other stipulations, which will retain their full validity and effectiveness. The parties agree to replace the affected clause or clauses with another or others that have the corresponding effects for the purposes pursued by the parties in this contract.

J.2 This contract includes all the existing agreements between the parties, and cancels and revokes, where appropriate, any other agreements or agreements, verbal or written, that were in force on the date of their subscription. This contract may be modified by written agreement of the parties.

K — Termination

K.1 The SUPPLIER may terminate the contract if the account has been 30 NATURAL DAYS without any type of use, prior notice by email to its administrators.

K.2 The termination of the contract does not exempt the parties from complying with those obligations that they have acquired.

L — Applicable Legislation and Jurisdiction

L.1 This contract is governed by the law of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods (CISG). Mandatory provisions of data protection law, in particular Regulation (EU) 2016/679 (GDPR), remain unaffected.

L.2 To the extent legally permissible, the exclusive place of jurisdiction for all disputes arising from or in connection with this contract is Munich, Germany, provided that the CLIENT is a merchant, a legal entity under public law or a special fund under public law. The SUPPLIER is also entitled to bring an action against the CLIENT at the CLIENT's general place of jurisdiction.

L.5 Where the Client is a merchant, a legal entity under public law or a special fund under public law, or has no general place of jurisdiction in Germany, the exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is Munich, Germany. Any mandatory statutory place of jurisdiction remains unaffected.

M — PRICE

The price of the application depends on the number of employees of each company. The first 10 (ten) employees per company are free forever; beyond that, prices are as follows (VAT not included):

Up to 10 employees: FREE FOREVER.

Standard plan, up to 100 employees and 10 externals: 5 €/month or 50 €/year.

Business plan, up to 1,000 employees and 100 externals: 20 €/month or 200 €/year.

Paid plans are charged in advance, monthly or yearly depending on the chosen plan, by card or another payment method accepted through Stripe, our payment provider. The subscription renews automatically at the end of each period and can be cancelled from the billing portal. If a payment does not go through, the company falls back to the free plan limits until the payment is settled. Falling back to the free plan does not delete any data.

Support

Support is provided by e-mail at team@claimora.com. All plans receive the same support, and no specific response times are guaranteed.

Data Backups

Fodoj GmbH keeps backups of the Claimora database in Google Cloud for disaster recovery.

Audit and Traceability

Claimora keeps a change history for employees' working-time records, showing which fields changed, their previous and new values, and when. HR and the employee's manager can view it. Deleted time entries are not erased: they are marked as annulled, optionally with a note, and remain visible to HR. Changes to absences, contracts, user accounts and external users' time entries are not versioned. Since 16 October 2026 the change history also records which user made each change; other actions taken by Fodoj GmbH staff in the administration panel are not logged.

It is not possible to delete the audit log from Claimora SaaS.

Claimora does not delete data automatically. While the contract is in force, working-time records cannot be erased from within the app and remain available to the CLIENT, who, as controller, is responsible for complying with the statutory retention periods (for example, 4 years in Spain and at least 2 years in Germany). On termination of the contract, the personal data is deleted or returned to the CLIENT as set out in section E.6 d).

User access control to Claimora SaaS

Passwords must be between 6 and 128 characters long and are stored only as one-way (bcrypt) hashes.

In case of forgetting the password, the email indicated by the client for its users is used to recover the account.

Requests to the app, including sign-in requests, are recorded in the server logs with their time.

Fodoj GmbH access control to Claimora SaaS

When Fodoj GmbH staff access Claimora SaaS for the processing of customer data, the following security measures are applied:

  • Fodoj GmbH staff access the application through individual, named user accounts with the administrator role, protected by email and password.
  • Fodoj GmbH personnel can only access the platform's administration area through an active account with the administrator role; that access ends as soon as the account is deactivated.
  • Queries that Fodoj GmbH staff run in the internal data analysis tool are logged, including the user, the query and the time.

