Privacy Policy

1. Our Role: Business Customer Contacts vs. Workforce Data

TimeTandem interacts with two categories of individuals. First, when a business signs up for the Platform, we collect information about the business and its point of contact directly, and with respect to that information we act as a business under the CCPA. Second, once a Customer's account is active, the Customer's own employees, managers, and owners ("Authorized Users") use the Platform to view schedules, clock in and out, and access attendance information, and Customer submits or generates Authorized User data within the Platform. With respect to that Authorized User workforce data, TimeTandem acts as a service provider to the Customer, who remains responsible as the business for that data. If you are an Authorized User and have questions about how your employer uses your information, we encourage you to contact your employer directly; your employer can also direct requests to us as described in the Data Processing Addendum that governs our relationship with them.

2. Categories of Personal Information We Collect

2.1 Account and billing information: name, business name, email address, phone number, billing address, and payment information, which is processed by our third-party payment processor.

2.2 Workforce data: Authorized User names, employment role, shift schedules, clock-in and clock-out times, attendance records, and gross pay calculations generated by the Platform. We do not collect Social Security numbers, bank account numbers, W-4 information, or government identification through the Platform's current payroll-related functionality.

2.3 Location data: precise geolocation information collected at the moment an Authorized User clocks in or clocks out, used for punch verification and geofencing. We do not continuously track an Authorized User's location in the background between clock-in and clock-out events. Precise geolocation is treated as sensitive personal information under the CCPA, and the rights described in Section 8 apply to it.

2.4 Messages: the content of messages Authorized Users exchange through the Platform's messaging functionality, which is intended for participant-only communication. Customer's administrators do not routinely have access to read private Authorized User messages, though separate administrative functionality may apply to organization or team-level communications where made available within the Services.

2.5 Usage and device data: log data, device and browser information, and similar technical data collected automatically when the Platform is used.

2.6 Communications: information provided when contacting customer support or otherwise communicating with us.

3. How We Use Personal Information

We use personal information to provide, maintain, and secure the Platform; to process payment for subscriptions; to communicate with Customers about their accounts and the Services; to provide customer support; to detect and prevent fraud and security incidents; to comply with legal obligations; and to improve the Platform, consistent with the limited business purposes described in our Data Processing Addendum with Customers. We do not use workforce data to make hiring, firing, or discipline decisions about Authorized Users; those decisions remain the Customer's, as the employer.

4. How We Share Personal Information

We share personal information with service providers that help us operate the Platform, currently Stripe (payment processing), Railway, Vercel, and Neon (application hosting, compute, and database infrastructure), and Cloudflare R2 (object storage), under contracts that limit their use of the information to providing services to us. We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising or any other advertising purpose, as those terms are defined under the CCPA. We may also disclose personal information where required by law, to protect the rights and safety of TimeTandem or others, or in connection with a merger, acquisition, or sale of assets.

5. Data Retention

We retain personal information for as long as reasonably necessary to provide the Platform to an active Customer. Following cancellation or termination of a Customer's account, we provide approximately a thirty (30) day period during which Customer Data, including Authorized User personal information, remains available for export, after which we delete or de-identify it, except to the extent we are legally or contractually required to retain specific records for a longer period. This is the same retention approach described in our Terms of Service and Data Processing Addendum.

6. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction, appropriate to the nature of the data we process. No system is completely secure, and we cannot guarantee absolute security.

7. Your Privacy Rights

Depending on where you are located, you may have rights to know what personal information we hold about you, to request access to or a copy of it, to request correction of inaccurate information, to request deletion, to opt out of the sale or sharing of personal information or its use for targeted advertising, and to be free from discrimination for exercising these rights. Where a right under this Section relates to workforce data controlled by your employer rather than by TimeTandem directly, we will refer your request to your employer and provide reasonable assistance in responding to it, consistent with our role as a service provider under the Data Processing Addendum. To exercise a right described in this Section, contact us using the information in Section 11.

8. California Privacy Rights

This Section applies to California residents and supplements the disclosures above, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). California residents have the right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purpose for collection, and the categories of third parties with whom we share personal information; the right to request deletion of personal information, subject to certain exceptions; the right to request correction of inaccurate personal information; the right to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information, to the extent applicable; and the right not to receive discriminatory treatment for exercising a CCPA right. As of January 1, 2023, California employees, job applicants, owners, directors, and business contacts are treated as consumers under the CCPA, and the disclosures in this Section extend to Authorized User workforce data we process as a service provider, consistent with Section 1 above. California residents may designate an authorized agent to submit a request on their behalf, subject to our ability to verify the request.

The Platform does not currently use artificial intelligence or automated decision-making technology. If TimeTandem introduces automated decision-making technology in connection with scheduling or attendance features in the future, we will provide the pre-use notice, opt-out rights, and any required risk assessment disclosures applicable to that technology under California's automated decision-making technology regulations then in effect, before deploying such technology in a way that triggers those requirements.

Precise geolocation data, described in Section 2.3, is sensitive personal information under the CCPA. California residents may direct us to limit our use of sensitive personal information to what is necessary to perform the Services by contacting us using the information in Section 11; because we collect Location Data only for punch verification and geofencing at the moment of a clock-in or clock-out event, and do not use it for any other purpose, that is already the extent of our use.

9. Additional State Privacy Disclosures

Residents of Virginia, Colorado, Connecticut, Texas, Utah, and other states with comprehensive consumer privacy laws have rights that are similar in substance to those described in Section 8, including rights to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects, to the extent those rights apply under the law of the resident's state. To exercise a right under this Section, contact us using the information in Section 11; we will not discriminate against you for making a request, and if we deny a request, you may have the right to appeal that decision by contacting us.

A number of states, including Connecticut, require an employer that engages in electronic monitoring of its employees to give prior notice of that monitoring. Because location tracking and any administrative access to Platform messaging are configured and controlled by Customer as the employer, Customer, not TimeTandem, is responsible for providing any notice required under its own state's electronic monitoring, wiretapping, or eavesdropping laws before enabling or using those features. This Privacy Policy describes how TimeTandem itself handles this data; it does not substitute for the notice Customer may separately owe to its own Authorized Users under the law of its own state.

Illinois and New York do not currently have a comprehensive consumer privacy law comparable to the CCPA. TimeTandem does not currently use biometric identifiers, such as fingerprint or facial recognition data, for time and attendance tracking. If TimeTandem introduces biometric time-clock functionality in the future, we will provide the notice, consent, and retention-schedule disclosures required by the Illinois Biometric Information Privacy Act and comparable state biometric privacy laws before deploying that functionality.

10. Children's Privacy

The Platform is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from individuals under the age of sixteen.

11. Contact Us

Questions about this Privacy Policy or requests to exercise a privacy right may be directed to TimeTandem, LLC, Columbus, Ohio, at privacy@timetandem.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law, including as the Platform's features evolve. We will post the updated Privacy Policy with a new effective date, and, for material changes, will provide additional notice as required by law.