Privacy Policy

Part 1: RRYME LTD as controller

In this part, RRYME LTD decides why and how your personal data is processed, and is responsible for it as controller under the UK GDPR and, where it applies to us, the EU GDPR.

1. Who we are and how to reach us

RRYME LTD, 128 City Road, London, EC1V 2NX, United Kingdom. Company number 17017522, registered in England and Wales.

For anything about your personal data, write to privacy@absenca.com. For everything else, write to info@absenca.com or use our contact form.

We have not appointed a data protection officer, because the law does not require one for our processing. The address above reaches the people responsible for data protection at RRYME LTD.

2. What we collect, why, and for how long

For each purpose: the data, the legal basis, who receives it, and how long we keep it. Where a recipient is outside the UK, section 4 explains the safeguard.

• Your login. Name, email address, password (stored only as a salted hash), the account id of the sign-in provider if you use Google, Microsoft or Slack to sign in, and your sessions with IP address and browser. Why: to give you an account and keep it secure. Legal basis: contract, and our legitimate interest in security. Recipients: our hosting provider, and the sign-in provider you choose. Kept: for as long as your account exists; a session stops working 30 days after it was last used.
• Billing. For paid plans: the billing contact's name and email address, the organization's name, its billing address and tax ID where collected, the plan and the invoices. Card details go straight to Stripe; we never see or store them. Why: to charge for the service and keep accounting records. Legal basis: contract, and our legal obligation to keep accounting and tax records. Recipients: Stripe, which processes payments for us and is also an independent controller for fraud prevention and anti-money-laundering checks. Kept: for as long as tax and accounting law requires.
• Service email. Name, email address and the content of each message: invitations, sign-in and password emails, leave notifications and billing notices. Why: to run the service. Legal basis: contract. Recipients: our hosting provider, which sends the email, and Resend, a fallback email provider in the United States, which keeps delivery records under its own retention policy. Kept: a message that could not be delivered is retried and then deleted after 14 days; we keep no copy of delivered messages.
• Analytics, only with your consent. How you use this website and the web app, recorded by Microsoft Clarity. Section 5 explains what is recorded, the cookies and the retention.
• Support, privacy requests and complaints. Your name, email address and what you write to us. Why: to answer you, and to handle requests and complaints as the law requires. Legal basis: our legitimate interest in answering you, and our legal obligation for rights requests. Recipients: our hosting and email providers. Kept: for as long as we need to deal with your message and any follow-up.
• Security and operations logs. Your user id, your organization's id, the address you requested, and errors. Why: to keep the service secure and working. Legal basis: our legitimate interest in security and reliability. Recipients: our hosting provider. Kept: 30 days in our application log, and up to 7 days in our hosting provider's request logs.
• Product feedback. What you send through the feedback, bug-report and feature-request forms in the app, linked to your account. Why: to improve Absenca. Legal basis: our legitimate interest in improving the service. Recipients: our hosting provider. Kept: until your account is erased.
• Business statistics. Counts per organization, such as seats, leave requests and sign-ins, used to run and plan the business. Legal basis: our legitimate interest in running the business. Recipients: none outside RRYME LTD and our hosting provider. Kept: as aggregates, with no fixed end date.

3. Where the data comes from

Most of it comes from you. Some comes from your employer, who may invite you, import you from a spreadsheet or add you from Slack; from the sign-in provider you choose (Google, Microsoft or Slack), which gives us your name and email address; and from Stripe, which tells us whether a payment went through.

4. Where the data goes: international transfers

RRYME LTD is established in the United Kingdom. The European Commission recognises the UK as providing adequate protection (decision renewed in December 2025), so personal data can flow from the EU to us without further safeguards. Switzerland recognises the UK in the same way.

Absenca is hosted on Cloudflare's global network; specific regions are not guaranteed.

Our staff may access data from outside the UK, including from Kosovo. They do so as RRYME LTD personnel, through our cloud systems only, and customer data is not stored on their own devices.

Several of our providers are US companies. For transfers to them we rely on the standard contractual clauses in their data processing agreements, with the UK Addendum for data from the UK, and in addition on the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge) where the provider is certified. Our sub-processor list gives the safeguard for each provider.

5. Analytics: Microsoft Clarity

If you accept analytics cookies, absenca.com and the Absenca web app load Microsoft Clarity. It records how pages are used: page views, clicks, scrolling and mouse movement, as session recordings and heatmaps, together with your device, browser and approximate location.

In the web app, everything on the page is masked before it leaves your browser, so recordings show the layout but not your text, names or leave data; we tell Clarity only your user id and role, never your name or email address. On absenca.com, Clarity's default masking hides sensitive input such as email addresses and numbers.

Microsoft is an independent controller for this data, under the Microsoft Privacy Statement. Legal basis: your consent. Clarity keeps recordings for 30 days; favourite recordings and a random sample are kept for up to 9 months.

Nothing loads until you accept, and you can change your mind at any time with "Cookie settings" in the footer of every page. Withdrawing stops recording from then on; it does not affect what was recorded before.

• _clck: keeps a Clarity user id for this site, so that your visits can be linked. Lasts 1 year.
• _clsk: groups your page views into one session recording. Lasts 1 day.
• Microsoft may also use its own identifiers, as its privacy statement describes.
• Strictly necessary, set without consent: the sign-in session cookie in the web app, and your cookie choice and theme, stored in your browser.