Claimora runs on managed Google Cloud services (Cloud Run and Cloud SQL for PostgreSQL) in the europe-west1 region (Belgium); the PROVIDER does not operate its own virtual machines. Automated deployments authenticate with short-lived credentials (workload identity federation) instead of stored keys, and administrative access to the infrastructure is restricted to authorised Fodoj GmbH personnel.

There are other purposes for which we treat your personal data:

  • To guarantee compliance with the conditions of use and applicable law. This may include the development of tools and algorithms that help this website to guarantee the confidentiality of the personal data it collects.
  • To support and improve the services offered by this website.
  • The Claimora app uses cookies to keep users signed in (session and, if chosen, "remember me"); the usage measurement with PostHog is carried out from our servers and uses no cookies or other browser storage. These data are processed as set out in the privacy policy. The claimora.com website does not set cookies of its own.
  • To manage social networks. Fodoj GmbH may have a presence on social media. The treatment of the data that is carried out of the people who become followers in the social networks of the official pages of https://claimora.com , will be governed by this section. As well as those conditions of use, privacy policies and access regulations that belong to the social network that is appropriate in each case and previously accepted. It will process your data for the purposes of correctly managing your presence on the social network, reporting activities, products or services of Fodoj GmbH. As well as for any other purpose that the regulations of social networks allow. In no case will we use the profiles of followers on social networks to send advertising individually.

Fodoj GmbH does not sell or rent personal data. It only shares them with third parties with prior consent, with the service providers that process them on its behalf (hosting, email delivery, payment processing, error monitoring and product analytics), where necessary to provide the contracted service, or when required by law.

Legitimation for the treatment of your data

The legal bases for the processing of your data are: the performance of the contract with the CLIENT (Article 6(1)(b) GDPR) for the CLIENT's account, subscription and billing, together with our legitimate interest in managing the business relationship with the CLIENT's contact persons (Article 6(1)(f) GDPR); our legitimate interest in operating, securing and improving the service (Article 6(1)(f) GDPR); compliance with legal obligations, such as commercial and tax record-keeping (Article 6(1)(c) GDPR); and consent where we expressly ask for it (Article 6(1)(a) GDPR). For the personal data of the CLIENT's staff processed in Claimora, Fodoj GmbH acts as processor on behalf of the CLIENT (Article 28 GDPR), and the legal basis is determined by the CLIENT as controller; for working-time records, this is usually the CLIENT's legal obligation to record working time.

If you contact us by email (team@claimora.com) or by phone (+49 89 54197048), we process the data you provide only to answer your request. The legal basis is the taking of steps prior to entering into a contract (Art. 6(1)(b) GDPR) or, for other enquiries, our legitimate interest in replying to you (Art. 6(1)(f) GDPR).

The prospective or commercial offer of products and services is based on the consent that is requested, without in any case the withdrawal of this consent conditioning the execution of the subscription contract.

Data Category

The categories of data that are treated are:

  • identifying data;
  • employment data;
  • working-time and absence data;
  • connection and usage data (IP address, approximate location derived from it, browser, operating system and device type, pages visited and the previous page).

Health data, a special category of personal data under Article 9 GDPR, are processed only on behalf of the CLIENT: the sick-leave days and the sick notes or medical certificates that employees upload. Claimora does not ask for a diagnosis, and in the app only the employee who uploaded a document can open it.

Navigation

The links on Fodoj GmbH sites may take you to external pages over which the company has no control. Therefore, the content, accuracy, updating, modification or purpose of other websites is not the responsibility of Fodoj GmbH.

Neither claimora.com nor the Claimora app uses Google Analytics. claimora.com uses no other third-party analytics service either; the Claimora app measures its use with PostHog, from our own servers and without any analytics script in your browser, as described below. The website and the app serve the Rubik font from our own servers, not from Google Fonts. The pricing page loads Stripe's pricing table from Stripe's servers. In the app, some scripts and stylesheets are loaded from the jsDelivr and JSPM content delivery networks, the sign-up page uses hCaptcha to block bots, and the pages of the HR area load Stripe's payment library (Stripe.js). Each of these providers receives your IP address and technical data about your browser when your browser connects to it.

