Privacy Policy

LightLink ("we", "us") provides workforce-tracking software to companies ("Customer") who deploy our agent on employee devices. This policy explains what we collect, why, and how Customers and their employees can control it.

1. Roles

Under GDPR and similar regimes the Customer is the data controller and LightLink is the data processor. We act on the Customer's instructions only. The Data Processing Agreement (DPA) governs that relationship.

2. What we collect

From employees of our Customers (data subjects)

• Account info: name, email, employee ID, department, role.
• Activity tracking: per-application time, foreground window titles, URL domains, mouse and keyboard activity counts (not contents).
• Screenshots: periodic captures of the active screen, configurable per-employee. Sensitive apps are auto-blurred when the employee enables it.
• Attendance & productivity scores: derived from activity logs.
• Device info: hostname, OS version, agent version, IP address at login.

What we explicitly DO NOT collect

• Contents of files you open or edit.
• Audio, microphone, or webcam footage.
• Passwords typed into apps (we count keystrokes only, not their values).
• Activity outside scheduled work hours.
• Activity from apps an employee has added to their exclusion list.

3. Why we collect it

• Provide the workforce-tracking service the Customer subscribed to.
• Generate productivity reports, attendance records, and AI-flagged anomaly insights.
• Keep accounts secure (login alerts, GeoIP-based anomaly detection).
• Bill the Customer accurately based on subscribed plan and seat count.

4. Where it lives

Each Customer's data sits in an isolated tenant database under their unique subdomain. Data is stored within the LightLink infrastructure region the Customer was provisioned in. Customers on Business+ plans may opt to bring their own AWS S3, SFTP, or Azure storage for screenshot files.

5. Who can see it

• Tenant administrators: full access to their employees' tracked data.
• Employees: their own data plus configurable settings — see the Privacy Center in the admin panel.
• LightLink staff: only when troubleshooting at the Customer's request, and never to view individual employee screenshots.

6. Your rights as an employee

You may at any time:

• View exactly what's tracked about you (Privacy Center in the admin panel).
• Download a JSON archive of all data we hold (Privacy Center → Download my data).
• Request blurring of screenshots from sensitive apps (banking, password managers, personal email).
• Exclude specific apps from screenshot capture entirely.
• Request correction or deletion by contacting your tenant administrator (the Customer is the controller and must process your request).

7. Retention

Activity data, screenshots, and heartbeats are retained per the Customer's data_retention_days setting (default 90 days). Audit logs persist for the life of the subscription. On termination, all tenant data is purged within 30 days of contract end unless the Customer requests an export beforehand.

8. Security

See our Security Practices page. Highlights: TLS 1.2+ in transit, encrypted backups, role-based access, audit logging of every mutation, per-tenant database isolation.

9. Changes to this policy

We will email the Customer admin contact at least 30 days before a material change takes effect.

10. Contact

Questions: privacy@lightlink.uludeveloper.top. Data Protection Officer: dpo@lightlink.uludeveloper.top.