6. Your rights

You have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• receive the data you gave us in a machine-readable format, or have it sent to someone else (portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing before you withdrew it;
• not be subject to decisions based solely on automated processing. We make no such decisions.

7. Using your rights, and complaints

To use any of these rights, write to privacy@absenca.com. We answer within one month. If a request is complex, we may extend that by up to two more months, and we will tell you why.

If you are unhappy with how we handle your data, please tell us first: write to privacy@absenca.com, or choose "Privacy complaint" on our contact form. We acknowledge every complaint and reply within 30 days.

You can also complain to the UK regulator, the Information Commission (ico.org.uk), or to the data protection authority in the EU country where you live or work, or where the issue arose.

Part 2: When your employer uses Absenca

When an organization uses Absenca for its staff, the organization is the controller of the leave data it puts in: names, work details, leave requests, balances, approvals, reasons, notes, and attachments such as sick notes. RRYME LTD processes that data only on the organization's instructions, under our Data Processing Agreement.

If you have a question or a request about your leave data, such as a copy, a correction or erasure, please contact your employer. If you write to us instead, we will pass your request on to them and help them answer it.

Some leave data can reveal health information, such as sick leave or a sick note. Absenca lets your employer mark a leave type private, so that colleagues see "Away" instead of its name in the app's calendar and team views. Channel digests, calendar feeds, shared team calendars, scheduled reports and out-of-office replies still show the leave type for now. Sick notes can be opened only by you and the people who approve your requests. And we ask that nobody enters diagnoses or medical details.

Your employer decides how long leave data is kept, and what happens to it when you leave. Your Absenca login itself is covered by Part 1.

8. Integrations

Integrations are optional. An admin of your organization (or you, for your own calendar) chooses to connect them, and can disconnect them at any time. Each one is your organization's own tool, under its own agreement with the vendor. For each: what it receives, why, how long it is kept, and how to delete it.

8.1 Slack

Receives: leave notifications, digests and replies to commands, in the channels and direct messages your admin sets up. Digests show who is away, when, and the leave type.

Absenca stores: the workspace id, the bot token (encrypted), and the Slack user id of each person it links to an Absenca user. Directory import reads names, email addresses, job titles and departments. Permissions requested: channels:join, channels:read, chat:write, commands, groups:read, im:write, users:read and users:read.email.

Why: so that people can be notified and request leave in Slack. Kept: while the app is connected.

Delete: an admin disconnects Slack in Absenca's settings or removes the app from Slack, which stops all access. To have the stored token and user links erased, write to privacy@absenca.com.

8.2 Microsoft Teams

Receives: leave notifications and digests, and replies to messages sent to the Absenca bot. Messages pass through Microsoft's bot service, which is our sub-processor.

Absenca stores: your Teams tenant id, the conversations the bot was added to, and the Teams user id of each person it links to an Absenca user.

Why: so that people can be notified and request leave in Teams. Kept: while the app is installed.

Delete: removing the app from Teams removes the conversations; to have the remaining links erased, write to privacy@absenca.com.

8.3 Google Chat

Receives: leave notifications and digests in the spaces the Absenca app is added to, and replies to messages sent to it.

Absenca stores: the space ids and the Google user id of each person it links to an Absenca user.

Why: so that people can be notified in Google Chat. Kept: while the app is in a space.

Delete: removing the app from a space removes that space; to have the remaining links erased, write to privacy@absenca.com.

8.4 Google Calendar

Receives: your approved leave, written as events in your calendar. For a shared team calendar, Absenca creates a calendar of its own and manages events only in that calendar.

Permissions requested: calendar.events (to create and update your leave events) and userinfo.email (to show which account is connected); for a shared team calendar, calendar.app.created. Absenca stores the access and refresh tokens (encrypted) and the ids of the events it created. It does not read your other events.

Why: so that your leave shows in your calendar. Kept: while the calendar is connected.

Delete: disconnect the calendar in Absenca, which stops syncing and removes our record of the events, and revoke access in your Google Account (myaccount.google.com/permissions). To have the stored tokens erased, write to privacy@absenca.com.

Absenca's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar feature you turned on. We do not sell it, use it for advertising, or use it to train AI models, and people at RRYME LTD read it only with your permission, to keep the service secure, or where the law requires.

8.5 Outlook and Microsoft 365

Receives: your approved leave, written as events in your Outlook calendar, or in a shared team calendar.

Permissions requested: Calendars.ReadWrite (to create and update the leave events), offline_access (to keep syncing) and User.Read (to show which account is connected). Absenca stores the tokens (encrypted) and the ids of the events it created.

Why: so that your leave shows in your calendar. Kept: while the calendar is connected.

Delete: disconnect the calendar in Absenca, which stops syncing and removes our record of the events, and remove Absenca's access in your Microsoft account settings. To have the stored tokens erased, write to privacy@absenca.com.

9. How we protect data

Data is encrypted in transit, and at rest by our hosting provider; Absenca also encrypts the tokens of connected tools. Access in the product follows roles. Our staff use a separate admin system, and their access to customer leave data is logged. Passwords are stored only as salted hashes. Our security page has the details.

10. Changes to this policy

Each version of this policy is dated, and earlier versions stay available at their own addresses, listed at the top of this page. Before a material change takes effect, we tell organization admins by email or in the app.