Privacy¶
Last updated: 5 November 2026. Publisher and processor: MVdW-Software, Draaiersstraat 33, 9300 Aalst, Belgium (VAT BE 0729.544.225).
You are the controller of your data. MVdW-Software processes it as your processor to run the subscription: the synchronization of GitLab and Exact Online happens on our servers, on your behalf, and only within your organization.
For the technical detail of how the data is handled and protected, see Data & Security.
What we store, and why¶
| Data | Where | Why |
|---|---|---|
| The GitLab access token of each connection | encrypted in the app's database (AES-256-GCM, one key per organization; only its last four characters are ever shown) | to call the GitLab API. It is never shown again after it is saved, never logged, and can be replaced at any time from GitLab connections |
| The linked projects and their sync state (cursors, the last run, the hashes of the written lines) | the app's database, per organization | to keep the sync idempotent and resumable; the hashes are what make a run never write the same line twice |
| The GitLab usernames and e-mails of the people who logged time, and their match to an Exact employee | the app's database, per organization | so a time log lands on the right employee |
| The webhook secrets of your projects | as a SHA-256 hash (the secret itself is not kept) | to verify that a webhook came from your GitLab |
| Account, organization and billing records | in the portal | to run the subscription |
What we do not store¶
- Exact data is passed through, not kept. The sync reads a time log, writes the hour line, and discards the rest: we hold no copy of your Exact projects, employees, invoices or any other Exact data, only the identifiers and hashes a correct next run needs.
- No GitLab source code. The sync reads time logs, issues, milestones and project metadata, never the code, branches or diffs of your projects.
- No Exact refresh tokens in this app. The portal's Exact token broker hands the sync a short-lived access token (10 minutes, memory only) per call; the refresh token stays in the portal, encrypted.
- No telemetry or tracking. The service has no analytics, no license check and no advertising.
What leaves our servers¶
| To | What | Why |
|---|---|---|
| your GitLab instance | the token's calls (time logs, issues, labels) and the writes the sync performs (draft hour lines are written to Exact, labels to GitLab) | the purpose of the service |
Exact Online (start.exactonline.*) |
the same, for the enabled administrations | the purpose of the service |
| Mollie | the payment for the subscription, in the portal | billing |
The writes to GitLab and Exact are exactly what is described in How the sync works: draft hour
lines, WBS lines and the exact::… labels, nothing else.
Your responsibilities¶
- Give the GitLab token only the access it needs (a project or group token with an expiry date is the recommendation; Replace token rotates it without touching the linked projects).
- Keep the portal's admin accounts protected: changes in GitLab Sync require an organization admin and two-factor authentication, and the audit log in the portal records who changed what.
- Remember that a token with the
apiscope may write labels on the GitLab projects it can see.
Your rights and deletion¶
Questions about your data, or a request for export or deletion, go to info@mvdw-software.com. Deleting an organization in the portal deletes everything the app stores for it (connections, links, people, sync state), immediately.