docket.rocks
DE Create your workspace

Privacy Policy

How we collect, use, store, disclose and protect personal data.

Last updated: October 21, 2026

1. Introduction

This Privacy Policy explains how Evernow GmbH ("docket", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data when you visit our website, create an account, use the docket platform, communicate with us, or otherwise interact with our services.

docket is a cloud-based agency management platform for professional users, including agencies, freelancers, consultants, and other businesses. The platform enables users to manage projects, tickets, customer and contact data, time tracking, quotations, invoices, file uploads, reports, and connections to AI apps that users connect themselves.

This Privacy Policy applies to:

  • visitors of our website;
  • account administrators and users of the docket platform;
  • customers, prospective customers, suppliers, and business contacts;
  • individuals whose personal data is entered into docket by our customers.

2. Controller

Evernow GmbH
Dreieichstraße 59
60486 Frankfurt am Main
Germany

Commercial Register: AG Frankfurt am Main, HRB 54195
VAT ID: DE220772379
Email: [email protected]

3. Data Protection Officer

We have not appointed a data protection officer at this time. If we become legally required to appoint one, we will update this Privacy Policy accordingly.

4. Roles Under Data Protection Law

4.1 Where We Act as Controller

Evernow GmbH generally acts as controller for personal data that we process for our own purposes, including:

  • website operation;
  • account registration and administration;
  • customer relationship management;
  • billing and payment administration;
  • transactional communication;
  • support requests;
  • security monitoring;
  • service improvement;
  • legal and compliance purposes.

4.2 Where We Act as Processor

For personal data that customers upload, enter, store, or otherwise process within docket as part of their own business workflows, the customer generally acts as controller and Evernow GmbH acts as processor.

Such processing is governed by our Data Processing Agreement (DPA), unless a separate written data processing agreement has been concluded.

5. Professional Use Only

docket is intended for professional and commercial use by businesses, agencies, freelancers, consultants, and similar professional users. It is not intended for private consumer use.

6. Categories of Personal Data We Process

Depending on your interaction with us and the platform configuration, we may process the following categories of personal data.

6.1 Account and User Data

  • name;
  • email address;
  • password hash;
  • user role;
  • organization or workspace membership;
  • authentication and login records;
  • account settings;
  • for the person who signs up a workspace: the time, IP address and version of the Terms of Service and Privacy Policy accepted at signup.

6.2 Organization and Billing Data

  • company or business name;
  • business address;
  • billing address;
  • VAT or tax information;
  • subscription plan;
  • payment status;
  • invoice and billing records.

6.3 Customer and Contact Data Entered Into docket

Customers may enter personal data relating to their own customers, prospects, suppliers, contractors, employees, or other contacts, including:

  • names;
  • business email addresses;
  • telephone numbers;
  • company details;
  • addresses;
  • notes;
  • communication history;
  • project-related information.

6.4 Project, Ticket, Time Tracking, Quotation, and Invoice Data

docket may process personal data contained in:

  • projects;
  • tickets;
  • ticket comments;
  • internal notes;
  • time entries;
  • work logs;
  • employee records;
  • quotations;
  • invoices;
  • reports;
  • project budgets and billing information.

6.5 Uploaded Files

Users may upload files such as:

  • PDF files;
  • invoices;
  • contracts;
  • spreadsheets;
  • images;
  • documents;
  • attachments to tickets or projects;
  • other business-related files.

Uploaded files may contain personal data or confidential business information depending on the customer's use of the platform.

6.6 Transactional Communication Data

We may process data necessary to send transactional emails, including:

  • account invitations;
  • password reset emails;
  • login or security notices;
  • billing notices;
  • invoices;
  • subscription notices;
  • system notifications;
  • ticket or comment notifications;
  • administrative notifications to account administrators;
  • replies a user sends to a notification email, which docket adds as a comment when they come from that user's address.

6.7 Payment Data

Payments are processed by Stripe. We generally do not store full credit card numbers ourselves. Stripe may process payment details, billing information, cardholder information, transaction data, and related fraud prevention information.

6.8 Technical, Log, and Diagnostic Data

We may process technical data such as:

  • IP address;
  • browser type and version;
  • operating system;
  • device information;
  • timestamps;
  • authentication logs;
  • application logs;
  • error reports;
  • crash reports;
  • diagnostic information;
  • security-relevant events.

Our servers send their logs, including the IP addresses of incoming requests, together with performance data and error reports to our monitoring provider AppSignal. Errors that occur in your browser while you use docket are reported to AppSignal as well: the error message and technical details of the error, browser and operating system, and the domain of the page — not its path, and no user ID, email address or name. AppSignal stores this data in the EU and deletes it after 30 days.

