Privacy Policy
Draft update: business positions approved September 7 for implementation. Staffing, insurance, verified data disposal, vendor evidence and customer-specific terms remain prerequisites; this summary is not an executed agreement or proof of current capability.
Provider-side prospect and account administration also processes business contact information, communications and pre-tenant intake forms, which can exist before a customer organization is created. Retention and rights handling for these records must be finalized separately from workforce processing.
Information processed
RostrOps processes worker and site-leader identity, badge numbers, ID photos, NFC card identifiers, role and craft assignments, scan-in and scan-out sessions, work areas, attendance status, limited time-off and call-in metadata, administrator email addresses, device tokens, and authentication/audit metadata.
When a worker self-scans in without a site leader present, the mobile app additionally captures a self-scan selfie — reviewed by the worker's supervisor to confirm identity — and a single device location reading at that moment, used to advisorily check the worker is at the job site. Location is read only at scan-in, never in the background, and never used for continuous tracking; a denied location permission does not block scan-in.
Information not collected
RostrOps has no dedicated fields or supported workflows for Social Security numbers, dates of birth, government IDs, protected-class demographics, payroll rates, bank information, or payment-card details. Customers should not submit unsupported sensitive data; free text and uploads may nevertheless contain it. NFC badges are ID tokens, not fingerprints or biometric identifiers. ID photos and self-scan selfies are plain photographs reviewed by people; no facial-recognition processing is performed.
How information is used
The platform uses data to verify site presence and authority, support site safety and access control, manage attendance and NCNS workflows, process assignments and transfers, support time-off and call-in workflows, generate reports, calculate customer billing, secure the platform, and maintain audit records.
Service providers
RostrOps uses Microsoft Azure for hosting and Application Insights request, dependency and exception diagnostics, Resend for transactional email, Expo for mobile push notifications, Anthropic for optional AI features when enabled by the customer, and weather/geocoding/timezone services: conditional Tomorrow.io, US National Weather Service, Open-Meteo, Nominatim and timeapi.io.
The public site requests Google Fonts, and the web location picker requests OpenStreetMap tiles. Those requests expose browser network information to the providers. Recognized identities in optional AI prompts are tokenized, but residual free text and site context can still identify people.
Processing locations
The inspected Azure API and database are in Central US; file storage is in East US. Vendor processing, support and global delivery locations require separate confirmation before any US-only commitment.
Retention and rights
The approved drafting schedule is 90 days for scan selfies/precise GPS, profile photos removed within 30 days of offboarding, three-year operational records, 90-day raw diagnostics, relationship-plus-one-year administrative/contractual audit evidence, and seven-year provider accounting with minimized worker detail. These periods require implementation and customer agreement; they are not universally enforced current behavior. Closeout provides a 30-day export request window, delivery within 14 days of request, 30 days for retrieval and day-90 active disposal, subject to documented lawful retention/holds. Backups and previous versions require separate disposal verification. Worker requests should start with the responsible employer or site operator.
Counsel items before publication
- Confirm privacy contact email, mailing address, and TDPSA response/appeal language.
- Verify the approved retention and export/disposal schedule before publication.
- Confirm subprocessor list and whether geocoding/weather providers should be listed.
- Confirm AI-feature disclosure, including residual free-text handling.