When you use the Claimora app (app.claimora.com), our server sends PostHog one page-view event for each page the app successfully displays in your browser, including the sign-in, sign-up, password recovery and invitation acceptance pages. The event contains the page address and the previous page without query strings, fragments or credentials, the referring domain, your browser and its version, operating system and device type, the internal name of the screen, the interface language and the country that Cloudflare derives from your IP address (left out for signed-in users whose company has switched location tracking off). For signed-in users these events are linked only to the numeric user ID and the company's numeric ID, never to your name, e-mail address or IP address, and they also carry the user's employment type (employee or external), roles and language; when a company signs up, an event recording its creation is sent with the same identifiers and details. For visitors who are not signed in, the events are linked to a pseudonymous identifier that our server calculates from the IP address and the browser's user agent with a secret key and the current date, so it changes every day and the IP address cannot be read from it; PostHog creates no profile for these visitors. PostHog never receives your IP address, and these data currently have no defined deletion period. For signed-in users the app also stores the IP address and approximate location of the last request (country, region, city, postcode, coordinates and time zone), which are also copied onto time entries, unless the company has switched location tracking off; HR can see these locations in the app and managers can see the last location of their team, but AI assistants connected to Claimora cannot access them. The activity log the app used to keep in our own database has been deleted from it. The claimora.com website does not include analytics or tracking scripts. Our hosting provider Cloudflare processes technical connection data, such as IP addresses, to deliver and protect the website.

Secret and data security

https://claimora.com is committed to the use and treatment of the personal data of the users, respecting their confidentiality and using them in accordance with the purpose thereof, as well as to comply with their obligation to save them and adapt all the measures to prevent alteration, loss, treatment or unauthorized access, in accordance with the provisions of current data protection regulations.

This website includes an SSL certificate. It is a security protocol that makes your data travel in an integral and safe way, that is, the transmission of data between a server and web user, and in feedback, is fully encrypted or encrypted.

https://claimora.com can not guarantee the absolute inaccessibility of the Internet network and therefore the violation of data through fraudulent access to them by third parties.

Regarding the confidentiality of the processing, Fodoj GmbH will ensure that any person who is authorized by Fodoj GmbH to process the user's data (including its staff, collaborators and providers) is under an appropriate obligation of confidentiality (either a contractual or legal duty).

When a security incident occurs, when Fodoj GmbH becomes aware, it must notify the user without undue delay and must provide timely information related to the Security Incident as it is known or when the user reasonably requests it.

Accuracy and veracity of the data

As a user, you are solely responsible for the veracity and correctness of the data you send to https://claimora.com , exonerating Fodoj GmbH, from any responsibility in this regard.

Users guarantee and respond, in any case, to the accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated. The user agrees to provide complete and correct information through any enabled communication channel.

Acceptance and consent

The user declares that they have been informed of the conditions on the protection of personal data and of the processing of such data by Fodoj GmbH in the manner and for the purposes indicated in this privacy policy.

Revocability

Where processing is based on consent, you may withdraw that consent at any time by writing to Fodoj GmbH at team@claimora.com. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Personal data that Fodoj GmbH processes on behalf of a customer (for example, employee data entered into Claimora by an employer) is processed on that customer's instructions, and requests about that data should be addressed to the customer.

Changes to the privacy policy

Fodoj GmbH reserves the right to modify this policy to adapt it to new legislation or jurisprudence, as well as to industry practices. In these cases, Fodoj GmbH will announce on this page the changes introduced with reasonable anticipation of their implementation.

Commercial emails

In accordance with the Spanish LSSICE and the German Unfair Competition Act (UWG), Fodoj GmbH does not send commercial e-mails without the recipient's prior consent. Claimora currently has no newsletter and sends no advertising e-mails. The automatic e-mails Claimora sends from team@claimora.com are service e-mails only, such as account confirmations, invitations, password reset and password change notices, and approval or absence notifications.

In accordance with the provisions of Law 34/2002 on Services of the Information Society and electronic commerce, https://claimora.com undertakes not to send communications of a commercial nature without properly identifying them.