All requests to docket.rocks and to the docket application pass through Cloudflare's network, which receives them encrypted, checks them for attacks and forwards them to our servers. In doing so, Cloudflare processes in particular your IP address, the address requested, browser details and security-relevant events.

6.9 Website Visitor Statistics

To understand how our public website (docket.rocks, excluding the docket application) is used, we record page views on our own servers: the page visited, the referring website, campaign parameters contained in the link, browser, operating system and device type, and a shortened IP address (the last part is removed). We do not use cookies or tracking scripts for this and do not combine this data with other information. Visits are grouped by a value derived from the shortened IP address and browser details, which does not allow us to identify you. When a workspace is signed up, we additionally tag that one visit with the identifier of the new workspace so that we can count sign-ups. For that visit the statistics can therefore be related to the workspace for as long as it exists; when the workspace is deleted, we remove the identifier. No data flows from the statistics into the workspace or your user account.

After 18 months, the shortened IP address, the browser details, the derived value, and the full address of the referring page are removed. What remains is anonymous statistical information.

Nothing is stored on or read from your device; the data is taken solely from the request your browser sends to our server anyway. Consent under section 25 of the German TDDDG is therefore not required.

6.10 Data From Integrations You Connect (Jira)

docket can exchange data with Atlassian Jira Cloud and, optionally, the Jira app Tempo Timesheets. This never happens automatically. It requires a manual setup: an administrator of the workspace connects the company's Jira site and links individual docket projects to Jira projects, and each user who wants their time sent to Jira connects their own Atlassian account. Workspaces that do not set this up exchange no data with Atlassian.

Once set up, the following data is processed:

  • from Jira into docket, for linked projects: Jira issues (key, title, status, priority, due date, description text, assignee) and the time logged on them in Jira (author, author's Atlassian account ID and name, date, duration, comment);
  • from docket to Jira: time entries a connected user books on a Jira ticket (date, duration, description), written to Jira under that user's Atlassian account;
  • for each connected user: their Atlassian account ID and display name, the email address of an API token where one is used, and the access credentials (API token or the authorization granted on Atlassian's consent page), stored encrypted;
  • for the Jira site connection: the access credentials the administrator enters (the email address and API token of the Jira account used to read issues, or an authorization granted on Atlassian's consent page) and, where used, a Tempo API token, stored encrypted.

To delete data of Atlassian accounts that have been closed, as Atlassian requires of apps that store such data, we regularly send the Atlassian account IDs stored in docket, together with the time we last updated them, to Atlassian, which tells us which accounts have been closed or changed. We then delete or update the related data.

6.11 AI Apps You Connect (MCP)

Users can connect AI apps such as Claude, ChatGPT, Cursor or Claude Code to docket through the Model Context Protocol (MCP). This never happens automatically. An administrator first has to allow AI connections for the workspace, and each user then connects an app themselves: they add docket to the app, log in to docket and confirm on docket's consent page. Workspaces that don't allow it, and users who don't connect an app, exchange no data with any AI app.

Once a user has connected an app:

  • the app reads, on the user's requests, the data that user can see in docket — projects, tickets, customers, time entries and the working hours they are compared against, and, only as far as the user's role shows them, budgets, colleagues' workload, quotations, invoices and revenue figures (for administrators also other users' time entries) — and the app's provider processes it;
  • the app can book, change and delete that user's own time entries;
  • we store the app's registration (its name and callback address), the user's consent, and access credentials for it — only as digests — together with when the connection was last used.

The user can disconnect an app in their profile settings at any time; a password change, the user leaving the workspace or an administrator turning AI connections off ends the access too.

6.12 Protection Against Automated Sign-ups

To prevent programs from creating workspaces in bulk, your browser solves a small computational puzzle (proof of work, ALTCHA library) when you submit the sign-up form; we serve and verify it ourselves. No data is sent to third parties, no cookie is set and no information about your device is collected. We also check whether a human filled in the form (an invisible field stays empty, submitting takes longer than a few seconds). We keep the solved puzzle briefly so that it can be used only once.

7. Purposes and Legal Bases of Processing

We process personal data for the purposes and legal bases described below.

7.1 Website Operation

We process technical data to provide the website securely and reliably.

Legal basis: Art. 6(1)(f) GDPR – legitimate interests in operating a secure and functioning website.

7.2 Account Registration and Platform Access

We process account and user data to create accounts, authenticate users, manage workspaces, assign roles, and provide access to the platform.

Legal basis: Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures.

7.3 Provision of the docket Platform

We process customer content and operational data to provide the platform functionality, including projects, tickets, time tracking, quotations, invoices, reports, file storage, and collaboration features.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) where we act as controller; Art. 28 GDPR and the Customer's documented instructions where we act as processor.

