Privacy Policy

Last updated 2026-09-06

This policy explains what information Spaulding Labs LLC collects through MetalTrack Time, how we use it, and the choices you have. It covers the MetalTrack Time web portal, the time-clock apps and devices, and our connection to QuickBooks Online.

Information we collect

• Account information — the email address and password (stored only as a hash) of each portal user, and two-factor authentication secrets, which are encrypted at rest.
• Business identifiers — your assigned Business ID and, after you connect QuickBooks, your QuickBooks company name, company ID (realm), and time zone.
• Employee information from QuickBooks Online — employee display names and QuickBooks employee IDs, so you can select who uses the time clock. Names are encrypted at rest.
• Time-clock data — clock-in / clock-out events (employee, time, and the device used), and the daily hour totals derived from them.
• Payment information — handled by our payment processor (Stripe). We store only a customer/subscription reference and billing status, never full card numbers.
• Technical logs — IP addresses and timestamps for sign-in attempts and security events, kept for abuse prevention.

QuickBooks Online data

When you connect MetalTrack Time to QuickBooks Online we receive OAuth tokens that let us read your employee list and company info and write time activities. Tokens are encrypted at rest and are used only to provide MetalTrack Time. We request the accounting scope only. You can disconnect at any time from within QuickBooks or from MetalTrack Time; on disconnect we revoke the tokens and stop accessing your company. We do not use QuickBooks data for advertising and we do not sell it.

How we use information

• To operate the time clock and sync hours to your QuickBooks company.
• To authenticate users and devices and secure accounts.
• To bill your subscription and communicate about your account.
• To detect and prevent abuse, fraud, and security incidents.

Data retention

Raw clock events are retained for about one week after they have been synced to QuickBooks Online, then deleted. A minimal audit record (employee, work date, total hours, and the QuickBooks time-activity reference) is kept longer so we can confirm what was sent. Account and billing records are kept for the life of the account and a short period afterward, then deleted; a pre-deletion export is available on request.

Sharing

We share information only with: Intuit (QuickBooks Online), as needed to provide the integration; our payment processor for billing; and our infrastructure/hosting providers. We may disclose information if required by law or to protect our rights or users’ safety. We do not sell personal information.

Security

Data is transmitted over TLS and stored on a dedicated server with tenant isolation enforced at the database level. Sensitive fields (employee names, clock PINs, QuickBooks tokens, two-factor secrets) are encrypted at rest with per-customer keys. Access to production systems is restricted and network-gated.

Your choices

• You can disconnect QuickBooks Online at any time.
• You can remove employees, users, and devices from the portal.
• You can request access to, correction of, or deletion of your account data by contacting us. We will respond consistent with applicable law.

Children

MetalTrack Time is a business tool and is not directed to children under 13.

Changes

We may update this policy; material changes will be posted here with a new date and, where practical, emailed to account owners.

Contact

Spaulding Labs LLC — support@metaltrack.net