Privacy Policy

Last Updated: June 9, 2026

Introduction

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our SAMM for Work mobile application and website (collectively, the "Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

This Privacy Policy is provided by SAMM Tech LLC, a company registered in Georgia, United States ("we," "us," "our").

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide to us when you register for an account, use the Service, or otherwise contact us. The personal information we collect includes:

• Account Information: Email address, first name, last name, optional phone number (used for SMS one-time-code login), account access level (for example Employee or Administrator), job title if your organization assigns one, employment type
• Organization Information: Organization name, assigned location
• Work-Related Data: Tasks, messages, schedules, leave requests, availability, time entries
• Profile Photos: Photos captured in kiosk mode for clock-in/clock-out verification

Location Information

• GPS Coordinates: Latitude, longitude, accuracy (in meters)
• Geofencing Data: Distance from assigned work location, entry/exit events

For Other User Types: Location tracking is not enabled for administrators, accountants, and salaried employees. These users can use the Service without providing location access.

Device Information

We automatically collect certain information about your device when you access the Service:

• Device Identifiers: Unique device ID, device model, operating system version (transmitted to our servers to register the device for push notifications and diagnostics)

The app also reads battery level, charging status, and internet connectivity status from your device. This information is used only on your device to optimize location tracking (for example, reducing GPS polling when the battery is low and queuing data when offline). These values are not transmitted to our servers and we do not collect, store, or have access to them.

Usage Information

• Time Tracking Data: Clock-in and clock-out timestamps, work hours, attendance records
• GPS Signal Quality: Signal loss and recovery events (to ensure accurate time tracking)
• App Activity: Feature usage, settings preferences

Billing and Payment Information (Organization Billing Contacts Only)

• Name and email of organization administrators designated for billing
• Organization billing configuration (plan, billing interval, billable user counts)
• Payment method type on file (for example, card or U.S. bank account)
• Invoice and payment status, amounts, and failure reasons

Important: SAMM for Work does not store full credit card or bank account numbers. Payment details are collected and stored by Stripe, our payment processor.

Push Notification Tokens

We collect Firebase Cloud Messaging (FCM) tokens to send you push notifications about:

• Task assignments and updates
• Schedule changes
• Important announcements from your organization
• Chat messages

How We Use Your Information

We use the information we collect to:

1. Provide and Maintain the Service
   • Create and manage your account
   • Enable clock-in/clock-out functionality
   • Track work hours and attendance
   • Verify you are at your assigned work location during clock-in
   • Process and display your timesheets and payroll data
2. Communicate With You
   • Send push notifications about work-related updates
   • Respond to your inquiries and support requests
   • Send administrative information and updates
3. Process Organization Billing
   • Manage subscription billing and payment methods for subscribing organizations
   • Send billing-related notifications to authorized organization administrators
4. Improve the Service
   • Analyze usage patterns to enhance features
   • Monitor and resolve technical issues
   • Optimize GPS tracking accuracy and battery efficiency
5. Ensure Security and Compliance
   • Prevent fraud and unauthorized access
   • Comply with legal obligations
   • Enforce our terms and conditions
6. Analytics
   • Understand how users interact with the Service
   • Improve user experience and app performance

Data Storage and Security

Data Storage

All data collected through the Service is securely stored on Google Cloud Platform (GCP) infrastructure. We use industry-standard cloud storage services to ensure:

• High availability and reliability
• Regular automated backups
• Secure data centers with physical security measures
• Geographic redundancy

Photos captured through kiosk mode are stored in Google Cloud Storage with secure, time-limited access URLs.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Authentication Security: Secure authentication methods with encrypted tokens and secure session management
• Authentication: JWT (JSON Web Token) based authentication with secure refresh token mechanism
• Access Controls: Permission-based controls tied to each user’s account access level
• API Security: Secure API endpoints with request validation and authentication requirements

Despite our security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but strive to use commercially acceptable means to protect your personal information.