7.4 Billing and Payments

We process billing and subscription data to administer subscriptions, process payments, generate invoices, and manage payment status.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations, such as tax and commercial retention).

7.5 Transactional Emails

We process contact and account data to send transactional emails required for platform operation and account administration.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interests in operating the Service).

We send no marketing emails or newsletter. Should we ever do so, we will obtain your consent first (Art. 6(1)(a) GDPR).

7.6 Support

If you contact us for support, we process the information you provide to respond to and resolve your request.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interests in customer support).

7.7 Security, Fraud Prevention, and Abuse Prevention

We process technical logs, authentication records, and security events to protect the platform, detect abuse, prevent unauthorized access, and ensure system integrity.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests in the security of the platform) and, where applicable, Art. 6(1)(c) GDPR.

7.8 Legal Compliance

We process certain data to comply with accounting, tax, commercial, regulatory, and legal obligations.

Legal basis: Art. 6(1)(c) GDPR – compliance with legal obligations.

7.9 Product Improvement

We do not analyse usage or content data. What we see is the number of active users per workspace, since that is what we bill on (section 7.4), and the technical error and performance data described in section 6.8. We do not use Customer Data to train AI models.

Legal basis: Art. 6(1)(b) GDPR (billing) and Art. 6(1)(f) GDPR (legitimate interests in a reliable Service).

7.10 Website Visitor Statistics

We process the website visitor statistics described in section 6.9 to understand how our website is found and used, and to improve it.

Legal basis: Art. 6(1)(f) GDPR – legitimate interests in improving our website.

7.11 Jira Integration

We process the data described in section 6.10 to synchronize the workspace's linked projects and time entries with the customer's Jira site, as configured by the customer.

For the reconciliation of Atlassian account IDs (section 6.10) we act as controller: it fulfils our own obligations as the provider of an Atlassian app, not an instruction of the Customer.

Legal basis: Art. 28 GDPR and the Customer's documented instructions where we act as processor (the Customer decides to connect Jira); Art. 6(1)(f) GDPR (legitimate interests) and Atlassian's requirements for apps for the account-status checks described in section 6.10, to keep the data current and delete it once an Atlassian account is closed.

7.12 AI Apps You Connect

We process the data described in section 6.11 to give the AI app a user connected the access that user granted.

Legal basis: Art. 28 GDPR and the Customer's documented instructions where we act as processor (the Customer allows AI connections, the user connects an app); Art. 6(1)(b) GDPR (performance of a contract) for the connection itself.

7.13 Monitoring and Error Tracking

We process the log and error data described in section 6.8 to detect, analyze and fix errors and performance problems on our servers and in the browser.

Legal basis: Art. 6(1)(f) GDPR – legitimate interests in a functioning and reliable Service.

7.14 Protection Against Automated Sign-ups

We process the data described in section 6.12 to fend off automated sign-ups.

Legal basis: Art. 6(1)(f) GDPR – legitimate interests in protecting our Service against abuse.

8. AI Functionality

This section covers docket's own AI features. AI apps a user connects to docket themselves (for example Claude or ChatGPT) are not docket's AI features; see section 6.11.

docket currently has no AI features of its own and does not send customer content to any AI service provider. If we introduce such features, we will update this Privacy Policy and the Subprocessor List beforehand.

Customer content is not used by Evernow GmbH for training AI models.

Customers should not submit special categories of personal data to the platform unless they have a lawful basis and appropriate safeguards for doing so.

9. Cookies and Similar Technologies

We set no cookies on our public website (docket.rocks). Only the sign-up form sets a session cookie that protects the form against abuse and expires when the browser is closed.

In the docket application we use only strictly necessary cookies and comparable technologies:

  • a session cookie for sign-in and form protection, which expires when the browser is closed;
  • a cookie holding the application's access token (docket_api_token), readable only by the browser, valid until sign-out or for at most 24 hours;
  • a "stay signed in" cookie (remember_user_token), only if you choose that option when signing in, valid for 14 days;
  • a cookie holding your language choice for the sign-in pages (docket_locale);
  • the browser's local storage for interface settings, unsent comment drafts and navigation state; this data never leaves your browser.

The legal basis for these cookies is section 25(2) no. 2 of the German TDDDG (strictly necessary to provide the service you requested) in conjunction with Art. 6(1)(b) GDPR. A cookie banner is therefore not required.

We use no advertising, marketing or analytics cookies and no tracking pixels. Should we introduce non-essential cookies in the future, we will update this Privacy Policy and obtain your consent first.

10. Recipients and Service Providers

We use carefully selected service providers to operate docket. These providers may process personal data on our behalf or as independent controllers depending on their role.

