GDPR and works council review
ActivityPulse is designed for review under GDPR Article 88 and by a European works council: sensitive capture is off by default, keystroke content is never recorded, a narrower scope can never widen a broader one, and every configuration change is audited. It is not certified by any body — no such certification exists for this category — so what follows is the design, stated plainly enough to be checked.
What a vendor can and cannot promise
Worth being direct about, because the category is not.
Compliance is a property of a deployment
Compliance is a property of a deployment — your lawful basis, your works council agreement, your retention policy, your configuration — not a property of a product. Any vendor claiming to hand you compliance in a box is describing something that does not exist, and a data protection officer will know that within a minute of asking.
Compliant defaults, transparent architecture
What a product can do is make the compliant configuration the default, make the non-compliant one difficult, and make the whole thing inspectable. That is what the rest of this page describes.
Article 88 and the principle of minimisation
Article 88 lets member states set their own rules for processing employee data, and most set them tighter than the GDPR baseline. The common thread across those regimes is proportionality: collect what the purpose requires and no more.
ActivityPulse's purpose is attributing hours to projects. That needs to know which application was in front of a person and for how long. It does not need to know what they typed, what was on their screen, or what their webcam saw — so none of that is collected, and the most invasive capabilities are gated rather than offered as a switch.
The questions a works council asks
With the answers, in the order they usually come.
- Does it record keystrokes? No — keystroke content is never captured on any plan.
- Does it take random screenshots? No — screenshots are disabled by default and gated behind an organisation-level setting.
- Can a manager watch a live screen? No — there is no live streaming capability.
- Does it calculate a productivity score? No — ActivityPulse attributes hours, it does not score humans.
- Can an employee see what was captured? Yes — /my-data in the console lists the settings in force, and their own timesheets show the recorded activity.
- Can an employee pause tracking for personal time? Yes — the agent includes a pause control.
What is never captured
Guaranteed across all plans and configurations.
- Keystroke content — what you type is never recorded, on any plan.
- Webcam or microphone — the agent has no access to either.
- Continuous screen recording — there is no session replay or video capture.
- Personal file contents — the agent reads window and process metadata, not documents.
- Browsing on a paused device — pausing capture stops collection, it does not hide it.
Data subject rights
- rtbf
- An erasure deletes the person's captured activity and the raw archive it came from, and anonymises the account itself — name, address, devices and memberships go with it; approved timesheets are kept as payroll evidence unless the organisation turns that off.
- transparent-agent
- By default the person being monitored can see what is being captured on their own machine and can pause capture. The one exception is a covert investigation, which is Enterprise-only, unavailable in the EU, capped at 90 days, and audited.
- audited-config
- Every change to what an organisation captures is written to an audit log with who changed it and when.
Scope, retention and residency
Retention is bounded per organisation rather than accumulating by default, and capture can be limited to a working-time window. Data residency options are available from the Teams plan upwards; the current default region and the full list of sub-processors are published on the sub-processors page.
The processing terms we offer as processor under Article 28 are on the data processing agreement page.
Frequently asked questions
Does ActivityPulse need employee consent under GDPR?
Consent is usually the wrong lawful basis in an employment relationship because of the imbalance of power between employer and employee. Most European deployments rely on legitimate interests (Article 6(1)(f)) combined with a works council agreement, where metadata-only capture makes the proportionality test much easier to meet than screenshotting or keystroke logging.
Can employees see what is being captured about them?
Yes. The console carries a page — /my-data — that lists what is captured under the settings in force for that person, with no administrator in the middle and no role required to open it. The same console gives each person access to their own timesheets.
How does erasure (right to be forgotten) work?
An organisation admin can trigger erasure for a member. This deletes their user record and purges their activity rows from the organisation database, leaving an audit record that the erasure happened.
Can a manager turn on screenshots for one person?
No. Screenshots are disabled at the organisation level by default, and narrower scopes (teams, members) can only restrict settings further, never expand them. If screenshots are off for the organisation, no manager can enable them for an individual.
Where is data stored?
By default in Cloudflare D1 in the United States — East. From the Teams plan an organisation can choose United States — West, Asia-Pacific or Oceania instead, and its database is created there. Residency within the European Union is built but not offered yet; if you need it, tell us before you contract.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.