Privacy Policy

OpslyIQ Provider: itecbrains llc, a Georgia limited liability company, d/b/a OpslyIQ

Effective: September 1, 2026

OpslyIQ is used by two different groups of people, and their rights are different. Read § 1.2 before anything else if you are an employee.

This means that if you want to see, correct or delete your information, you should ask your employer. We cannot honour those requests on our own, because doing so would alter your employer's own records — records they are frequently required by law to keep, such as Form I-9 and wage records. When you contact us, we will refer you to your employer and assist them in responding. § 11 explains this in full.

- Identifiers: name, email address, telephone number, postal address. - Date of birth, used to derive minor status and apply hours restrictions. - Government identifiers: Social Security number or ITIN. Stored as an encrypted reference; only the last four digits appear in our database tables. - Financial account information: bank routing and account number for direct deposit. Stored as an encrypted reference; only the last four digits appear in our database tables. - Employment records: time entries, schedules, wages, tips, overtime, payroll inputs and estimates, role and pay rate, employment status. - Employment documents: Form I-9 and supporting documents, Form W-4, signed offer letters and handbook acknowledgments. - Expense receipts submitted through the Service.

- A photograph of the employee taken at the moment of the punch. This is a photograph. We do not perform facial recognition, do not extract facial geometry, and do not generate or store any biometric template or faceprint. The photograph is used solely for a human manager's visual review of a time entry. § 3 explains this further. - Precise geographic coordinates at the moment of the punch. These are precise — accurate to within a few metres or better — not approximate. They are used solely to verify that the punch occurred at the work site and to enforce a geofence the employer configures. A punch may be rejected or flagged for review based on distance from the work site.

We describe this separately because it is the item people most often ask about, and because being precise matters more than being reassuring.

What we do. We store a photograph taken at the punch, in a private storage bucket, accessible only through a short-lived signed link to authorized users of the employer's organization.

What we do not do. We do not run facial recognition. We do not measure or record facial geometry. We do not create a faceprint or template. We do not compare one photograph to another. We do not use any photograph to identify anyone. We do not use photographs to train any model, and we do not sell or share them.

A feature we have not built. Our system contains a per-employee consent flag reserved for an optional face-matching feature that does not exist today. If we ever build it, it will be off by default and will remain off for any individual for whom the employer has not first obtained a written release that complies with the biometric privacy law of that individual's jurisdiction. The flag exists so that the feature cannot be switched on without that release.

Retention. Clock-in photographs are deleted 90 days after capture. See § 6.

We use information to: provide, operate, secure and support the Service; authenticate users and enforce permissions; produce schedules, time records, labor analytics, payroll estimates and compliance readings; maintain integrations the Customer connects; detect and investigate security incidents, fraud and misuse; communicate about the Service, including billing, renewal and service notices; comply with law; and enforce our agreements.

Automated analysis. The Service produces analytics that flag individual time entries for manager review and that rank employees by a composite operational score. These outputs are decision support for a human reviewer. No employment decision — discipline, termination, change in hours or change in pay — is made by the Service. Under our Terms of Service the employer must independently review the underlying evidence and give the affected individual an opportunity to respond before taking any action.

Operational text analytics. Where the Customer uses our assistant features, operational text is sent to a third-party analytics provider to generate the response. Social Security numbers, bank and routing numbers, card numbers, employer identification numbers and personal names are removed before the text leaves our systems, and the same removal is applied before anything is written to our logs. Under our configuration, that provider does not use the content to train its models.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.

We also disclose information: to the Customer whose account the data belongs to; to professional advisers under confidentiality; in connection with a merger or sale of assets, subject to this policy; and where required by law or to protect rights and safety. We will notify the affected Customer of a compelled disclosure where we are lawfully able to.

A current list of sub-processors is maintained at the URL identified in the Data Processing Addendum. We give Customers thirty (30) days' notice before adding a sub-processor that processes workforce data.

We may retain information longer where required by law, or where necessary to resolve a dispute or enforce our agreements, and will delete it when that need ends. Deletion is performed on a schedule and recorded. Backups are overwritten in the ordinary course.

Employment records of former employees are deliberately retained for the periods above. Payroll and tax records must survive the end of employment, and archiving rather than deleting an employee is how the Service preserves them. Archived employees are excluded from the Location count and carry no fee.

Sensitive values — Social Security numbers, bank account details and integration credentials — are held encrypted at rest in a secrets vault and are readable only server-side by a privileged service role. They are never returned to a browser. Where the plaintext is never needed, values are stored as one-way hashes.

Separation between organizations is enforced at the database layer, not by application code, so one organization's records are unreadable by another organization's users regardless of how a request is made. Within an organization, access is further narrowed by role and by position in the Location hierarchy.

All file storage is private and reached through short-lived signed links. Authentication supports time-based one-time-password multi-factor authentication, enforced-MFA policy, single sign-on and SCIM provisioning. Every sensitive change writes an audit record capturing the before and after state.

No system is perfectly secure. We will notify affected Customers without undue delay after becoming aware of a breach affecting their data, and will provide the information they need to meet their own notification obligations.

We process and store information in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

We use cookies and similar technologies that are strictly necessary to operate the Service — session management, authentication and security — and a limited set for measuring product usage. We do not use advertising cookies and we do not participate in cross-context behavioural advertising. Where a browser transmits a Global Privacy Control signal, we treat it as a valid opt-out request under the state laws that require it.

The Service is not directed to children. We do not knowingly collect personal information from anyone under thirteen (13). If we learn that we have, we will delete it and notify the Customer.

Our Customers may lawfully employ minors, and the Service supports that: date of birth is collected so that hours and scheduling restrictions applicable to minors can be applied. Authorized Users enrolled by a Customer must be at least fourteen (14) years of age. A minor employee does not contract with us — the employer is the contracting party — and a minor's information is processed on the employer's instruction like any other employee's.

We will post a revised policy with a new effective date and, where the change is material, notify Customers by email at least thirty (30) days before it takes effect.

Annex 1 forms part of this policy and of our Terms of Service and governs our processing of workforce information on a Customer's behalf.

itecbrains llc d/b/a OpslyIQ, 5354 McGinnis Ferry Rd, Suite 224, Johns Creek, Georgia 30005. privacy@opslyiq.com