Current providers include:

  • Fly.io for application hosting, infrastructure and the database (Fly.io Managed Postgres in Frankfurt, including its backups);
  • Amazon Web Services S3 for file and attachment storage;
  • Redis Cloud (Redis Inc., data stored in Frankfurt) for the background job queue, real-time updates, caching and rate limiting;
  • Stripe for payment processing and billing;
  • Postmark for transactional email delivery and for receiving replies to notification emails;
  • AppSignal for monitoring, server logs (including IP addresses), and error tracking on the server and in the browser;
  • Cloudflare for domain management and for routing and protecting all requests to docket.rocks and the application.

A current Subprocessor List is maintained at docket.rocks/legal/subprocessors.

Integrations the customer connects. If a workspace has set up the Jira integration (section 6.10), docket sends the data described there to Atlassian (and, where the workspace uses it, to Tempo) and receives data from them. These are the customer's own services, used under the customer's own agreements with Atlassian and Tempo; they are not service providers of Evernow GmbH. Without this manual setup, no data is sent to them.

The same applies to AI apps a user connects (section 6.11): what the app reads from docket goes to its provider (for example Anthropic for Claude or OpenAI for ChatGPT) under the user's or the customer's agreement with that provider. These providers are not service providers of Evernow GmbH, and nothing is sent to them unless a user connected the app.

Content from other servers. Where the application shows content a user has embedded from elsewhere – images in descriptions and comments, or the preview images of an RSS feed the workspace chose for the dashboard – your browser loads it directly from that server, which receives your IP address in the process. Whether and which content is embedded is decided by the Customer.

11. International Data Transfers

Some service providers may process personal data outside the European Economic Area, including in the United States or other countries that may not provide the same level of data protection as the European Union.

Where required, we rely on appropriate safeguards such as:

  • adequacy decisions;
  • the EU-U.S. Data Privacy Framework where applicable;
  • Standard Contractual Clauses;
  • data processing agreements;
  • supplementary safeguards where appropriate.

Where a customer connects Jira, where Atlassian and Tempo process the data depends on the customer's own agreements and settings with them (for example, Atlassian data residency). The same holds for the providers of AI apps a user connects (section 6.11).

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention criteria include:

  • account data is retained for the duration of the customer relationship;
  • a workspace whose signup was never confirmed by email is deleted 14 days after signup;
  • replies to notification emails are kept as received for 30 days after processing and then deleted; the reply address in a notification email stops working after 90 days;
  • customer content is retained while the customer's workspace is active;
  • administrators can download a complete export of the workspace at any time; when the subscription ends, the workspace's administrators can still sign in for 30 days, solely to download this export, and receive a reminder email before the workspace is deleted;
  • 30 days after the subscription ends, the workspace and all customer content in it are deleted completely;
  • database backups are kept for 10 days, so deleted data is also gone from the backups no more than 10 days after it was deleted;
  • billing, accounting, and tax records are retained according to statutory retention requirements;
  • logs and diagnostic data are retained only as long as necessary for security, troubleshooting, and reliability; our monitoring provider AppSignal deletes server logs and error reports after 30 days;
  • a user's Jira connection credentials are deleted when the user disconnects Jira; data of Atlassian accounts reported as closed is deleted or anonymized within the period Atlassian requires;
  • an AI app's access credentials stop working when the user disconnects it, changes their password or leaves the workspace;
  • the time and IP address of the last two sign-ins are stored in the user account until the account or the workspace is deleted;
  • the change history of the rates of customers, projects and services is stored with the workspace and deleted with it;
  • export files of a workspace are deleted 7 days after they were created;
  • support requests by email are deleted once your matter is resolved, at the latest after three years, unless a statutory retention obligation applies;
  • website visitor statistics are anonymized after 18 months by removing the shortened IP address, browser details, the derived visitor value, and the full referring address; the remaining anonymous statistics are kept.

13. Data Subject Rights

Subject to applicable law, individuals may have the right to:

  • request access to their personal data;
  • request correction of inaccurate personal data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing;
  • receive personal data in a portable format;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a supervisory authority.

Requests may be sent to [email protected]. We answer within one month (Art. 12(3) GDPR); for particularly complex or numerous requests this period may be extended by up to two months, of which we inform you within the first month.

If the request concerns personal data processed in a customer workspace, we may refer the request to the relevant customer, as the customer may be the controller of that data.

Right to object: Where we process personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

14. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Measures may include:

  • encryption in transit;
  • access controls;
  • authentication mechanisms;
  • role-based permissions;
  • logical tenant separation;
  • monitoring and error tracking;
  • backup procedures;
  • restrictions on internal access;
  • confidentiality obligations.

No system can be guaranteed to be completely secure. Customers are responsible for maintaining secure credentials, configuring user access appropriately, and ensuring that their users handle data lawfully.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes may be communicated by email, in-app notice, or publication on our website.