Privacy policy

Last updated: 4 October 2026.

This policy describes the personal data Slog-app processes, why, who it is shared with, how long it is kept and how to exercise your rights. It covers the website, the application, the API and the MCP server that lets you connect Slog-app to an AI assistant such as ChatGPT or Claude.

1. Data controller

Oxolyn Lab, SIRET 93778233200012, reachable at hello@oxolyn-lab.com.

2. Data we collect

Account holders

  • Account: email address, first and last name, your password in hashed form if you set one, the sign-in provider you used (Google, GitHub or LinkedIn) and the identifier of that account, preferred language and time zone, notification preferences, date and IP address of your latest sign-ins.
  • Time tracking: your time entries (description, start, end, project), your projects, clients, tags and notes, and your working hours.
  • Teams: the teams you belong to and your role in them, and the email addresses of the people you invite. Within a team, your name, email address and the time you log there are visible to the other members according to their role.
  • Billing: the state of your subscription, your payment history and the billing details you ask us to print on invoices. Card details are entered at Stripe and never pass through our servers.
  • Referrals: the link between the referring and the referred account, and the amount credited.
  • API and AI assistants: the API tokens you create and when they were last used, the name of each connected application and the access tokens issued to it (see section 5).
  • Support and newsletter: the messages you exchange with us, and your email address if you subscribed to the newsletter.

Website visitors

Audience measurement is provided by Plausible, without cookies and without any data that identifies a visitor. The pages also load the LinkedIn Insight Tag, which measures the results of our LinkedIn campaigns: LinkedIn receives the address of the page visited, the IP address and the browser, and may set cookies.

3. Purposes and legal bases

  • Providing the service (account, time tracking, teams, dashboards, exports, API, connecting an AI assistant): performance of the contract.
  • Billing the subscription and keeping accounts: performance of the contract and legal obligation.
  • Sending service emails (reminders and weekly reports, which you can switch off in your notification settings): performance of the contract.
  • Securing the service, fixing errors, answering support requests and measuring the audience: legitimate interest.
  • Sending the newsletter: consent, which you can withdraw at any time from any issue.

Your time entries, projects and clients are never sold, used for advertising, or used to train an artificial intelligence model.

4. Recipients and processors

Data is accessible to the Slog-app team and to the following providers, each for the sole task entrusted to it:

  • OVH — hosting of the application and its database, in France.
  • Scaleway — file storage and backups, in France.
  • Stripe — payments and invoicing.
  • Mailjet — sending emails and the newsletter.
  • AppSignal — error and performance monitoring.
  • Chatwoot — support chat. When you are signed in, your name and email address are passed to it so that we know who is writing.
  • Gravatar — profile pictures. Your browser requests the picture using a one-way hash of your email address.
  • Plausible — cookieless audience measurement.
  • LinkedIn — measuring our LinkedIn campaigns through the Insight Tag.
  • Slack — internal notifications when an account, a team, a project or a client is created, or an export is run.

The sign-in provider you choose (Google, GitHub or LinkedIn) sends us your email address and name; we send nothing back to it.

5. Connecting an AI assistant (ChatGPT, Claude…)

You can connect your Slog-app account to an MCP-compatible AI assistant, such as ChatGPT or Claude, to read and edit your time entries, projects, clients, teams and working hours in conversation.

  • The connection only happens after your explicit approval, on a Slog-app consent screen. The assistant can only reach what your own account can reach, with the same rights you have in the application.
  • The data the assistant asks for — your name and email address, your time entries, projects, clients and working hours, and the teams you belong to with their members and invitations — is sent to it and is then processed by the assistant’s provider (for example OpenAI for ChatGPT or Anthropic for Claude), under that provider’s own privacy policy.
  • Slog-app does not receive your conversations: only the requests the assistant makes to our tools.
  • An access token expires after two hours. To end the connection sooner, disconnect Slog-app in the assistant’s settings, or write to us to revoke every access you granted.

6. Retention

  • Account and time tracking data: for as long as the account exists. Deleting the account from your settings immediately erases it together with your time entries, projects and clients.
  • Accounts whose email address was never confirmed: deleted after two weeks.
  • Backups: fifteen days.
  • Invoices: ten years at Stripe, as our accounting obligations require.
  • Exports: sent to you by email and not kept on our servers.
  • Log of our team’s interventions on an account: the email address of the account concerned is kept in it, so that we can account for those interventions.
  • Newsletter: until you unsubscribe.

7. Transfers outside the European Union

The application and its data are hosted in France. Some providers listed in section 4 (notably Stripe, Chatwoot, Gravatar, LinkedIn and Slack) may process data in the United States; these transfers rely on the European Commission’s standard contractual clauses or on the EU–US Data Privacy Framework.

8. Cookies

The application sets the cookies it needs to work: the session of a signed-in user, the one that keeps you signed in if you ask for it, the time zone of your browser and the tips you dismissed. If you open the support chat, Chatwoot sets a cookie that remembers the conversation. The LinkedIn Insight Tag may set LinkedIn’s own cookies. Audience measurement uses none.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw your consent at any time. Write to us at hello@oxolyn-lab.com; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL.

10. Changes

This policy may change. The date of the latest update appears at the top of this page, and any significant change is brought to the attention of account holders.

¿Quieres seguir nuestras noticias, actualizaciones y ofertas especiales?

Regístrate para recibir nuestro Boletín