Legal
Privacy policy
This policy explains what Mycroscope does with personal information. It covers the public website, the signed-in app, and the Windows desktop app. It is written for the Protection of Personal Information Act (POPIA). It is not legal advice for your organisation.
The terms of service govern use of the product. Questions about this policy go through the support form.
1. Two roles
When a company uses Mycroscope to record its people, that company decides why the recording happens and what the monitoring notice says. Under POPIA, that company is the responsible party for the activity records.
Mycroscope stores and shows those records so the company can run the product. For that activity, Mycroscope is an operator. Mycroscope does not use a customer’s activity to advertise, and Mycroscope staff cannot open the contents of a customer’s activity.
Mycroscope is the responsible party for its own account, billing, and support records.
2. Information the product stores
Account
Name, email address, organisation name, role, a password held by the sign-in service, and an optional authenticator code for two-factor login. Invitations and activation codes are stored until they are used or they expire.
Activity
After a person acknowledges the company’s monitoring notice, the desktop app can store:
- Active, idle, and away time.
- The application name and the website.
- The window title and the full web address, only if the company turns that on. The notice says so.
- Answers for meetings, calls, breaks, or other time away from the computer, when that prompt is on.
- On Workforce Management, the names and sizes of files copied to a removable drive, a cloud folder, or a network drive, and that a phone or other drive was connected. The contents of files are not read. Files copied onto a phone are not listed.
- Computer name, operating system, agent version, and the time the agent last checked in.
Billing
Plan, number of people, amount, currency, payment reference, and the invoice. Card numbers are handled by the card payment provider. Mycroscope does not store the card number.
Support
If you use the support form, Mycroscope keeps the name, email, organisation, topic, and message you send, so the question can be answered.
Technical logs
The hosting and database services keep ordinary logs, such as IP address and the time of a request, to run and protect the service. The audit log inside the app records sensitive actions, including when a manager opens another person’s detail.
3. What is not collected
Mycroscope does not photograph the screen, does not read documents or email bodies, and does not sell personal information. A customer can grant a short support window. That window shows agent status only: whether the desktop app is installed, the computer name, the version, and the last check-in. It does not show activity.
4. Why it is used
- To create and secure the account, including optional two-factor login.
- To record and show activity as the company’s notice describes.
- To produce dashboards, exports, and, on Productivity Optimization, written reports from figures already stored.
- To charge for the plan, keep invoices, and apply a confirmed payment.
- To answer a support question.
- To investigate abuse, such as a bad install or a payment that does not match the checkout.
The company that employs the person must have its own lawful basis for the monitoring and must say so in the notice. Mycroscope’s basis for account, billing, and support information is the contract with the organisation and the steps needed to run that contract.
5. Who can see activity
- The person can open their own activity on every plan, including Free.
- Owners, and managers allowed to see that person, can open the wider record. A manager limited to certain teams does not see other teams.
- Live “who is working right now” is included from Work Activity Tracking upward. On Free, a manager sees the name and today’s active and idle time.
- Mycroscope operators can suspend, restore, or, after cancellation, delete an account. They cannot read activity contents.
6. How long it is kept
Detailed activity is kept for 30 days on Free, 6 months on Work Activity Tracking and Workforce Management, and 12 months on Productivity Optimization. The owner can choose a shorter period. A shorter period hides older charts. The nightly clean-up deletes detail that is past the longest plan window, or past the shorter period the owner set.
Names and sizes of copied files follow the company’s file-retention setting, from 7 to 365 days, with a default of 30 days.
Account and billing records are kept for as long as the organisation exists and for as long as tax and accounting rules require the invoices. Support messages are kept long enough to resolve the question and keep a record of it. Server logs are kept for the period set by the hosting provider.
Deleting the organisation is available only after the subscription is cancelled. An operator must type the organisation name. That deletion removes the people, activity, policies, and audit history for that customer, and removes their logins.
7. Service providers
Mycroscope uses other companies to run the service:
- Supabase, for the database, sign-in, and server functions.
- The host that runs the Mycroscope containers, for the website and the signed-in web app. Support questions are stored there until they are answered.
- The card payment provider, for the hosted payment page and the payment confirmation. Mycroscope does not receive the card number.
- An email provider, when the organisation has turned on manager email or billing email. Until that provider is connected, those messages are not sent.
These providers may process information outside South Africa. Mycroscope uses them to provide the service the organisation asked for. The organisation remains responsible for telling its people about the monitoring.
8. Security
Access to another person’s record is limited by role and team, and those views are written to the audit log. Owners can require two-factor login for managers. The desktop installer asks for the company install key so a person cannot reinstall the agent on their own. No method of transmission or storage is perfect. A suspected incident can be reported on the support form.
9. Rights
An employee who wants to see, correct, or object to activity recorded about them should start with their employer. The information officer named in the company’s monitoring notice is the contact for that organisation. The employer decides the monitoring. Mycroscope will help the organisation respond where the product stores the record.
For Mycroscope’s own account, billing, or support records, use the support form. You may also lodge a complaint with the Information Regulator of South Africa.
10. Children
Mycroscope is a workplace product. It is not directed at children, and accounts are not opened for children.
11. Cookies and the browser
The public pages do not set an account cookie. The signed-in app stores the sign-in session in the browser so you stay signed in. The hosting provider may record the IP address and time of a request in its logs.
12. Changes
If this policy changes, the new version will be posted on this page with a new effective date. Where a change affects activity already being recorded, the company’s monitoring notice is the notice its people acknowledge inside the product.
13. Contact
Privacy questions: support form. Choose the topic “Privacy”.