Third-Party Services

We use the following third-party services that may collect, process, or store your information:

Google Cloud Platform (GCP)

• Purpose: Primary data storage and hosting infrastructure
• Data Processed: All user data, time tracking data, location data, photos
• Privacy Policy: https://cloud.google.com/privacy

Firebase Cloud Messaging (Google)

• Purpose: Push notifications
• Data Processed: Device tokens, notification preferences
• Privacy Policy: https://firebase.google.com/support/privacy

Firebase Crashlytics (Google)

• Purpose: Mobile crash reporting and diagnostics
• Data Processed: Crash logs, non-fatal error diagnostics, app and device metadata (no direct PII by default)
• Privacy Policy: https://firebase.google.com/support/privacy

Firebase Analytics (Google Analytics for Firebase)

• Purpose: Usage analytics and app performance monitoring
• Data Processed: App usage statistics, device information (anonymized)
• Privacy Policy: https://policies.google.com/privacy

Stripe, Inc.

• Purpose: Subscription payment processing and secure payment method storage
• Data Processed: Billing contact information, payment method details (card or U.S. bank account), transaction and invoice data
• Privacy Policy: https://stripe.com/privacy

These third-party service providers have access to your personal information only to perform specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Data Sharing and Disclosure

We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

When We May Share Your Data

We may share your information only in the following circumstances:

1. Within Your Organization
   • Your employer/organization can access your work-related data (time entries, location during work hours, tasks, schedules)
   • Administrators and managers within your organization can view relevant data for workforce management purposes
2. Service Providers
   • We share data with third-party service providers (listed above) who assist in operating our Service
   • These providers are contractually obligated to keep your information confidential
3. Legal Requirements
   • We may disclose your information if required by law, court order, or government regulation
   • To protect our rights, privacy, safety, or property, and that of our users
4. Business Transfers
   • In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity

Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: Upon account deletion or termination, we retain data for 90 days for backup and recovery purposes, then permanently delete it
• Time Tracking Records: May be retained for up to 7 years to comply with employment and tax record-keeping requirements
• Location Data: Historical location data is subject to organizational data retention policies

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

For All Users

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Objection: Object to our processing of your personal information
• Portability: Request transfer of your data to another service

GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority
• Right to restrict processing of your personal information
• Right to data portability in a structured, commonly used format
• Analytics consent model: OFF by default for EU device locales; you can opt in via Settings > Privacy & Data and withdraw at any time

CCPA Rights (California Users)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Know what personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of personal information we collected from you
• Right to Opt-Out: Opt-out of the sale of personal information (note: we do not sell your data)
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights

How to Exercise Your Rights

Location Tracking Controls

Permission and Consent

Location tracking requires explicit permission:

• You must grant location permissions when prompted by your mobile device
• For Android users, background location access is required for automatic time tracking
• You can revoke location permissions at any time through your device settings

How to Disable Location Tracking

• App Settings: Disable automatic time tracking in the app settings
• Device Settings: Revoke location permissions for the SAMM for Work app
• Contact Your Administrator: Request to be changed to a non-location-based employee type

Note: Disabling location tracking may affect certain features like automatic clock-in/clock-out and geofencing.

Children's Privacy

SAMM for Work is a workforce management tool provided to organizations (employers) for use by their authorized employees and staff. Accounts are created and managed by the subscribing organization, not by individual users.

SAMM for Work does not collect age or date-of-birth information. The subscribing organization is solely responsible for verifying that any person it authorizes to use the Service meets all applicable minimum employment age requirements under local, state, and federal law.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has been provided access to the Service, please contact us at [email protected] and we will delete such information.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

We take appropriate measures to ensure that your personal information remains protected in accordance with this Privacy Policy, including:

• Using standard contractual clauses approved by the European Commission
• Ensuring third-party service providers comply with GDPR requirements
• Implementing appropriate technical and organizational safeguards

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by:

• Updating the "Last Updated" date at the top of this Privacy Policy
• Sending a notification through the app or via email
• Displaying a prominent notice within the Service

Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.

Do Not Track Signals

Some web browsers have a "Do Not Track" feature that signals to websites you visit that you do not want to have your online activity tracked. Our Service does not currently respond to Do Not Track signals.

Contact Us

---

This privacy policy was last updated on June 9, 2026. By using our Service, you acknowledge that you have read and understood this Privacy Policy.